Email

From The Uncensored Hidden Wiki
Jump to: navigation, search

Conclusion

As was to be expected, free e-mail hosters do not offer good security, because they hardly can make money that way. There are / were some almost non-commercial hosters who focus on anonymity, but many were cypherpunks who ran out of funds at some point and stopped the projects. Some hosters claim good security but you have to exercise some caution. Hushmail is the most blatant bigmouth out there who - however - can read your secret key actually, but they say, they "usually" don't. What a joke :-(

Now what?

http://en.onion.marketmail.info/what.html may be a good option. To be on the safe side, you may want to consider running your own mail server there.

List

This page lists a variety of realworld Email services. The tables primarily denote areas of interest and useability for the anonymous community. We aim to make it the canonical one stop reference for choosing Email providers. (This framework and data is imported and synced with another project. Feel free to edit it.)

  • These are realworld services. Using them to harass people or break the law WILL cause them to ban anonymous networks, that hurts everyone. All it takes is one bad case. So PLEASE, use them responsibly!
  • Volunteer what you know
- Take a moment to find a new provider, then fully test and list them.
- Pick a listed provider, then verify that their listing details are still accurate.
  • Some selection/usage tips
- Source IP addresses - It is usually not desirable to allow the recipient to learn the mail came from Tor (or anywhere else). Those people or use cases might thus discount the authenticity of what was sent. Look at the headers to see if mail claiming to be from a person is in fact from their location. If it's not, it may be suspect. Without an IP, it can't be called either way.
- Doomsday Provisions - Consider creating a stockpile of pristine unused email accounts at the major free providers so that, if they begin barring signups from exits, access to new accounts will still be possible, at least until logins from exits are also blocked. If an account hasn't been used in a while, many providers will mark the account dormant (no mail delivery/storage), or they will simply delete the account. So checking it once in a while might be in order.


Free Mail Services - Traditional Full Service

Minimum criteria for listing in this section:

- Login to at least one method of sending (web, smtp, submission) must be via SSL/TLS/OTP.
- Login to at least one method of receiving (web, imap, pop) must be via SSL/TLS/OTP.
- Must offer both one method of sending, and one method of receiving, for free.


Protocol List

Service HTTP (80) HTTPS (443) IMAP (143) IMAPS (993) SMTP (25) SMTPS (465) submission (587) POP3 (110) POP3S (995)
AOL  ?  ?  ?  ?  ?  ?  ?  ?  ?
Fastmail Y Y Y Y N a N a N a Y Y
Gmail Y Y d Y Y Y Y Y Y Y
Hotmail Y Y N N Y f N Y f N Y f
Rambler Y Y Y Y Y Y Y Y Y
Yahoo Y N N N N N N  ? N
Zoho Y Y N Y g N Y N N Y g
Lavabit Y Y Y Y Y Y Y Y Y

Column headings:

HTTPS - Indicates that everything (creation, login, management and use) is available over SSL/TLS, fulltime, natively, no tricks or certificate acceptance required.
xxxxx - The other columns are similarly self explanatory and are hereby omitted.

Notes from the above table:

a - Present but not free, has no known APAY scheme, thus marked N.
b - Possible with HttpsEveryWhere.
c - Works, but uses a self signed, expired, or otherwise deviant, certificate.
d - Gmail has a cleartext session leak with the splash page after signup (welcoming the new user to their mailbox one click away). A password change and log out/in will nullify this.
e - (This table note is available for future use.)
f - More info here: techblissonline
g - Zoho's IMAP returns an odd EXPUNGE response, and pop appears to be nonstandard.

Feature List

Service SIPW SIPS SINW REQE/UPDE REQP REQN FNMC NACT TRAV DELE APAY MULD/ADVM CTYO LENG ZONE DNLD
AOL  ?  ?  ?  ?/?  ?  ?  ?  ?  ?  ?  ?  ?/N US  ?  ?  ?
Fastmail N N N Y/Y N N Y Y N Y  ? Y/Y NO Y  ?  ?
Gmail N Y Y N/? Y Y Y Y N Y  ? N/N US Y Y  ?
Hotmail  ?  ?  ?  ?/?  ?  ?  ?  ?  ?  ?  ?  ?/N US  ?  ?  ?
Rambler Y Y N N/? N Y Y Y N Y  ? Y/N RU Y  ?  ?
Yahoo Y  ?  ? N/? N Y Y Y N Y  ? Y/N US Y Y N b
Zoho N Y Y Y/Y N N Y Y a N Y  ? N/N US Y Y  ?
Lavabit  ? Y Y N N N  ?  ? Y  ? Y N/N US Y  ? Y

Column headings:

SIPW - Source IP appears in mail sent via webmail.
SIPS - Source IP appears in mail sent via SMTP/SMTPS/submission.
SINW - Mail sent via SMTP/SMTPS/submission appears in webmail.
REQE - Requires alternate email to sign up, often used to send activation/recovery links.
UPDE - The address from REQE may be updated later to be the account itself, thus removing the third party.
REQP - Requires phone (SMS/voice) to sign up.
REQN - Requires filling out some name fields (first/last/full), or other PII, to sign up.
FNMC - The '^From: ' "name (GECOS)" field is a single configurable string, independent of the REQN string(s).
NACT - Defaults, or configurable, to not automatically add contacts when sending and receiving mail.
TRAV - Has issues when the exit changes mid session (traveling), or with certain countries/networks in general. This does not include the normal blocking of random exits due to abuse.
1 - Requires the user to log back in to clear things up. Not preventable with the usual 'remember me' cookie/session login options.
2 - Fails to create the account, or fails to login.
3 - Locks the account (requiring helpdesk (human) intervention), or deletes the account.
Note: (1) is usually due to benign software issues. (2) and (3) are usually due to the provider automating their country/network restrictions. (3) is especially bad/unreliable/unpredictable and use of the service is not recommended without MAPADDRESS.
DELE - The account may be deleted by the user.
APAY - Accepts anonymous/alternative payment methods for usage, extended features, or donations. A slash (/) separated list.
1 - Money order
2 - Non-personalized credit (gift) cards.
3 - Bitcoin
MULD - Offers multiple domains to choose from. These are listed on the discussion page.
ADVM - Tags mail body with adverts that give away the MULD parent (ex: when mailing a single recipient from accounts using said domains). Or puts its name in the domain names.
CTYO - Country of organization.
LENG - Language is English by default or configurable as such.
ZONE - Timezone is settable.
DNLD - Messages in the web interface are downloadable to disk via some mechanism.

Notes from the above table:

a - True. Yet when sending via webmail, destination addresses appear in (settings.mail.anti-spam.whitelisted_email). They are deletable.
b - And the headers appear raw, separate from the interpreted body. No way to easily cut/paste the whole thing.

Test Accounts

These accounts are (were!) to permit verification of the data in the above tables. Feel free to take a test drive and then create your own accounts later. But the hosters will fight you agressively if you use tornet. Please make the username and password eight(8) characters long and from the set [a-z0-9]. Lead both with a letter. Don't be an asshole.

Service Username Password Created
AOL anotst01 qwerty73 DEAD
Fastmail anotst01 p90xmous DEAD
Gmail anotst01  ? DEAD
Hotmail john.anotst p90xmous 02-20-2012 john.anotst@hotmail.com tornet-hostile
Rambler anotst01 p90xmous 02-20-2012 russian-only
Yahoo anotst01 p90xmous DEAD !
Zoho anotst01 p90xmous DEAD !

Record all the parameters you supplied when creating the account. Name, DOB, address, country, email, recovery Q&A, activation link, exit (fingerprint, IP, country) if you locked it to one, etc.

AOL - Richard Jensen, April 18 1987, Security Question "Tom and Jerry". Requires javascript to sign up and use.
Fastmail - Alternative email: anotst01@hmamail.com; Full Name: optional, not provided; no location or DOB requested; no security question; Javascript not required for signup or use.
Gmail - Naver Sinead (male), DOB 8 July 1965, Location Ireland, Email anotst01@mailinator.com, Cell phone +353854790102
Hotmail - John Stevenson, Recovery Q&A: "best friend"\fapfap, DOB 1 Jan 1970, Cell phone: +1(123)456-7890, Country: USA, postal code (not req'd for non-US): 12345 , john.anotst@mailinator.com contact addr.
Rambler - John Stevenson, Recovery Q&A: hui/hui, DOB 1 Jan 1970,
Yahoo - anotst01@yahoo.com; Full Name = Anonymouse Usser; DOB=July 4, 1976; Home=Germany; Postal Code= 35-364; Security Question #1: Where did you meet your spouse? Answer=Berlin; Security Question #2: Where did you spend your childhood summers? Answer=Munchen
Zoho -

Old style listings (test and port these to the above tables)

  • Mail.md - requires Javascript, no alternate email required, pop3, in Moldavia, max. 250 MB
Israel-based, long downtime 2015, 250'000 users deleted, 3MB (look what non-israeli offer you instead!) free accounts, drops large portion of incoming mail - unreliable.
JS controversy:
  • Requires JS to login for the first time!
  • ... unless you close the tab/browser after signup, reload https://safe-mail.net and login again being sure to select "Fast (no scripts or icons)" as your "Interface" just above the SignIn button.
- Terms of Service PROHIBITS use of proxies, but tor/proxies are not blocked and no violation of this term has ever been known to get an account flagged - until the 2015 crash, that was!
- All login attempts (successful or not) create a record of the user's IP address & user agent string!
- Slow to implement tor-traffic like ruggedinbox and SIGAINT do.
  • Hushmail free accounts expire after 3 weeks of inactivity (non-login). Requires javascript to sign up, but can send/receive using mobile site. Blocks some Tor IPs for "abuse", deletes accounts at random for "suspicious activity"
  • canada-11 Saved messages are deleted after 60 days of inactivity (non-login). Torbrowser-friendly, javascript, requires strong cumbersome password, 1 GB storage, 25 MB attachments
  • Myway (forwards to error page if JS is disabled)
  • Mail (captcha requires JS, requires major ISP-provided email for verification, not at all anon unless you can hack someone elses)
  • Net@Address cert issued to spy agency. good luck with that one.
  • ruggedinbox.com ad-free, tor-ready, reliable mail, low traffic limit (1 mail per 3 minutes)
  • Tuffmail - 30 day free trial only, may not support ssl
  • Runbox - 30 day free trial only, good cert
  • AnonymousSpeech.com - 30 day free trial only, JS required, promises to not cooperate with law enforcement ;-) -- in Panama, expensive!

Bitmessage

E-mail via Bitmessage is well supported. see: Category:Bitmessage


Sending email (aka: simple webgates up to strong mixnets)


Receiving email (aka: disposable address maildrops/forwarders)

Service HTTP HTTPS DROP OPEN AUTH HEAD BODY MUDE MADE DNLD AFWD CTYO
Spamavert Y N N Y N Y Y a N Y ?  ? N b NO
Yopmail Y N  ? Y N Y N Y Y c N N b  ?
10 Minute Mail Y N  ? Y N N N N Y d N N b  ?
spamgourmet  ?  ?  ?  ?  ?  ?  ?  ?  ?  ?  ?  ?

Column headings:

HTTP - Everything works via HTTP.
HTTPS - Everything works via HTTPS.
DROP - This is a maildrop service.
OPEN - Maildrops are not protected other than by the randomness of the address.
AUTH - Maildrops are protected by authentication.
HEAD - Full, original as received, headers are available.
BODY - Full, original as received, body is available.
MUDE - Messages are user deletable.
MADE - Messages are automatically deleted after this many hours.
DNLD - Messages (too long for cut and paste) are downloadable to disk via some mechanism.
AFWD - This is an automatic forwarding service.
CTYO - Country of organization.

Notes from the above table:

a - Only up to a certain length.
b - Per message manual forwarding available.
c - The emails are deleted after 8 days.
d - Mailbox (along with emails) disappear in 10 minutes if not click on the corresponding link.

old style listings (test and port these to the above table)

TRADITIONAL WEBMAIL SERVICES

Concepts like that of Hushmail are basically a joke, because Hushmail sees the passphrase (i.e. secret key). Always locally encrypt your mails and only then maybe use a webmail system via Torbrowser, if you want to avoid 'Torbirdy'.

  • http://VFEmail.net - Unused Accounts disabled after 180days, deletion after 280 total days
  • Hushmail.com - You will need to sign in at least once every 3 weeks to not get fully deleted. 25 MB, requires javascript. BC, Canada based. Has and will give account information to governments. See Hushmail Spills to Feds


  • AnonymousSpeech.com - a favorite of document forgers, requires javascript, free trial accounts for 2 weeks only
  • SecureNym.net Houston, TX, USA hosted and operated PGP enabled webmail. Not free.


EMAIL FORWARDING SERVICES

  • http://spamgourmet.com accept no substitute! Adjust the # of mails when deletion kicks in
  • SpamBox - free forwarding up to 1 year!
  • NotSharingMy.info - free forwarding for life!
  • Jetable - Requires email confirmation before temporary address becomes active. 24 hours to 1 month lifetime.


TEMP / DISPOSABLE E-MAIL ADDRESSES & UNSORTED, often short-lived

unlike many below, spamgourmet offers long-term forwarding.

  • spamgourmet - classic, disposable spam filter, SSL available, specify max # of emails forwarded, field to identify sender, next to no captchas
  • Mailinator blocked in most web register procedures, even with alias domains like binkmail etc.
  • YopMail.com catch all, disposable e-mail. no reply. deletable or deleted after 90 days. javascript required. multiple domains available.
  • GuerrillaMail unreliable here, long delay, via mixmaster
  • anonymousE anon email, max. 12 hr. delay possible, no captchas :-)


  • Melt Mail - email forwarding with a 3 ... 24h lifespan, captchas
  • MyTrashMail webmail on-the-fly, RSS feed! autodelete after 5 ... 30 days
  • WH4F - "Will Hack For Food" account expires in 8 days max., read-only, usability imperfect, test account: zhnmju@wh4f.org passwd 333
  • Dispostable captcha for EVERY READ, terrible
  • GishPuppy - Manage multiple forwardable temporary addresses.
  • Hide My Ass mail - Allows passwords for anonymous mail accounts and self-destruction after time limit or on demand.
  • IncognitoMail temp mail for 1 hour only
  • MaskedMail - Get your email address masked with a 24-hour working temporary anonymous email forwarder.
  • anonbox[ Clearnet link! ] a 24hr. mail account in torbrowser for receiving only, no size limit! provided by CCC

Pay Mail Services - Traditional Full Service

These are known for their strong public stance on, and in, the privacy field. Instead of the usual boilerplate/loopholed TOS/AUP/Privacy policies, expect to see ones that make that clear. This section exists because some users, particularly businesses, may benefit from having a paid/contractual relationship with their mail provider.

Minimum criteria for listing in this section:

- Login to at least one method of sending (web, smtp, submission) must be via SSL/TLS/OTP.
- Login to at least one method of receiving (web, imap, pop) must be via SSL/TLS/OTP.
- Must offer both one method of sending, and one method of receiving, all for pay, none for free.
- Must have a strong/atypical position regarding privacy.


Protocol List

Service HTTP (80) HTTPS (443) IMAP (143) IMAPS (993) SMTP (25) SMTPS (465) submission (587) POP3 (110) POP3S (995)
None at the moment  ?  ?  ?  ?  ?  ?  ?  ?  ?

Column headings:

xxxxx - Refer to the Free section, the columns are an identical mirror.

Notes from the above table:

x - None at the moment.


Feature List

Service SIPW SIPS SINW REQE/UPDE REQP REQN FNMC NACT TRAV DELE APAY MULD/ADVM CTYO LENG ZONE
None at the moment  ?  ?  ?  ?/?  ?  ?  ?  ?  ?  ?  ?  ?/?  ??  ?  ?

Column headings:

xxxxx - Refer to the Free section, the columns are an identical mirror.

Notes from the above table:

x - None at the moment.


Useful tools

  • Fake Name Generator - Random identity to go with your fake persona
  • GenerateData.com - Similar to above but with a more limited range of data to generate
  • Privnote - Self-destructing message, get notified when read, doesn't send the email, but tells you the IP address of who opened it.

Threats

It is often recommended to use mail encryption (enigmail). Remember, subjects are always unencrypted.

Even if subject-lines are random, hidden, "-", empty or misleading and the content is encrypted, the e-mail provider can still log valuable data. When you logged in, how long, how often you fetch mail, how fast you type, how long you read a message, which spelling mistakes you make and correct, to which address mails are sent, when you receive mails, from which addresses and when. That's quite a lot metadata, which may lead into (false) assumptions by an adversary.

Registering the e-mail address anonymously, i.e. not entering personal data and only accessing it over Tor is a secure thing. If you have a website or other kind of project, you must publish your e-mail address so others can write to you. The e-mail provider is always a single point of failure.

If the provider gets pressured, forced or decides not to like your opinion anymore or feels like terminating the service for everyone, the e-mail account can be easily terminated in seconds. This can significantly slow down correspondence. Therefore it's always good to have a few backup e-mail address and alternative communication channels.

See Also






Dead Hidden Services

Do not simply remove services that appear to be offline from the above list! Services can go down temporarily, so we keep track of when they do and maintain a list of dead hidden services.

  • In addition to an onion simply being gone (Tor cannot resolve the onion), sites that display 404 (and use a known onion/URL based hosting service) are the only other thing that is considered truly DOWN. Presumably the account is gone.
  1. If a service has been down for a while, tag it with Template:Down using {{Down|YYYY-MM-DD}} (your guess as to when it went down).
  2. If a tagged service on the above list of live hidden services has come back up, remove the DOWN tag.
  3. If a tagged service is still down after a month, please move it (along with the DOWN tag) to the list of dead hidden services.
  • The general idea of the remaining four service states below is that, if the Hidden Service Descriptor is available, and something is responding behind it... the service is considered up, and we track that fact on the Main Page. If any of these subsequently go offline, append the DOWN tag and handle as above.
  1. Hello world's / statements, minimal sites, services with low user activity, etc (while boring)... are listed as usual.
  2. Broken services are those that display 404 (and do not use a known hosting service), PHP or other errors (or they fail silently)... any of which prevent the use of the service as intended. They also include blank pages, empty dirs and neglected status notes. Presumably the operator is in limbo. Broken services are tagged with {{Down|YYYY-MM-DD|reason}} (your guess as to when it went broken)
  3. Services that automatically redirect to another service (such as by HTTP protocol or script), have their redirection destinations noted in their descriptions. These are tagged with {{Down|YYYY-MM-DD|Redir to site}} (your guess as to when it went redir)
  4. Sites that are formally closed via announcement are tagged with {{Down|YYYY-MM-DD|Closed}} (your guess as to when it went closed)


  • 1dl.us - dead. Requires javascript. Temp Email, file dump and a bunch of other networking tools.
  • HerpMail - Dead 2105 - Temporary read and reply email addresses
  • Make Me The King - LINK DEAD Can notify you when you receive mail.
  • Nabuma - read and reply email addresses at a variety of domains, an announcement on the site reads "The service will be down for remodelling from Dec. 22nd, 2011 till summer 2012"
  • OneOffEmail (Service offline 2015)
  • tempalias - forwards to your real email address and expires after a set time or number of messages - DISCONTINUED BY HIS AUTHOR
  • mailop - YAMD, yet another mail drop dead
  • WhySpam.Me Dead.
  • Shady Email - Don't just hide your email, Make it Questionable & Suspicious. Dead.
  • funky mail
  • FilzMail - temporary read and reply email addresses. silent error - 552-Quota exceeded. crap.


send email:

dead sites (Nov. 2015):



  • send-email.org - email, watch for buggy 'mail sent' message, test first, does not send to all domains at all (i.e. crap)
  • Hotpop (down or firewalls Tor IPs)
  • MintEmail - 1 hour email addresses, don't reload, else ure @ is gone, seems not to work 2015
  • Care2 (no longer a mail provider)
  • MailVault.com Germany hosted, US operated 4MB free, encrypted? webmail. Can be buggy. Unreliable hosting / free webmail access in the past few years.
  • MailVault (27.10.11 - down)
  • inMail24 Claims web, POP3, and IMAP4 access. I was unable to register an account: throws "access denied" page.


  • Box.az - blocks most countries in torbrowser -- Use this link to bypass Javascript register button. Service requires Javascript to get past login screen if the URL ends with /yeni (ie. https://box.az/yeni). If you change the /yeni to /sade no Javascript is needed to access inbox email. Sending email still requires Javascript (cannot be bypassed by simply hitting enter). Blocks at least a few tor IP's from signup.
  • GMX (note: I had an account blocked without warning, apparently due to Tor usage during setup and thereafter; I didn't use my account for anything 'bad'. GMX has not responded to my _many_ requests for explanation and unblocking of account.)
  • riseup.net (Invite only, takes ages, they want lefties only)
  • Luxmail - Redirects to another domain when checking mail. Requires Javascript. No ssl.
  • Privat DE Mail (no webmail, requires other address but you can use e.g. mailcatch.com)
  • Privat DE Mail (no webmail, requires other address but you can use e.g. mailcatch.com)
  • Zapak (broken signin- requires you to click a button that doesnt exist, even with js enabled)
  • Bigstring (has various bugs, not reliable and not safe!)
  • Gawab (requires JS, address, and phone number)
  • Myspace (blocks signups from Tor)
  • Secure-Mail.biz operator announced shutdown in 2015 -- German operated, webmail service. Not free.