Presumably all unencrypted email is available to federal agencies including IP addresses, header information, and email content (eg, through SMTP with or without SSL and TLS -- thunderbird has an SSL/TLS option so it is not clear whether TLS will be used anyway, depending on the mail server). If PGP encryption is used, then this will be known to such organizations, and since header data is not encrypted, this will likely attract suspicion and increase monitoring on nonencrypted data and other traffic from that IP address.

What are options (general or specific) to use end to end secure email without agencies knowing that emails are being sent? Would VPN with SMTP not work because the emails will become accessible after leaving the VPN server? It seems that web-based email through a VPN (eg, protonmail) would meet these criteria. Are there other options?

  • [tinfoilhatmode]You can't, setup an account just for sending PGP mail and only access it from behind a proxy and/or VPN.[/tinfoilhatmode] – BadSkillz Jul 20 '15 at 14:08
  • You say it can't, but you've given a solution, which is to set up an email account just for sending PGP mail and accessing it from a proxy and/or VPN. What would be wrong with my other idea, to use secure web-based email through a browser and through a VPN, would that also work? – nelson Jul 20 '15 at 16:08
  • There would still be the issue of browser fingerprinting so you need to randomize your user-agent or check for an evercookie. If they really want to, there are many ways the government can find out who you are and start investigating you. Posting this question was the first reason probably.. – BadSkillz Jul 20 '15 at 17:22
  • 1
    You could use steganography to make your encrypted messages look like spam: spammimic.com/explain.shtml – Neil McGuigan Jul 20 '15 at 18:16
  • 1
    Since you don't seem to be married to SMTP, then your question isn't really about e-mail, per se; you just want to know how to send encrypted electronic messages without the government knowing that's what you're doing, right? Botnets have been trying to solve that problem for the last couple decades. I'd look up whitepapers on their communication techniques, and how to layer those techiques into your regular traffic. Personally, I'd steganographically encode information in the sentence structure of my comments, but that's just me. – Parthian Shot Jul 20 '15 at 20:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.