<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div style="" class=""><span style="" class="">Hi Petter,</span></div>You should look at something like Cables in Linux Liberte.<br style="" class=""><br style="" class="">But the only reason Cables theoretically* works is that everything is delivered over Tor, and it typically runs on a machine where Tor is being leveraged for everything. That at least gives the user some protection if the email client happens to be doing something screwy that the author of Cables didn't know about.<br style="" class=""><br style="" class="">With your proposal, you have to trust that both exim and whatever email client not only don't have bugs. But more importantly, you must know that your rules for when to sending/receiving over Tor are perfect, _and_ that your documentation is effective enough to
teach your users not to mix, forward, leak, or otherwise undermine all the work you are trying to do to hide their metadata. Oh, and keep in mind that most clients do a fine job of hiding nearly all of the ugly metadata from the user, so they're often not even aware it's there in the first place.<br style="" class=""><br style="" class="">In short, if you let your users send unencrypted messages in the same client/system as covert messages, your users won't be safe. And if you force encryption for everything, you defeat the purpose of using email and should instead choose a protocol/system designed specifically to hide metadata.<br style="" class=""><br style="" class="">Best,<br style="" class="">Jonathan<br style="" class=""><br style="" class="">* I've never used Cables, and it looks to be abandoned. But its
features and design are the most comprehensive I've seen for the kind of
messaging you're interested in doing.<br style="" class=""><div class="qtdSeparateBR"><br><br></div><div style="display: block;" class="yahoo_quoted"> <div class="" style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div class="" style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div style="" class="" dir="ltr"> <font style="" class="" face="Arial" size="2"> On Saturday, October 11, 2014 6:02 AM, Petter Reinholdtsen <pere@hungry.com> wrote:<br style="" class=""> </font> </div> <br style="" class=""><br style="" class=""> <div style="" class="">Hi.<br style="" class=""><br style="" class="">I got this idea for how to set up a system to exchange emails between<br style="" class="">freedobox boxes without having to develop much ourself. Is this<br style="" class="">already done by someone else? Anyone here know
enough about the<br style="" class="">involved systems to make a proof of concept quickly?<br style="" class=""><br style="" class="">The idea is based on the fact that a Tor hidden service is just a<br style="" class="">process listening on some port somewhere, and the fact that exim can<br style="" class="">be told to use any transport to send email. If we set up exim to send<br style="" class="">all addresses of a given format (say<br style="" class=""><user>@<hidden-service-id>.freedomboxmail or similar) via a transport<br style="" class="">delivering the mail via SMTP over Tor to the address given in<br style="" class=""><hidden-service-id>, and set up SMTP on each freedombox to listen as a<br style="" class="">Tor hidden service. This would allow emails to be injected into the<br style="" class="">freedombox using normal mail clients (to the local SMTP port), and<br style="" class="">forwarded via Tor to any online
freedombox without leaking metadata<br style="" class="">about the mail exchange to anyone listening on the network segments<br style="" class="">betwheen the freedombox machines.<br style="" class=""><br style="" class="">For additional protection against spammers, one can add a check in<br style="" class="">exim to require all email to be GPG encrypted, or perhaps only accept<br style="" class="">GPG signed emails. But that is mostly to reduce the amount of<br style="" class="">unwanted email, and not to be able to send email without leaking<br style="" class="">metadata to prying eyes.<br style="" class=""><br style="" class="">What do the rest of you thing about this idea? Possible to implemnt?<br style="" class="">Something to put in the FreedomBox?<br style="" class=""><br style="" class="">-- <br style="" class="">Happy hacking<br style="" class="">Petter Reinholdtsen<br style="" class=""><br style=""
class="">_______________________________________________<br style="" class="">Freedombox-discuss mailing list<br style="" class=""><a style="" class="" ymailto="mailto:Freedombox-discuss@lists.alioth.debian.org" href="mailto:Freedombox-discuss@lists.alioth.debian.org">Freedombox-discuss@lists.alioth.debian.org</a><br style="" class=""><a style="" class="" href="http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss" target="_blank">http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss</a><br style="" class=""><br style="" class=""><br style="" class=""></div> </div> </div> </div> </div></body></html>