Silk Road forums
Discussion => Security => Topic started by: kremlin on April 20, 2012, 05:29 pm
-
?
-
Tormail.net was suspended earlier this week & hasn't been consistently up since then. Tormail itself still works fine.
http://jhiwjjlqpyawmpjx.onion
-
actually you can't receive email or send mail to any non-tormail account anymore so it's close to useless
-
so is there any other secure web email? obviously hushmail is out since they sell out users to LE
-
"20 April 2012 - Domain tormail.net Down
Today the regisrar nic.ru disabled our domain tormail.net.
It was not due to any complaint about the tormail service but rather a very stupid demand that they were making from us that we could not comply.
We are still not certain if we will be able to get the domain back, so it is possible that it will be gone forever.
In the best case cenario we can transfer the domain to another registrar which may take 1-2 weeks.
At the moment is it not possible to send or receive email from email addresses outside of tor mail.
It is possible that we will register a new domain name to continue the service."
-
i find the timing of this very suspicious given the takedown of TFM... i'll bet some of those guys busted had tormail accounts and now the registrar is being bullied by the DEA/FBI to make demands to tormails admin. probably want them to release mail accounts or something similar & unethical. anyone else feel the same way? man that takedown of TFM has me spooked! i know its different here but there are still ways that LE can try to get in between the cracks. look at how many SR vendors have tormail addresses listed as backup to SR.
i also have a crazy theory that DPR is somehow current or ex-government/military or somehow connected but has gone rogue because he hates the war on drugs. I think his intentions are very good - he clearly is extremely intelligent and sees outside the box. But he is almost military disciplined from what i see of him online. He also knows a fuckton about tor technology which makes me think maybe he was involved with development of TOR itself. after all, how the fuck could he be so good at securing this site when the FBI/DEA most likely has someone/some service monitoring silk road, constantly trying to find a way to track down a real IP address of the server to find its location. I think the guy is brilliant though - you have to be to pull this shit off for as long as he's done it so far.
-
i find the timing of this very suspicious given the takedown of TFM... i'll bet some of those guys busted had tormail accounts and now the registrar is being bullied by the DEA/FBI to make demands to tormails admin. probably want them to release mail accounts or something similar & unethical. anyone else feel the same way?
x10 didn't have much there but cleaned out what I did then sent an email to admin@tormail.net and asked them to delete my account. Couldn't find a way to do it on my own, or even change the password, for that matter. Fuck, wish there was an alternative service.
-
From my understanding, you can still send emails from your Tormail address to "anyone", however, every Tormail address is now a ".org" instead of a ".net". This is all pretty sudden.
This actually (imo) somewhat adds to the legitimacy of Tormail, but it's going to be some work updating every Tormail account we have. :(
This is the message they ALL 'just' received, but this information is not 'yet' reflected on their website.
I do believe this was very unexpected for them and they are doing their best. We should know FOR SURE tonight or tomorrow:
-----
Dear Tor Mail User,
Early this morning, April 20, our domain registrar nic.ru suspended the domain tormail.net.
The reason they gave is because they require us to submit ID documents to them, apostilized and certified by the Russian Embassy.
We are unable to do this to protect our own identity, and also this request is very unusual and suspicious.
They have further refused to unlock the domain and allow us to transfer it to a different registrar.
We have filed a complaint with ICANN as per the domain transfer rules, they are not allowed to do this.
As it is the weekend, we probably wont get a response until next week, and even to transfer a domain normally takes about a week to be completed.
For this reason, at the earliest we can hope for is to have the domain back within two weeks.
It is possible the domain is gone for good and it may not be possible to get it back.
Up until two months ago, the domain was registered with a USA company, Moniker domains.
They were great and we had no problems with them, but with the recent domain seizures we decided to move the domain offshore.
It appears this was a big mistake, the Russian providers are much worse!
The chances of getting the domain back does not look good, and even if we get it back it will take a long time.
For that reason we have registered a new domain name tormail.org and will use that one to continue the service.
If we do get the tormail.net domain back, we will change back to using that one.
Every user who had a @tormail.net address now has the same address @tormail.org
Your new email address is: "your-email"@tormail.org
You may continue to use the @tormail.net addresses on the Tor Mail website, but they will not work with external services.
You should quickly change the email addresses at any services you are using.
If we get the tormail.net domain back, both addresses will be able to reach you.
If you are using our webmail service, (squirrelmail or roundcube) no changes are necessary.
If you are using thunderbird or other SMTP software, you will need to change the "From" address to your new tormail.org address or you will be unable to send mail.
This message has also been posted at our hidden service, so you can verify its validity.
http://jhiwjjlqpyawmpjx.onion/
Sorry for the inconvenience, but we were taken by surprise by this and had no time to avoid it.
Admin.
-----
Peace
The Flipside Crew
-
tested and .org works, lol should've bought an Iceland domain
-
Good to know! :)
Still not updated on their website yet unfortunatly, but sure it will be. No 'real' reason to believe otherwise.
At least this 'somewhat' explains the "Russian connections" being discussed in another recent thread. :)
Peace
The Flipside Crew
-
tested and .org works, lol should've bought an Iceland domain
I agree, sir, and .org does indeed work. Just changed all my listings to reflect that.
-
at this point I think I am going to stick to the SR system only and ride it out without email for awhile. My nerves can't it lol
-
i also have a crazy theory that DPR is somehow current or ex-government/military or somehow connected but has gone rogue because he hates the war on drugs. I think his intentions are very good - he clearly is extremely intelligent and sees outside the box. But he is almost military disciplined from what i see of him online. He also knows a fuckton about tor technology which makes me think maybe he was involved with development of TOR itself. after all, how the fuck could he be so good at securing this site when the FBI/DEA most likely has someone/some service monitoring silk road, constantly trying to find a way to track down a real IP address of the server to find its location. I think the guy is brilliant though - you have to be to pull this shit off for as long as he's done it so far.
Lots of people are Ex-mil (after a fashion). In certain areas of the country and in certain families it is simply expected you will "do a hitch" like your father and grandfather etc. did. This may be considered "part of what you do to be sure you are in the will" (in rich families) or what you do to attain adult level respect from the other men in your family.
Contrary to popular perception the military is NOT in fact very disciplined, nor are they very deadly in and of themselves. Basically they are (99% of the time, everyone except the SPECOPs community) bureaucrats and paper pushers with a group history of marching in formation in funny identical suits and getting up early 3 times per week and going on a leisurely jog possibly with some calisthenics. They are NOT..
1. especially honorable
2 especially disciplined (all their reinforcement mechanisms are external.. take away the regs and POOF)
3. anything like efficient
4. anything like deadly, except where they have massive numbers and incredible amounts of federal money on their side.
Take it from someone who knows a little about the armed "service".. what you are seeing in terms of discipline and subtlety of mind is NOT indicative, typical or characteristic of anyone who learned to think in uniform.
By far the most disciplined people, the deadliest scariest people (in a good way) and the most technologically savvy people I've ever met had no significant military/gov background.
-
brutusk,
Using GPG with email has been the time-tested and proven way of doing business since the inception of this scene, many, MANY years ago.
SR (and the "unknown/unrevealed" encryption methods they use to protect your private information) have been in use for about a year or so.
If you are using GPG, this "temporary" Tormail issue will not effect the security of "any" of your communications and is nothing to be concerned about or run from.
Tormail (like SR) simply provides a welcome, additional "Tor-based" layer of security to your online communications. Tor is 'primarily' designed to hide your IP, not ensure your encryption. That is what GPG is for. So any Tormail users using GPG have NOTHING to worry about really.
We are however "very" curious to see how this plays out, legally. :)
Peace
The Flipside Crew
-
I was in the process of sending some coins through Coinapult and used the .net address. Definitely worst timing ever >:( Hopefully they can get the e-mail resent to the correct address.
-
Early this morning, April 20, our domain registrar nic.ru suspended the domain tormail.net.
The reason they gave is because they require us to submit ID documents to them, apostilized and certified by the Russian Embassy.
We are unable to do this to protect our own identity, and also this request is very unusual and suspicious.
They have further refused to unlock the domain and allow us to transfer it to a different registrar.
We have filed a complaint with ICANN as per the domain transfer rules, they are not allowed to do this.
As it is the weekend, we probably wont get a response until next week, and even to transfer a domain normally takes about a week to be completed.
For this reason, at the earliest we can hope for is to have the domain back within two weeks.
It is possible the domain is gone for good and it may not be possible to get it back.
Up until two months ago, the domain was registered with a USA company, Moniker domains.
They were great and we had no problems with them, but with the recent domain seizures we decided to move the domain offshore.
It appears this was a big mistake, the Russian providers are much worse!
The chances of getting the domain back does not look good, and even if we get it back it will take a long time.
For that reason we have registered a new domain name tormail.org and will use that one to continue the service.
If we do get the tormail.net domain back, we will change back to using that one.
Every user who had a @tormail.net address now has the same address @tormail.org
You may continue to use the @tormail.net addresses on the Tor Mail website, but they will not work with external services.
You should quickly change the email addresses at any services you are using.
If we get the tormail.net domain back, both addresses will be able to reach you.
If you are using our webmail service, (squirrelmail or roundcube) no changes are necessary.
If you are using thunderbird or other SMTP software, you will need to change the "From" address to your new tormail.org address or you will be unable to send mail.
Sorry for the inconvenience, but we were taken by surprise by this and had no time to avoid it.
Admin.
-
I still don't like the fact that these events, or the message sent to each tormail address (quoted above) has not yet been reflected on their website, either the .net or the .org.
I guess it depends on how much control they have over the original domain at this point, but since they have control of the .org at least, you would think by now they would have made this information public. Until they do, we are going to err or the side of caution. There is always the small, remote (tinfoil) chance that the tormail server was hacked/cloned, but if that were tha case, then again, they would likely have updated their website to reflect that fact too. So it''s probably legit.
I'm surprised they didn't register the domain with "Domains by proxy" (if they are still around) to protect their anonymity, since that seems to be the issue.
Just some healthy paranoia. ;)
Peace
The Flipside
-
I still don't like the fact that these events, or the message sent to each tormail address (quoted above) has not yet been reflected on their website, either the .net or the .org.
They reflected it on their hidden service site and it makes sense, cause .net or .org sites is just a fence around hidden service.
-
lucy,
Could you provide a link to where they have this posted on their hidder-service site?
This is the url: http://jhiwjjlqpyawmpjx.onion/
I don't see it mentioned anywhere. :(
New sign-up's have also been disabled for now. Understandable, considering the circumstances.
Peace
The Flipside Crew
-
Take it from someone who knows a little about the armed "service".. what you are seeing in terms of discipline and subtlety of mind is NOT indicative, typical or characteristic of anyone who learned to think in uniform.
By far the most disciplined people, the deadliest scariest people (in a good way) and the most technologically savvy people I've ever met had no significant military/gov background.
I kinda agree and disagree. It depends on who we are talking about. It's like the difference between a police officer and a FBI agent, or a normal university student and a geeky university student.
The average military solider isn't particularly disciplined anymore than the typical person in the street. True. They are regular people. Nothing wrong with that either. But grunts aren't supposed to think, they are supposed to obey to the exclusivity of anything else. If you ever meet a Navy SEAL or a SAS solider i.e. what the British call Commandos, then you're up against a rarer animal.
Those guys are highly intelligent, highly disciplined and extremely motivated. However, what I called 'highly disciplined' isn't what most people might think of as being disciplined. Commandos in fact, are notorious for being independent minded and next to impossible to control via regular army disciplinary techniques. Being an independent thinker == getting shit done = being intelligent. The Army, despite it's lampooning from the left such as H.G. Wells, who said the army is chock full of the most stupid people on the planet (this is the left who also ironically support a larger army in a different context), was smart enough to recognize that chaotic irregular thinking might be more effective than well ordered activities dependent on hierarchy.
tldr; it depends!
Off topic thought: Commonly I hear it is said commandos show psychopathic tendencies. That is to say: psychologists think these kinds of people don't use society as a frame of reference. They also say this about successful business people. That is because psychologists are probably all closet Marxists, which is a different discussion! (see the movie 'The Corporation' to get a sense of what I mean). Doubtless in the future, not being on Facebook for an hour a day will be seen as evidence of some <insert label here>pathy to be remedied by many expensive hours of counseling and box ticking (sic) :D
-
Quick questions for 'mdmamail' or 'goblin' or any others that may know.
I have tried using multiple settings and cannot get GPG keys to work any longer.
1. If using an emaill client like Thunderbird, should one reset all extensions to ".org" in all the settings for that Tormail account?
2. I didn't "think" this would have an impact on GPG keys, yet (after trying multiple .net/.org settings with pre-existing accounts) and trying to encrypt an email using GPG/Enigmail, I get this error
----------------
OpenPGP Alert
The email address or key ID '123abc@tormail.org' cannot be matched to a valid, not expired OpenPGP key.
Please ensure that you have a valid OpenPGP key, and that your account settings point to that key."
----------------
Any thoughts anyone? I'm sure it's something simple. Am I the only one getting this error?
And QTC, I believe you are correct. Yet intil I can get "any" Tormail accounts to work again, I cannot verify, but they do clearly state:
"At the moment is it not possible to send or receive email from email addresses outside of tor mail."
With "at the moment" being the operative words. I'm sure they will work this out eventually. :)
Thanks in advance for any help guys!
Peace
The Flipside Crew
-
- whats important is the server you connect to on port 25 is jhiwjjlqpyawmpjx.onion
- rename the account to .org if you called it tormail.net but this just what its called in thunderbird. once its renamed i noticed other labels also renamed to .org...
.{if this makes sense..}
-
It seems this information has now been updated on there .onion website. I also don't think all the changes will be immediate. As of now I can send between two ".net" Tormail addresses no problem, GPG/key wise.
But trying to send anything encrypted with a ".org" address isn't working. This is in direct contrast to what they state:
"If you are using thunderbird or other SMTP software, you will need to change the "From" address to your new tormail.org address or you will be unable to send mail
Yet. I think they are doing their best. Patience is a virtue. ;)
And actually, they do say:
"You may continue to use the @tormail.net addresses on the Tor Mail website, but they will not work with external services."
So I believe "eventually" the new ".org" addresses should be able to access outside mailservers.
In the mean time, they also say:
"If you are using our webmail service, (squirrelmail or roundcube) no changes are necessary."
Although this isn't working "overall" or us yet, I'm sure it will come in good time. With the amount of Tormail addresses we have, using their web-mail service would be ridiculously time-consuming, and considerably more unsafe for multiple reasons.
So until they get things worked out, I believe we will be posting a new (temporary) public email/key on another mailserver for those wishing to continue to be in GPG encrypted contact for now. We will post this information on our profile page shortly.
All things in good time I suppose. :)
Thanks to all for your help and insight. We feel confident this will all end well. According to the message from Tormail, it was apparently a BLATENT disregard of ICANN rules and regulations. Which makes us even more curious about the 'politics' behind this action at this point.
Time will tell... :)
Peace
The Flipside Crew
-
In thunderbird, go to openpgp under preferences---- click "by rules and email addresses" or even pre-set rules only....then just point account to the key you have saved. Go to account settings ----> openpgp security ----> "use specific key..."
-
So .org for people that want to email you that don't use tormail?.net still works for people that are using tormail, to contact you?
-
I've tried singing up for tormail a couple times now yesterday and today at the tormail.org, but they say they aren't allowing new user accounts? I am iso an anonymous email account like tormail, what are the alternatives as the original question asks (as I haven't seen an answer posted)? I've read that hushmail is an alternative, but they will give your info to LE. Is something like privacybox comparable? Thanks
-
i'm using "tormail" very rare, but i've an important question: what kind of "mail" - provider CAN RECEIVE MAILS, when sent from "tormail" itself i'm not really fun of, creating multiple mail accounts on "freemail" - providers, to try it out... so anyone know?
-
I've tried singing up for tormail a couple times now yesterday and today at the tormail.org, but they say they aren't allowing new user accounts? I am iso an anonymous email account like tormail, what are the alternatives as the original question asks (as I haven't seen an answer posted)? I've read that hushmail is an alternative, but they will give your info to LE. Is something like privacybox comparable? Thanks
Yes, new Tormail account registrations are not being accepted at this time. We are considering listing and selling the "excess/overflow" of "clean" pre-registered Tormail addresses we have to the highest bidders.
j/k..."of course" ;)
But shortly before Tormail went online, "fastmail.fm" was recommended to us by a close, knowledgable friend as being a good, free email provider where you could sign up using Tor and integrate GPG. However, it seems their "free" accounts no longer include use of their outgoing STMP server (aka, you can't send emails) if using an email client, like Thunderbird, ect.
Therefore, we are also very curious as to know the answer to the original question posed in this thread.
What is the best alternative for a free, non-domestic, "anonymity-based", email provider one can sign up with using Tor, that allows for both IMAP (POP?) and STMP server connections from an email client?
We would like to set up a "temporary" public email/key for our customers wishing to continue GPG encrypted email contact with us until all Tormail issues have been resolved, but would like to know the 'next best bet' to Tormail at this point. Please don't say Hushmail...Or we WILL be forced to delete you from the source code of reality and the multiverse itself. ;)
Any thoughts very much appreciated! :)
Peace
The Flipside Crew
-
I only use the webservice, seems a lot more secure. why should I download the mails?
My only problem are lazy vendors that dont want to encrypt everything. Just one encrypted message for one conversation, and yeah its thats simpel. just open it and close it with a key. But I see it too often that my message is decrypted and sent back plain... :-/
... no, no names and it was more than one.
-
Actually the webservice can be "less" secure depending on which service you use. At least "Squirrel Mail" doesn't require Java, which can be manipulated/used maliciously against you in many ways.
Also, using an email client (like Thunderbird) allows you to keep things "organized" in one place, especially when you have a lot of email accounts (like we do). There are many, many other good reasons folks use an email client, including retaining complete control of your private keys via Enigmail, ect. (Unless I'm mistaken about the webservice?)
Does anyone have the "next best bet"? We would like to post a new email/key for our customers, but are at a bit of a loss at this point. We had depended on fastmail as a "back-up" from previous advice. We were completely unable to even generate a key pair for any "fastmail.fm" address, let alone use their outgoing STMP server as a "free" user.
We have contacted multiple, knowledgeable vendor friends of ours, but they can take up to a week to respond at times. Any thoughts until Tormail is back 100%? A FREE service for everyone? Off-shore? "Anonymity" conscious? IMAP/POP/STMP capable? Tor-accessible and GPG capable for the masses? Do we really have to use Gmail? :(
Thanks!
Peace
The Flipside Crew
-
http://www.wilderssecurity.com/showthread.php?t=318935
doesn't matter what provider, use anonymizing network and only pgp but if you advertise your address out in the clear they will cancel it no matter what service. still not convince tormail is not russian security services setup and trap. would be typical for them to make big phony spectacle like pulling domains to encourage local dissident to use it. federal security services tried to outlaw Gmail and Hotmail last year coz American's don't give them access to it and terrorists are stupid, don't use pgp and write everything in clear
-
Even if Tormail were run by the DEA...
We still have three letters that beat them....GPG! :)
So "not likely" in our opinion.
Peace
The Flipside Crew
-
Hushmail is good, only downside is that u have to pay for a membership if you want external mail app support (IMAP, POP). Other than that, its awesome. Just sign up, everything uses encryption, you can export your private key from the hushmail servers and use it with your PGP client.
On another note, I believe this whole situation has to do with the bomb scares at University of Pittsburgh, which happens to be....about 45 minutes away from my house lol. The FBI confiscated a server that was running on the "Original" Tor network before it got mad funding and became Tor. I can't remember the name of the service/site it was but it was an anonymous email service with tor and encryption, and this I believe is making the companies that manage all these anon servers a little nervous. Plus tormail.net was hosted in Russia.......Russia? Come on. I coulda told u that was a bad idea from the beginning. Ever watched locked up abroad :P.
This is just all completely ridiculous, the FBI gets nowhere by confiscating the server...No information is held on it...And due to the nature of the service, keeps all its users identities completely anonymous...Like I said, no personal information is stored on the server.....And the FBI knows this, they just wanna piss people off...Which never works in there favor, I'm sure Anonymous is cooking up some ideas on how to fight this threat against our freedoms and liberties.
Its all bullshit! We are not FUCKING hurting anyone...
If any of the information I presented isn't right please correct me. It is merely my opinion.
-
LOL... :)
We LOVE "Locked up Abroad". Especially since we are "abroad" ourselves quite often. :)
But yeah, sending an encrypted GPG message "thru" hush is safe if keys are exchanged. But hush cooperates 100% with LE, and have "backdoors" written into their source code, ect.
Hush should NOT be trusted (100%) unless you know what you are doing. GPG wise.
So basically, agreed my friend. :)
Peace
The Flipside Crew