0

assuming all emails sent to the clearnet from a specific email provider are tracked by country e.g. all emails from protonmail will have a link to switzerland and the NSA AI will scan and read them cause they are in the clearnet. If protonmail uses a .onion address, does the email exit protonmail servers into the clearnet through a tor exit node? Can the NSA AI track it?

1

You should slice it into two parts:

Client to server communication

If you want to access the server to send or receive an email, you can use tor and access the hidden service. This has the advantage that an attacker under normal circumstances is unable to see that you have connected with your IP to the server.

Server to server communication

If the server sends an email to another server it uses the clearnet under normal circumstances. The clearnet is used to avoid these emails being marked as spam at the receiving server because almost every tor exit node is on spam blacklists.

Summary

Protonmail mails are not send through an exit node. Because of that the NSA might track that the mail is sent from switzerland.

Small Overview

Client_A ---(tor)---> ProtonMail ------> MailProvider_B -----> Client_B

Legend:

---(tor)-->: Connection via tor

---------->: Clearnet connection, which hopefully uses TLS

Encrypted & meta-data-free alternatives

The following alternatives are relatively new and might have vulnerabilities:

  • In Essence it can also track that its a protonmail email – securitydude5 May 11 '17 at 10:28
  • yep, you are right. But it should not be able to track the email sender and receiver if TLS connections are used for the clearnet communication.... On the other hand you should know that in most countries email providers hand out the emails of an user if asked by the law enforcement... – nebulak May 11 '17 at 10:33
  • How then does one send email that cant be tracked by the NSA – securitydude5 May 11 '17 at 10:36
  • Use Tor for anonymization and encryption(e.g. OpenPGP) to hide the content of the email. This actually results in pseudonymization and should be enough in most countries. The law enforcement then only knows that two persons have communicated with each other, but do not know who these persons are and what they talked about... – nebulak May 11 '17 at 10:47
  • What if the other recipient does not use OpenPGP. The sender uses Scryptmail and or protonmail. Sender sends to random people but does not want his email snooped. Powerful adversary knows sender already uses Scryptmail or protonmail. Sende moved from Gmail to these but adversary knows now – securitydude5 May 11 '17 at 11:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.