Tor Mail

» see tormail.org as it lived, on the wayback machine

~ the obituary ~

Tor Mail appeared around 2010 and did the one thing the Tor network had no good answer for. You could browse anonymously and you could publish anonymously, but you could not easily receive a reply. Tor Mail gave you an inbox reachable from inside the network and from the ordinary internet, with no name and no address required at signup. There were two web clients, one full Ajax build and one plain version that needed neither JavaScript nor cookies, and the service also spoke SMTP and IMAP for anyone who wanted to use a real mail program.

The architecture was the selling point. The operators said the hard drives on the public-facing relays held the Exim mail server and the Tor software and nothing else, so it did not matter who seized them. No messages on those boxes. No logs. Relays did not know the address of the hidden service they fronted. If a relay went offline the operators said they would replace it within hours, and they said they would not help anyone identify or censor a user.

All of that turned out to be true and all of it turned out to be irrelevant, because the machine that mattered belonged to somebody else.

~ the case file ~

~ who it was actually for ~

The Tor Mail user base was the Tor user base, which is to say it was not one group. Journalists working sources and people in countries where the wrong email address is evidence were signing up alongside a heavy trade in stolen card numbers, all of them for the same reason. That mixture is the permanent problem with anonymity services and nobody has solved it since.

It also meant the service died on somebody else's reputation. Freedom Hosting carried a very large share of all Tor hidden services in 2013, and among them were sites its operator was later sentenced to twenty-seven years over. Tor Mail had nothing to do with those and shared a landlord with them.

~ the week in august ~

Eric Eoin Marques was arrested in Dublin at the end of July 2013. On 4 August the Freedom Hosting estate went down together, and users who reloaded a page during that window were served a JavaScript exploit against Firefox 17, the version the Tor Browser Bundle was built on at the time. The payload reported the real IP address and the Windows machine name back to a server in Virginia. JavaScript had been enabled by default in the bundle. It was not after that.

Tor Mail's front page carried a short notice that week. "Down for Maintenance. Sorry, This server is currently offline for maintenance." In September the FBI confirmed in a Dublin court filing that it had taken Freedom Hosting down. In January 2014 Wired reported that the bureau had a copy of the Tor Mail server, and in January 2016 Motherboard reported that innocent Tor Mail accounts were likely searched along with everything else.

~ the distance ~

I have read about Tor for as long as I have been an engineer and I have never had a reason to want an untraceable mailbox. That is a statement about my life rather than about the service. The people who needed Tor Mail needed it badly enough that when it vanished there was no orderly migration anywhere, just a set of addresses that stopped working and a set of conversations that ended mid-thread.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »