3

Scenario:
Someone uses thunderbird to manage her various email addresses. All of those contain her real name (work, university, ...). One day, she has need of an anonymous email account and so creates one, which she only connects to via Tor Browser. This is a little inconvenient, however, so she decides to make use of the torbirdy add-on so that the traffic is routed through Tor.

Question:
If Thunderbird now channels all emails through Tor, don't the real-name addresses revoke the anonymity that torbirdy aims to provide?

Note:
1. A somewhat similar question has been asked here. The accepted answer makes me think that the answer to my question might me in the affirmative, but it is different enough so that I am in no way sure of it.
2. In the wiki entry for torbirdy on torproject, the possibility of using addresses containing real names with torbirdy is mentioned. However, it only says the following:

Please bear in mind that email accounts that have been used without Tor before offer less privacy/anonymity/weaker pseudonyms than email accounts that have always been accessed with Tor. But nevertheless, TorBirdy is still useful for existing accounts or real-name email addresses. For example, if you are looking for location anonymity -- you travel a lot and don't want to disclose all your locations by sending emails -- TorBirdy works wonderfully!

This does not answer my question since I want to know if anonymous addresses (previously only connected to via Tor) lose their anonymity when used in the same Thunderbird instance with non-anonymous addresses.

Side question:
This might be related or not, but I seem to recall reading somewhere that you are not supposed to use Tor for things like online banking where you have to identify yourself, because it compromises your anonymity when connecting to other websites after that (without requesting a new circuit). Is this true or false?

1 Answer 1

4

First of all:

There are no anonymous email addresses; there may be email accounts at services that do not require a lot of personal data to register and where you can register email addresses for that account which do not contain your name or other information which may provide a hint of who you are. If you use two different email addresses (i.e. [email protected] and [email protected]) which are linked to the same account on the provider's server then your anonymity will be gone once someone has to power to ask the provider to reveal data.

Some more words of caution:

Many people using Tor for illegal activities got caught because they have been using aliases which contained their first name, year of birth the place they live, like [email protected]. This won't identify someone, but number of people who are called "Hans", are born in 1984 and live in Munich are is small enough to limit further investigations to that target group. You get the idea. Also some people have been re-using avatar pics on the "anonymous" part of the net which they have been using on the other side as well.

Now you would like to know if if

anonymous addresses (previously only connected to via Tor) loose their anonymity when used in the same thunderbird account with non-anonymous addresses

To strictly answer to your question, the answer would be: Most likely. But it of course depends on that a Thunderbird Account means to you? Or did you mean to write "Thunderbird instance" as in an instance of the software installed onto a machine?

If I interpret your question in a broader sense, then let's assume you have three email accounts:

where the latter one would we what you consider "anonymous".

As long as you can be sure that the rumpelstilzchen account is using entirely different SMTP and IMAP servers as the other two, I would argue that accessing those distinctly separate servers over one Tor connection will not allow anyone to make a link between the fist two accounts and the 3rd one. I guess this is what you are asking, basically.

Yet there are some pitfalls.

One of them is that a default behaviour in Thunderbird is that there is one SMTP smarthost for multiple email accounts. You can configure this differently, but you have to make sure you do so. Otherwise you may be ending up sending emails for all three accounts over the same SMTP server which would possibly allow to make a link between them.

Many more pitfalls are between backrest and screen, like pasting the wrong signature into an email and the like.

I would rather try to use two different instances of Thunderbird (with distinct skins) or to different MUAs (Mail User Agents aka E-Mail clients) for anonymous and non anonymous mail traffic; just as a precaution.

3
  • 1
    Note that it will still provide location anonymity.
    – forest
    Commented Sep 12, 2018 at 20:46
  • Thank you for your input. You mention the possibility of running two different Thunderbird instances (which is indeed what I meant by "Thunderbird account" - should I edit my question to reflect that?), could you confirm that the approach presented in unix.stackexchange.com/a/143851/293229 is the correct one? There also seems to be a Thunderbird extension for switching profiles, do you know if this would also be safe to use? Commented Sep 13, 2018 at 8:35
  • @nonthevisor It is always a good idea to reduce identified ambiguity in your question.
    – mlp
    Commented Sep 14, 2018 at 18:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .