Hide the fact of e-mail communication

Question

Bob has a mistress. Her name is Alice. Bob`s wife Eve knows Bob is unfaithful, but she does not know who the mistress is. Alice does not know Bob is married.

Bob needs to communicate with Alice over e-mail, but he needs to use his personal address (bob@bob.bob) and the e-mails must be sent to personal address of Alice (alice@alice.alice), otherwise Alice would be suspicious why she could not use her personal address.

Eve decides to monitor Bob`s e-mail communication and e-mail communication of all his possible girlfriends to find out, who the mistress is.

Is there any way for Bob to hide the fact he communicates with Alice? PGP encryption is not a solution: it hides only content of message, not a sender nor a receipient.

I thought there could be some trusted "friend-in-the-middle" Fred who communicates with both Bob and Alice. Bob could send e-mails to Fred with a real receipient in the first line of PGP encrypted message. Fred would decrypt the message, read the receipient, encrypt it again and send to Alice, so Eve would think Bob communicates with Fred and Fred communicates with Alice and there is no communication between Bob and Alice.

Is there any typical solution of this problem?

EDIT: Alice can cooperate in the way she encrypts her messages (because Bob's mistress would surely be security-conscious), but she needs to use her personal address and she needs to recieve e-mails from Bob`s address.

EDIT II: (for my girlfriend) I am not Bob, I have no mistress and my girlfriend is no monitoring my e-mail communication, well, I hope :-). I am looking for a technical solution how to hide communication between two given e-mail addresses. That is why a divorce is not a solution and changing one of these addresses is also not a solution, because it changes the original meaning of my question :-)...

Answer 1

Let's break this up:

1. Bob and Alice want to engage in two-way email communication.
2. Bob and Alice need to use their personal email addresses.
3. Eve has the ability to observe all communication in the system.
4. Eve must not learn about any special communication between Bob and Alice.
5. (Alice must not learn that Bob is married.)

The last statement (5) prevents you from using collaborative systems to hide communication, since Alice would instantly start wondering if Bob asked her to use such.

However, without Alice participating, Eve will learn about Bobs unfaithfulness as Alice replies to Bob the latest.

---

I would therefore propose to drop point 5. If Alice actively helps Bob, they can potentially keep Eve in the dark.

To that end, Bob sends encrypted messages to all his friends (different messages to different people). Since Eve cannot decrypt them, she cannot read the message to Alice. And since all friends are receiving mail, Eve cannot infer a special relationship between Bob and Alice.

The important part now is to have many of Bob's friends answer his messages (therefore he must have sent senseful messages to them). Otherwise Eve could infer the recipient of the main communication (Alice), as Alice would be the only one replying.

Of course, all replies sent to Bob should also be encrypted. (But Bob surely only has security-conscious friends and mistresses.)

---

...To conclude, Bob is better off staying faithful ;)

Answer 2

If Bob can own Alice's computer (all of them) without being detected, he can wrap a bot around her email client which collaborates with Bob in the way most convenient to him, but then presents the communication to Alice as coming in plaintext from Bob's address, even though that's not the truth. Outgoing emails to Bob are also intercepted and communicated colaboratively.

If Bob can own Alice's network (all of them) downstream from all the spots that Eve can monitor, a bot there could do the same thing.

If Bob can own Eve's computer (all of them) without being detected, he can lobotomize her monitoring tools to not see what's right there.

I see no less invasive solution.

Answer 3

Possible solution would be to use rule-based filtering/re-directing on the server and address-spoofing.

1.) Mail from Alice's account to Bob@Bob.Bob is immediately server-re-routed to a clandestine mail account which he uses for his affair. Unless Eve is able to view server filtering rules and/or the logs on the mailserver she will never know that Bob is receiving Mail from Alice.

Note: This is not a surefire-solution if there are non-affair-related Mails going back & forth between Alice and Bob which Eve ought to be seeing in order to keep from becoming suspicious (which is a whole new problem in itself, as Alice will surely be mixing business & private information, as lovers are wont to do).

2.) For mail from Bob's clandestine affair account to Alice, he will be spoofing his originator address to be originating from Bob@Bob.Bob. Unless Alice is header-savvy and checks the mail headers for inconsistencies she won't ever be the wiser.

This solution has a couple of prerequisites:

A. Eve is only able to monitor Bob's computer traffic (unless encrypted, as in many webmail services) and mail (client or webmail account), NOT the mail server logs and/or filtering rules.

B. Obviously, Bob's mail server must allow for server-side filtering and re-directing so Mails from Alice will never appear in Bob's actual mail account.

C. Bob's clandestine affair account's SMTP-server must allow for sending mails with a different originator address.

Answer 4

No solution. As Philipp points out, your requirements boil down to "Bob and Alice can only communicate in plain text directly over a monitored channel", because if Bob uses anything else Alice will realise he is hiding something.

Answer 5

You are presuming that a person can have only one personal email address, but that is not true. If Alice is not a knowing participant in Bob's adultery, there should be no reason for her to need to know that bob@bob.bob is the 'only' personal address for Bob. He could give her bob@gmail.com and she would be none the wiser.

Alternately, if Eve is only capable of monitoring the network but not the computer, Bob could hide the email by using a server-based email client and communicating with it securely. If Eve can monitor the computer, then she could see the email correspondence before (or after) any encryption (or decryption) operations have taken place.

Answer 6

The modern way of sending e-mails already gives an answer to Bob's problem. In fact, a service like GMail already encrypts the communication of e-mails between two GMail's addresses. Furthermore, Bob can connect to his e-mail front-end using HTTPS rendering all eavesdropping void.

If we consider that Bob's is careless and sending his e-mail to his new beloved over plain-text connections, he could set up a e-mail relay to which he communicates using any cryptographic method of choice, letting the relay take care of the e-mail redirection. The only thing Eve can see is encrypted email going out from Bob's to the relay.

However if Eve is able to monitor incoming traffic at Alice's place (as she can spy on all the candidates), there is not much Bob can do, since he has to use his own address for Alice.

Answer 7

Very strange that noone mentions the solution how General David Petraeus hid his love affair from prying eyes:

Both have a shared email web account. Each one is saving his/her message to the other person as Draft without sending them at all. So the only detectable transmission (which is normally encrypted) is between Petraeus and the server (Yahoo, Google Mail whatever) to save the draft. And sure, if someone asks, he/she is simply reading his e-mails, nothing else.

EDIT: It is possible, but it has the precondition that Alice is technical inept, has a web mail account and Bob is quite malicious.

Bob receiving Alices mails:
Bob sets up a mailserver (eventually hidden) in his workplace and gives the address to Alice. Eve is informed that a new time tracking system is installed. The server extracts the messages from Alice, and puts them steganographical hidden into job information (you have worked bla bla hours) which is then seen by Eve. To avoid bad timing, Bob sets up a cronjob so the mails are always sent out at the same time. Eve cannot see anything suspicious, only stupid boring workplace mails coming from the workplace.

Alice receiving Bob mails:
Harder, more malicious and depending on Alice's dumbness. Bob needs to get Alice's password for her account (Offer to set up the mail program, pry when Alice looks for her email). Then when Bob has received her messages, Bob brazenly logs in as Alice, writes down his answer as draft and moves the message to the inbox ! Naturally any user who would look at the headers would see at once the deception, but as said, it depends on Alice's dumbness.

Answer 8

Bitmessage may be the solution. See https://bitmessage.org/wiki/Main_Page. Bitmessage hides who is communicating with whom, and all messages sent through the network are encrypted, authenticated, and digitally signed.

From Wikipedia: Bitmessage is a decentralized, encrypted, peer-to-peer, trustless communications protocol that can be used by one person to send encrypted messages to another person, or to multiple subscribers. Bitmessage encrypts each users' message inbox using public-key cryptography and replicates it inside its P2P network, mixing it with inboxes of other users in order to conceal user's identity, prevent eavesdropping and allow the network to operate in a decentralized manner. The Bitmessage communications protocol avoids sender-spoofing through authentication, and hides metadata from wiretapping systems

Answer 9

This was quite a good question and despite some comments, is very relevant to security. It is also a real problem. Don't get caught up in the mirky details. instead focus on the general problem, which could be equally applied to real world issues faced by Journalists or pretty much anyone who lives in a country where government control and civil liberties may be at odds. Essentially, this is the metadata problem. A 3rd party does not need to actually know the content of communication to draw conclusions about what was in the communication. The fact these conclusions may be based on inaccurate or incorrect assumptions is largely irrelevant.

The general question is, how can party A communicate with party B without party C, who has access to party A's metadata, knowing that some communication has occurred?

With email, this is extremely difficult. There are other protocols which either have less useful metadata or which can allow the metadata to be obfuscated. However, the problem here is that party B may not be able or willing or even aware of these other protocols. The advantage of email is in its ubiquity.

If we assume the restrictions of the original problem hold i.e. party A cannot just get a different email address, then the most obvious solution would seem to be using the MiTM type scenario. Essentially, some form of relay where party A sends the message to party D, who sends it to party B and party B's respons is sent to party D and then back to A. However, this has a number of limitations as well. Party B (who is not cooperating) may observe that the messages are being relayed and become suspicious. Likewise, party C might wonder what the messages going to the relay point are and become just as suspicious, especially if C is able to associate messages going to the relay with some other behaviours and there is sufficient frequency. The problem with using any form of relay is that it doesn't change the overall metadata pattern - it simply puts another hop into the process.

Metadata is about patterns and pattern analysis. To hide communications at this level, you need to obscure the patterns. Instead of one relay, have multiple relays and use each relay for multiple recipients. Difuse patterns by communicating with many people (in the OPs example, don't just email your mistress, but many other women who are not your mistress).

I guess the point here is that everything you do leaves metadata. This metadata can be used to draw assumptions based on the patterns which are identified in the metadata. Anyone who argues that only people who have something to hide need to worry about metadata are failing to think about what kinds of assumptions creative people might be able to derive from these patterns. If those drawing the conclusions have sufficient power, the fact that the assumptions may be incorrect is irrelevant - if they believe the assumptions are correct, they will act accordingly and this may have adverse impact regardless of the truth. For those with sufficient power/influence, how your percieved can be as important as how you are - if your partner believes your cheating, your life will likely become miserable regardless of whether you are or not. If your government believes you are exhibiting patterns of data commonly associated with terrorist activity, they will likely treat you as such regardless of your actual actions and if your company believes they have identified you as the whistle blower based on metadata, you will likely find yourself unemployed regardless of the reality.

Metadata is valuable and potentially dangerous. It will exist regardless of what we want. It is important that access is controlled appropriately and access has adequate checks and balances. We cannot assume that because some metadata seems innocuous to us that it cannot be used by others, especially when combined with other sources. From a security perspective, we should apply the normal 'need to know' principal to all our data, not just the data we think is sensitive or important. We need to assume there is always someone smarter and more creative than us and if your going to cheat on your partner, make sure you have a separate net identity they know nothing about!