1

I don't see much chance of persuading non-techie friends and family to use Tor or TAILS. So sending them e-mail from TAILS will identify me for other traffic on the same circuit? Or does SMTP and HTTP use separate paths?

There's even less chance of getting them to use PGP, so perhaps the other question is irrelevant.

Finally, how can they reply without going to my ISP? which would identify me again. I can set up an e-mail server, but without a hostname or IP address, no one can talk to it.

I'm one of thoe fellows who "doesn't have anything to hide," but I like the idea of snubbing the snoops. :-)

Improve this question

2 Answers 2

Reset to default
0

Tor and Claws together are not sufficient for anonymous e-mail. Here's why:

Claws mail is included in Tails because many people like the convenience of having a mail client. Tails allows you to save mail from Claws in the persistent volume (on USB sticks) https://tails.boum.org/doc/anonymous_internet/claws_mail/index.en.html which is quite handy.

However a mail client alone does not provide any anonymity.

Tails is supposed to send all traffic over the Tor network by default and because, like HTTP, SMTP can and most often does use TCP on the transport layer it should be fairly simple to send traffic from Claws through the Tor network.

This does not solve the problem of sending anonymous email though.

First of all you would need to create an anonymous email account anonymously (on Tor) and if you want to use Claws on Tails you can link your new email account to Claws.

(If you connect to an email account that is already associated with your real identity or ip address using Claws on Tails the best you can hope to achieve is to hide your location while you are sending emails)

There is no point going to these lengths if you are unable to convince your friends and family to (at the very least) create their own anonymous email accounts and always communicate with your anonymous email account from theirs. This is so that you can't be deanonymized by simply checking who you are talking to (in this case the metadata alone could be enough to reveal your true identity). Of course if the content of your emails could also be enough to reveal your identity, the emails would have to be encrypted too (PGP).

So there is no simple solution to anonymous communication over email and starting down the path of secure/anonymous communications only to get quickly deanonymized will just draw attention to you.

If you do not find it necessary or achievable to go to at least the lengths described above then you really only have one sensible option, which is to use a large, common email provider on the clear net and avoid putting your whole life into an email message. This will give you the best chance of blending in with the masses and getting ignored by snoops. In my honest opinion 'snubbing the snoops' just because doesn't do anyone any favors.

Improve this answer
1
  • 2
    My unverifiable hypothesis is that a sufficient level of protected but innocent traffic would be incentive for them to use fewer shotgun collections and more targeted collections.
    – WGroleau
    Commented Sep 20, 2015 at 21:13
0

Finally, how can they reply without going to my ISP? which would identify me again. I can set up an e-mail server, but without a hostname or IP address, no one can talk to it.

Even if you ran your own mail server in the basement, your connection to the outside world would still be via an ISP. The big ISPs - or, rather, the telcomms - are the companies that own the wires. Regardless of how you look at it, and how neutral you think the internet should be, it basically comes down to somebody owning the hardware and infrastructure (and having spent lots of money to implement it). This is also what makes traffic correlation attacks possible in the larger autonomous systems: an ISP can own enough of the network to look at both where your traffic enters and exits the Tor network.

If you want to really run without an ISP you're into the realms of becoming your own ISP, obtaining a block of IP addresses from IANA (or from a larger ISP), and doing a host of other complicated things. There's an interesting discussion on ISPs/GSPs here: http://www.techrepublic.com/forums/questions/theoretical-internet-without-isp/.

Improve this answer
3
  • Are there really any ISPs that "own enough of the network" to correlate my entry and exit packets? I've seen exit nodes in several different countries, on at least three continents. And the more nodes they watch, the harder it is to match one of (how many thousand?) inputs per second to one of as many outputs. Especially if they can't guarantee the exit is one of the nodes they are watching.
    – WGroleau
    Commented Sep 20, 2015 at 21:21
  • "Are there really any ISPs that "own enough of the network" to correlate my entry and exit packets?" Almost certainly. The same multinational conglomerate could own an ISP in one country (e.g. your entry guard's country), and also own, or own a significant part of, an ISP in another country (e.g. your exit node's country). This doesn't have to extend to network ownership: there's nothing stopping one ISP from paying for information from another. The trick is to try to make entry and exit nodes as disparate as possible, but this almost certainly won't be foolproof.
    – Richard Horrocks
    Commented Sep 21, 2015 at 13:01
  • "And the more nodes they watch, the harder it is to match one of (how many thousand?) inputs per second to one of as many outputs." It's not just a case of watching incoming and outgoing packets and trying to correlate the two. An adversary could also introduce lags and spikes into the network, which would make statistical analysis of traffic at the two end points easier to perform.
    – Richard Horrocks
    Commented Sep 21, 2015 at 13:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .