Introducing ProtonMail's Tor hidden service

Re:Introducing ProtonMail's Tor hidden service by mike-cardwell on Thursday January 19, 2017 @11:56AM (#13437254)

This is not quite as good as riseup.net's onion support as it doesn't include SMTP services. See:

https://riseup.net/en/security/network-security/tor#riseups-...

  mike@snake:~$ torsocks telnet wy6zk3pmcwiyhiao.onion 25
  Trying 127.42.42.0…
  Connected to wy6zk3pmcwiyhiao.onion.
  Escape character is ‘^]’.
  220 mx1.riseup.net ESMTP (spam is not appreciated)

So if your mail service supports onion addresses, then you can just replace "@riseup.net" in a users email address with "@wy6zk3pmcwiyhiao.onion".

Alternatively, your mail service could have explicit configuration in place to identify @riseup.net addresses and route them to wy6zk3pmcwiyhiao.onion instead of the normal MX records. I do this with Exim by utilising Tors TransPort+DNSPort functionality and then adding the following Exim router:

  riseup:
    driver = manualroute
    domains = riseup.net
    transport = remote_smtp
    route_data = ${lookup dnsdb{a=wy6zk3pmcwiyhiao.onion}}

Obviously this would be better if there was a way to dynamically advertise the onion address in the DNS instead of having to hardcode it in Exim.

[edit] - If they co-ordinated, Riseup and Protonmail, and potentially other similar privacy respecting mail services could send all their traffic over each other via Tor. If you work for either of these companies, please consider the possibility of looking into this sort of relationship.

[ Parent | on HN ]

Re:Introducing ProtonMail's Tor hidden service by saycheese on Thursday January 19, 2017 @01:18PM (#13438008)

Whatever happened to the Riseup canary issue?

https://riseup.net/canary

https://news.ycombinator.com/item?id=13007234

[ Parent | on HN ]

Re:Introducing ProtonMail's Tor hidden service by zie on Thursday January 19, 2017 @05:04PM (#13439881)

Obviously they either 1) lost the PGP key(or other internal issue) or 2) got served with something that won't let them post new canary messages.

something tells me #2 is probably more likely.

[ Parent | on HN ]

Re:Introducing ProtonMail's Tor hidden service by akerro on Wednesday February 01, 2017 @08:41AM (#13540600)

ProtonMail won't unite with Tutanota, Roundcube or even GPG over standard for email encryption, why would they setup Tor-Tor messaging?

[ Parent | on HN ]

Re:Introducing ProtonMail's Tor hidden service by o- on Friday January 20, 2017 @06:56AM (#13443164)

This is a great idea [your edit]!

And its already being developed by some (not protonmail though). See https://github.com/ehloonion/onionmx

[ Parent | on HN ]

Re:Introducing ProtonMail's Tor hidden service by mike-cardwell on Friday January 20, 2017 @08:52AM (#13443748)

Thanks for pointing this out to me. I have added suitable onionmx DNS SRV records and reconfigured my mail server to utilise them:

  mike@snake:~$ dig +short srv _onion-mx._tcp.grepular.com
  0 5 25 grepularmmmiatj7.onion.
  mike@snake:~$

[ Parent | on HN ]

Re:Introducing ProtonMail's Tor hidden service by 0x0 on Thursday January 19, 2017 @02:12PM (#13438588)

Shouldn't you also add super enforced SSL certificate validation for such a setup? Since SMTP is usually merely opportunistic SSL, any Tor exit node could very easily strip STARTSSL (or just MITM with a fake certificate that doesn't get validated) and you're worse off than running over the normal internet?

[ Parent | on HN ]

Re:Introducing ProtonMail's Tor hidden service by pfg on Thursday January 19, 2017 @02:50PM (#13438902)

Are we talking about using SMTP via the onion service, or just regular SMTP through an exit node? The onion service comes with its own crypto and would not need TLS on top of it (though you're free to use TLS anyway, like Facebook, if it makes sense because of how your infrastructure is set up). There's no exit node for hidden service connections (or any other node that sees the plaintext other than the hidden service itself).

[ Parent | on HN ]

Re:Introducing ProtonMail's Tor hidden service by 0x0 on Thursday January 19, 2017 @03:34PM (#13439233)

Ah, of course you are right. I forgot about hidden services not passing through an exit node.

[ Parent | on HN ]

Re:Introducing ProtonMail's Tor hidden service by mike-cardwell on Thursday January 19, 2017 @03:01PM (#13438998)

There are no exit nodes involved when talking to onion services. The traffic does not leave the Tor network.

[ Parent | on HN ]

[dead]

Re:Introducing ProtonMail's Tor hidden service by Pxtl on Thursday January 19, 2017 @02:00PM (#13438486)

> cucked

Can we not do that?

[ Parent | on HN ]

[dead]

Re:Introducing ProtonMail's Tor hidden service by castis on Thursday January 19, 2017 @03:09PM (#13439061)

What a boring set of unoriginal behaviors you've taken for yourself.

[ Parent | on HN ]

Re:Introducing ProtonMail's Tor hidden service by sctb on Thursday January 19, 2017 @06:10PM (#13440331)

We've banned this troll account.

[ Parent | on HN ]