Page MenuHomePhabricator

OnionMail
Closed, WontfixPublic

Description

OnionMail is a project that hasn't gotten its deserved publcity. Its supposed to be a Mixmaster-style service built on Tor. Its an anonymous mail server network which supports exiting messages. It doesn't add high latency guarantees of its own but it has a few benefits over using a mail service HS.

http://en.onionmail.info

The best technical intro I found:

https://hacker10.com/internet-anonymity/onionmail-an-anonymous-mail-server-running-on-tor/

Pros:

  • Makes pseudonymous mail account creation easier and safer than conventional services - in client registration possible.
  • Integrates with Icedove
  • Bi-directional communication possible enitrely inside the Tor network o with clearnet addresses
  • You don't have to trust their crypto implmentations if you use your own GPG key
  • Debian packages available via their repo
  • Written in memory safe Java

Cons:

  • I tried it out and its designed to only use a local Tor instance
  • Would need OpenJDK (not a big deal as so would I2P)

I am thinking about contacting them about changes we would like to see to improve compatibility with Whonix and UX. They made a GUI install wizard for TAILS but its outdated.

http://en.onionmail.info/contacts.html

Another interesting software project they have is NTU which transparently directs traffic over SOCKS proxy servers to evade Tor bans. Interesting but haven't tried it yet.

http://onionmail.info/ntu.html
https://github.com/onionmail/ntu

Details

Impact
Normal

Event Timeline

I tried it out and its designed to only use a local Tor instance

But with anon-ws-disable-stacked-tor, uwt and onion-grater (Control Port Filter Proxy) would should be all set to make any application use Tor on Whonix-Gateway without any application support needed?

Right. It should work but Onionmail complains that it can't access torrc on the WS.


Looks rather outdated. Their repo (http://onionmail.info/repo.html) has only packages for wheezy, not jessie or stretch.

It most likely tries to use /etc/init.d/tor directly. This has always been a bug. The proper way and init system agnostic way is to use service. You could perhaps hack around that.

sudo touch /etc/init.d/tor
sudo chmod +x /etc/init.d/tor

#!/bin/bash
set -x
true "$0 here"
exit 0

If they'd port to python-stem or similar and started using Tor ControlPort to create hidden services, that would make Whonix compatibility a lot easier.

onionmail directly appends /etc/tor/torrc (in the workstation). This btw is a Debian critical policy bug that would prevent the package from entering Debian. One would have to copy these hidden services config to the gateway. And then configure onionshare listen on eth0 (or all interfaces) rather than localhost. Or if that does not work, force it with bindp.

HulaHoop claimed this task.

No reply. I guess the project is dead - no releases for stable past Wheezy.

Closing.

Heard back from them at last. They plan to release a newer version for Stretch in February and to rework the mail client GUI wizard.

Project looks dead no recent releases.