Silk Road forums

Discussion => Security => Topic started by: random0 on August 02, 2012, 11:47 am

Title: Missing emails with Tormail? Anyone else?
Post by: random0 on August 02, 2012, 11:47 am
There are several emails I never received but the sender claims it was sent, and also have mails I sent but never arrived.
Anyone else experienced the same thing?
Title: Re: Missing emails with Tormail? Anyone else?
Post by: Boris Badenov on August 02, 2012, 08:02 pm
Have you checked in the junk folder in tormail? Sometimes they route it there for strange reasons.

BB
Title: Re: Missing emails with Tormail? Anyone else?
Post by: Travis Bickle on August 02, 2012, 10:39 pm
Yes I am in the same boat as you! I deposited some funds into Bitinstant and, normally, I get emails from TrustCash within minutes about the deposit. It has been almost an hour and I still haven't received any emails to my Tormail address about the deposit.

Also, when I try to send an email message from Tormail, I get the message, "SMTP error: [451] Error while writing spool file". Looks like Tormail is having some problems. I do hope that I get my confirmation emails from Bitinstant and Coinapult soon!
Title: Re: Missing emails with Tormail? Anyone else?
Post by: justaoneoffthistime on August 03, 2012, 12:15 am
I'm having the same problem right now with safe-mail....
Title: Re: Missing emails with Tormail? Anyone else?
Post by: justaoneoffthistime on August 03, 2012, 12:29 am
Trying to reg a tormail account, have been through about 30 captchas and it isn't taking any...???
Title: Re: Missing emails with Tormail? Anyone else?
Post by: throwAway5497 on August 03, 2012, 12:33 am
I haven't been able to log in to SquirrelMail all day. If I give it a wrong pw then it gives me the expected "Wrong username or password" error but with the correct login info I get "You must be logged in to access this page." Don't know if it's related but it's getting frustrating  :-\
Title: Re: Missing emails with Tormail? Anyone else?
Post by: random0 on August 03, 2012, 01:11 am
tormail.org is down at the moment, but my mails are missing apart from that.
Title: Re: Missing emails with Tormail? Anyone else?
Post by: Holly on August 03, 2012, 02:14 am
Tormail is working fine as far as login, I might be missing an email.  I was suspecting I was because I usually hear back from this contact within 24 hours but it's been more.  Was suspicious that I was missing the email before I saw this thread, so this may be not just you.


edit:
Yes I am in the same boat as you! I deposited some funds into Bitinstant and, normally, I get emails from TrustCash within minutes about the deposit. It has been almost an hour and I still haven't received any emails to my Tormail address about the deposit.

Also, when I try to send an email message from Tormail, I get the message, "SMTP error: [451] Error while writing spool file". Looks like Tormail is having some problems. I do hope that I get my confirmation emails from Bitinstant and Coinapult soon!

nevermind, I am getting this error too when sending.  you think any emails get lost when this shit happens? i'm expecting an important email -_-


edit #2
emails confirmed missing, emailed the other person off similar alias and they have responded.
tormail is lagging.
Title: Re: Missing emails with Tormail? Anyone else?
Post by: LouisCyphre on August 03, 2012, 08:31 am
Also, when I try to send an email message from Tormail, I get the message, "SMTP error: [451] Error while writing spool file". Looks like Tormail is having some problems. I do hope that I get my confirmation emails from Bitinstant and Coinapult soon!

A 451 error is a temporary one, so the messages won't have bounced back to the sender (yet).  That normally takes 4 or 5 days, depending on the settings of the servers involved.
Title: Re: Missing emails with Tormail? Anyone else?
Post by: LowWaterGate on August 03, 2012, 11:23 am
Tormail's login is again disabled.  I get the message: 
Quote
You must be logged in to access this page
.

If someone associated with Tormail could respond to this, that would be great.

If a moderator could re-title this thread to include the login problem, that would be great as well.  Suggestion:
Quote
Login failures and missing emails w/ Tormail

LWG
Title: Re: Missing emails with Tormail? Anyone else?
Post by: Hungry ghost on August 03, 2012, 04:40 pm
Ah I have been having same login problem. I was sure I had password right!
The reason I was checking my tormail was because I have been having trouble logging in to these forums too. I am absolutely sure my login details are correct, but it keeps saying " an error has occurred try again in 2 seconds"
Eventually I sent a password reset to tormail. I am unable to access my tormail, but weirdly my forum login works again. This has happened twice today now.
Title: Re: Missing emails with Tormail? Anyone else?
Post by: LouisCyphre on August 03, 2012, 04:46 pm
Ah I have been having same login problem. I was sure I had password right!
The reason I was checking my tormail was because I have been having trouble logging in to these forums too. I am absolutely sure my login details are correct, but it keeps saying " an error has occurred try again in 2 seconds"
Eventually I sent a password reset to tormail. I am unable to access my tormail, but weirdly my forum login works again. This has happened twice today now.

Lots of people are having login problems with the forum.  See this thread for details:

http://dkn255hz262ypmii.onion/index.php?topic=33848.0
Title: Re: Missing emails with Tormail? Anyone else?
Post by: mask on August 03, 2012, 05:09 pm
I have the same problem with Tormail.

I have just transfered bitcoins from bitinstant and now I don't get any emails, not even a confirmation!

Also I have to use the java script based webmail because squirrel mail doesn't work, it says "you need to login" when I try to login. What the fuck. What a fucking shitsite is this. I need my bitcoins..
Title: Re: Missing emails with Tormail? Anyone else?
Post by: hasmyaccountbeenhacked? on August 03, 2012, 08:33 pm
im under a different id on here as i cant login like many others,i also have mails missing from tor,not trying to panic anybody but theres been some strange goings on inthe last 24-48hrs
Title: Re: Missing emails with Tormail? Anyone else?
Post by: manger on August 03, 2012, 09:38 pm
mine works on cube, but its missing all the emails and doesn't work on squirrel. and i couldn't login to my normal sr forum account.
Title: Re: Missing emails with Tormail? Anyone else?
Post by: NFHC on August 03, 2012, 09:55 pm
honestly, you guys should consider using alternative email providers to tormail, they already lost their .net address. we aren't sure who runs it and the password policy is quite weak.

there are bigger providers that will help you blend in better. using tormail basically announces to the world you're doing something sketchy.
Title: Re: Missing emails with Tormail? Anyone else?
Post by: NeutronMan on August 03, 2012, 10:32 pm
Looks like it's just one of those things that has to work itself out. Being a free service, there really isn't much that can be expected of it.

NeutronMan
Title: Re: Missing emails with Tormail? Anyone else?
Post by: intercom on August 04, 2012, 12:52 am
nfhc: what email service do you recommend?
Title: Re: Missing emails with Tormail? Anyone else?
Post by: NFHC on August 04, 2012, 03:03 am
nfhc: what email service do you recommend?

depends on what you're looking for but it's better to use a popular email service, such as gmail or yahoo (sorry both of those require javascript at least to sign up). You can use POP or IMAP after that. I don't want to announce the provider I'm using to the forum but enough research and you'll find a free webmail that doesn't require javascript.
Title: Re: Missing emails with Tormail? Anyone else?
Post by: NATURE ALCHEMIST on August 04, 2012, 04:49 am
same problem here with tormail login    >:(
Title: Re: Missing emails with Tormail? Anyone else?
Post by: intercom on August 04, 2012, 03:38 pm
nfhc: what email service do you recommend?

depends on what you're looking for but it's better to use a popular email service, such as gmail or yahoo (sorry both of those require javascript at least to sign up). You can use POP or IMAP after that. I don't want to announce the provider I'm using to the forum but enough research and you'll find a free webmail that doesn't require javascript.

thanks for responding...but gmail or yahoo (or the like)? fuck that shit.
Title: Re: Missing emails with Tormail? Anyone else?
Post by: NFHC on August 04, 2012, 03:44 pm
nfhc: what email service do you recommend?

depends on what you're looking for but it's better to use a popular email service, such as gmail or yahoo (sorry both of those require javascript at least to sign up). You can use POP or IMAP after that. I don't want to announce the provider I'm using to the forum but enough research and you'll find a free webmail that doesn't require javascript.

thanks for responding...but gmail or yahoo (or the like)? fuck that shit.


can you expand on "fuck that shit"?

using a popular free email provider that people use encryption on for purposes other than drugs or using a service like hushmail that's obviously used for doing naughty things... HMMM
Title: Re: Missing emails with Tormail? Anyone else?
Post by: LouisCyphre on August 04, 2012, 04:09 pm
I sent myself some test messages from PrivacyBox shortly after this thread started and they've all appeared now, so it was likely an issue that has been resolved.
Title: Re: Missing emails with Tormail? Anyone else?
Post by: suckmyballs on August 04, 2012, 06:25 pm
Since so many people use Tormail here it is a given that that feds will seize those servers. Not really a problem since you are ONLY using TOR to connect. You have never sent a mail from your Tormail to somebody who knows you and of course you ALLWAYS use gpg/pgp. If you are dumb enough to use a public key that can identify you … well you are retarded.  Just plop in a copy of TAILS and use the I2P  mail service there. Using Windows is retarded. Was thinking about pen testing some of the application layers (SQLi) on SR. Damn I hope SR is using OpenBSD and smart enough to secure the DB structures. Got sqlmap, Arachni  and some other goodies ready to be piped into the dark nets. If I find some shit Ill let SR know about it. All the new “weirdo” shit going on here like “spiffy” looks and the admin now talking excessively to users makes me a bit uneasy. When antisec was taken out the FBI had all ready nailed Sabu weeks before. Whats this moral BS with “no guns”?! Got that little uneasy itch under my nut sack.
Title: Re: Missing emails with Tormail? Anyone else?
Post by: NFHC on August 04, 2012, 08:26 pm
okay, but I don't understand what the problem is if you use a clearnet email and always use Tor and PGP.  Are you banking on them cooperating with the feds and cracking your encrypted emails?

Can you clarify?
Title: Re: Missing emails with Tormail? Anyone else?
Post by: NFHC on August 04, 2012, 09:50 pm
Okay, that's a fair point, thank you for clarifying.
Title: Re: Missing emails with Tormail? Anyone else?
Post by: Travis Bickle on August 04, 2012, 11:37 pm
I have finally received the missing emails in my Tormail account! Most importantly I received the confirmation emails from Bitinstant and Coinapult about the bitcoins I had deposited a day and a half ago. The missing emails may have been due to technical problems at Tormail, although I was a nervous Nelly because of all the other weird things that have been happening lately in the Bictoin market, and so on.....
Title: Re: Missing emails with Tormail? Anyone else?
Post by: suckmyballs on August 04, 2012, 11:48 pm
Why not use the I2P darknets. Postman with Susimail is all part built into TAILs. Yes you can send mail to/from tormail, I2P mail and normal mail. Might put up a tut on how to use I2P if others want it..
Title: Re: Missing emails with Tormail? Anyone else?
Post by: LouisCyphre on August 04, 2012, 11:57 pm
I have finally received the missing emails in my Tormail account! Most importantly I received the confirmation emails from Bitinstant and Coinapult about the bitcoins I had deposited a day and a half ago. The missing emails may have been due to technical problems at Tormail, although I was a nervous Nelly because of all the other weird things that have been happening lately in the Bictoin market, and so on.....

You know, it's pretty rare for email to be lost. Most systems will re-try sending email for up to 5 days, trying again and again until they get a confirmation that it was received, or the 5 days are up.

Earlier in the thread someone included an error message indicating there was an error writing to the mail spool.  It's possible that they ran out of disk in /var/spool/mail or something like that.

Anyway, it was returning 451 errors so it was definitely telling senders that the error was temporary.
Title: Re: Missing emails with Tormail? Anyone else?
Post by: Limetless on August 05, 2012, 12:00 am
A vendor I talk to a lot on here thinks Tormail has been compromised, seriously considering abandoning it.
Title: Re: Missing emails with Tormail? Anyone else?
Post by: DrChong on August 05, 2012, 12:52 am
I was getting the SMTP 421 error myself last night on tormail...emails weren't sent or received. Working fine right now, but unfortunately I fear that I've lost some bitcoins in the process. I used bitinstant through email (e.g. coinapult), received the email from coinapult late last night, but when I clicked the link the page showed up as holding 0 bitcoins, even though the email noted that the link contained my bitcoins? What happened and is there any remedy to this?
Title: Re: Missing emails with Tormail? Anyone else?
Post by: LouisCyphre on August 05, 2012, 01:06 am
A vendor I talk to a lot on here thinks Tormail has been compromised, seriously considering abandoning it.

Jacob Appelbaum has tweeted to the effect that he thinks it's a honeypot or could easily be one.  As long as everything sent through it is encrypted it can still be used, but it has to be everything.
Title: Re: Missing emails with Tormail? Anyone else?
Post by: Limetless on August 05, 2012, 01:08 am
A vendor I talk to a lot on here thinks Tormail has been compromised, seriously considering abandoning it.

Jacob Appelbaum has tweeted to the effect that he thinks it's a honeypot or could easily be one.  As long as everything sent through it is encrypted it can still be used, but it has to be everything.

Who is Jacob Applebaum? I'd rather just not use it anymore tbh.
Title: Re: Missing emails with Tormail? Anyone else?
Post by: NATURE ALCHEMIST on August 05, 2012, 01:15 am
A vendor I talk to a lot on here thinks Tormail has been compromised, seriously considering abandoning it.

+1 and wasn´t the first time that this shit happens. i havn´t any compromising mail but for precaution i think everyone must leave tormail definitely.
Title: Re: Missing emails with Tormail? Anyone else?
Post by: LouisCyphre on August 05, 2012, 01:17 am
A vendor I talk to a lot on here thinks Tormail has been compromised, seriously considering abandoning it.

Jacob Appelbaum has tweeted to the effect that he thinks it's a honeypot or could easily be one.  As long as everything sent through it is encrypted it can still be used, but it has to be everything.

Who is Jacob Applebaum? I'd rather just not use it anymore tbh.

Tor developer big-wig.  Goes by the handle of ioerror.

As for Tor Mail, an alternative and/or replacement would be good.  Depending on how geeky to wanted to get, you could get a VPS anonymously with BTC and configure it with all the things you need for mail and run a hidden service yourself.

As long as the volume(s) it was running off are completely encrypted it could be a decent-ish solution.

EDIT:  I've clearly been awake too long and forgotten the obvious.  This will still need a clearnet domain name to receive mail from 99.9% of people.  The subdomain/hostname of the VPS would work, but it would change the email address every time the hosting provider was changed.

So you'd need an anonymously obtained VPS running a hidden service (so you can connect entirely within the Tor network) and an anonymously obtained domain name.

This would be a lot easier if onion.to did port forwarding for SMTP in addition to just forwarding HTTP traffic.  Still, that could be abused.
Title: Re: Missing emails with Tormail? Anyone else?
Post by: Limetless on August 05, 2012, 01:50 am
A vendor I talk to a lot on here thinks Tormail has been compromised, seriously considering abandoning it.

Jacob Appelbaum has tweeted to the effect that he thinks it's a honeypot or could easily be one.  As long as everything sent through it is encrypted it can still be used, but it has to be everything.

Who is Jacob Applebaum? I'd rather just not use it anymore tbh.

Tor developer big-wig.  Goes by the handle of ioerror.

As for Tor Mail, an alternative and/or replacement would be good.  Depending on how geeky to wanted to get, you could get a VPS anonymously with BTC and configure it with all the things you need for mail and run a hidden service yourself.

As long as the volume(s) it was running off are completely encrypted it could be a decent-ish solution.

I have no idea what you just said my friend.
Title: Re: Missing emails with Tormail? Anyone else?
Post by: LouisCyphre on August 05, 2012, 02:21 am
As for Tor Mail, an alternative and/or replacement would be good.  Depending on how geeky to wanted to get, you could get a VPS anonymously with BTC and configure it with all the things you need for mail and run a hidden service yourself.

As long as the volume(s) it was running off are completely encrypted it could be a decent-ish solution.

I have no idea what you just said my friend.

That rules that out then.

Replacing a service for sending mail anonymously is simple.  Mixmaster is fine for that.  The problem is getting a suitably easy to use anonymous email address to receive mail at.  This is where Tor Mail has a real advantage, even if it is a honeypot.

There are alternatives, of course, but they're not all as easy to use as Tor Mail, which is just an ordinary mail service with access to retrieving it restricted to Tor.

With any luck Guru will chime in soon with a decent explanation of various nym server solutions and AAM solutions.  Both of which require GPG for all communication.
Title: Re: Missing emails with Tormail? Anyone else?
Post by: 751a696c24d97009 on August 05, 2012, 04:11 am
Damn, this all makes me want to steer clear of Tormail now... What about keys for PGP? When you list the email in GPA when you generate your keys, could that mean the keys are compromised if Tormail is too? I doubt it, but I'd rather not be using a set of compromised keys.
Title: Re: Missing emails with Tormail? Anyone else?
Post by: Travis Bickle on August 05, 2012, 05:02 am
As for Tor Mail, an alternative and/or replacement would be good.  Depending on how geeky to wanted to get, you could get a VPS anonymously with BTC and configure it with all the things you need for mail and run a hidden service yourself.

As long as the volume(s) it was running off are completely encrypted it could be a decent-ish solution.

I have no idea what you just said my friend.

That rules that out then.

Replacing a service for sending mail anonymously is simple.  Mixmaster is fine for that.  The problem is getting a suitably easy to use anonymous email address to receive mail at.  This is where Tor Mail has a real advantage, even if it is a honeypot.

There are alternatives, of course, but they're not all as easy to use as Tor Mail, which is just an ordinary mail service with access to retrieving it restricted to Tor.

With any luck Guru will chime in soon with a decent explanation of various nym server solutions and AAM solutions.  Both of which require GPG for all communication.

Is Hushmail (after you register an account through Tor) a viable alternative to Tormail?
Title: Re: Missing emails with Tormail? Anyone else?
Post by: Limetless on August 05, 2012, 05:03 am
As for Tor Mail, an alternative and/or replacement would be good.  Depending on how geeky to wanted to get, you could get a VPS anonymously with BTC and configure it with all the things you need for mail and run a hidden service yourself.

As long as the volume(s) it was running off are completely encrypted it could be a decent-ish solution.

I have no idea what you just said my friend.

That rules that out then.

Replacing a service for sending mail anonymously is simple.  Mixmaster is fine for that.  The problem is getting a suitably easy to use anonymous email address to receive mail at.  This is where Tor Mail has a real advantage, even if it is a honeypot.

There are alternatives, of course, but they're not all as easy to use as Tor Mail, which is just an ordinary mail service with access to retrieving it restricted to Tor.

With any luck Guru will chime in soon with a decent explanation of various nym server solutions and AAM solutions.  Both of which require GPG for all communication.

Is Hushmail (after you register an account through Tor) a viable alternative to Tormail?

Hushmail is bent.
Title: Re: Missing emails with Tormail? Anyone else?
Post by: Travis Bickle on August 05, 2012, 05:17 am
I was getting the SMTP 421 error myself last night on tormail...emails weren't sent or received. Working fine right now, but unfortunately I fear that I've lost some bitcoins in the process. I used bitinstant through email (e.g. coinapult), received the email from coinapult late last night, but when I clicked the link the page showed up as holding 0 bitcoins, even though the email noted that the link contained my bitcoins? What happened and is there any remedy to this?
Well, I'm sorry to hear that you lost your bitcoins but the same thing happened to me once before. I had deposited cash to Bitinstant (through TrustCash) for bitcoins. But later the Coinapult link that I received in my Tormail account for this transaction showed that all my bitcoins had been WITHDRAWN! From then on I've always used a NEW Tormail account and a NEW PIN for each fresh transaction with Bitinstant for bitcoins. I don't know where the fault lies -- i.e. who is actually STEALING the bitcoins. Is it someone at Bitinstant, someone at Coinapult, or someone at the allegedly "compromised" Tormail email service?
Title: Re: Missing emails with Tormail? Anyone else?
Post by: Limetless on August 05, 2012, 06:24 am
A vendor I talk to a lot on here thinks Tormail has been compromised, seriously considering abandoning it.

I'd be interested in hearing what they have to say.  It is possible to set things up such that everything that is sent to your tormail account is both encrypted and anonymized, so even if the site were compromised, they would learn nothing. Here is a sample of what someone would see if they attempted to look at my email inbox:

Sender                    Date/Time:              Subject:
 
Nomen Nescio    May 10, 2012         8040c5507ec248bc5947f056caed9612ef0949b3c4eb6868
Anonymous            May 10, 2012         242bfc3f0d314ce84662c0077fe6fc214bad07d01c8fe849
Nomen Nescio    May 10, 2012         23504600380b7c74ba0a218adb2e5d9eec0832c3ab439071
Nomen Nescio    May 10, 2012         95cba20632a519d8c0ab01cb27a005fb2a4c19a8ea428a98
Anonymous            May 10, 2012         20062a0fc766cdf14d7da970e8f95fcf785aee14f9d15afc
Nomen Nescio    May 10, 2012         5a96ff378c13a968c62c44afd96e0e8d1a0cbac06e337907
Anonymous            May 10, 2012         34c5ea1d394d91a4e87fdb8b5ed707d4c98be8d829e53a4f

They're not going to learn one helluva lot from that, are they?

Guru

Clearly that translates to an invite to an orgy Guru..... :P
Title: Re: Missing emails with Tormail? Anyone else?
Post by: Limetless on August 05, 2012, 08:05 am
I might have to take you up on that actually, I'll message ya later on today. On a come down at this current time lol.
Title: Re: Missing emails with Tormail? Anyone else?
Post by: random0 on August 05, 2012, 08:33 pm
A vendor I talk to a lot on here thinks Tormail has been compromised, seriously considering abandoning it.

Jacob Appelbaum has tweeted to the effect that he thinks it's a honeypot or could easily be one.  As long as everything sent through it is encrypted it can still be used, but it has to be everything.

https://twitter.com/payloadDLL/status/224551392881295361
Quote
@ioerror It's a honeypot run by two U.S. nationals probably based in France/Germany. In short, don't refer anyone to use it.

I think this recent glitch might have been intentional on Tormail, because nobody was able to access Tormail with the non-js squirrelmail, but the javascript enabled roundcube client was still working to some extent. This could force some people to use the javascript instead of their usual non-js, so Tormail could use a malicious script to get their IPs.
This is just my fantasy of course.

On the other hand I received 2 mails recently after a couple of days I sent them, and these have interesting headers although I don't know if they mean anything.

1.
    Domain nodomain.com has exceeded the max emails per hour (363/300 (121%))
allowed.  Message will be reattempted later
------- This is a copy of the message, including all the headers. ------
Received: from tor19.anonymizer.ccc.de ([31.172.30.2]:49970 helo=internal.tormail.org)
        by server4.allsitecontrol.com with esmtpsa (TLSv1:RC4-SHA:128)

2.
    Domain nodomain.com has exceeded the max emails per hour (375/300 (125%))
allowed.  Message discarded.
------ This is a copy of the message, including all the headers. ------
Received: from [62.140.252.8] (port=61089 helo=internal.tormail.org)
        by server4.allsitecontrol.com with esmtpsa (TLSv1:RC4-SHA:128)

I noticed the ccc.de server. Is that just a Tor node that Tormail used, or Tormail and ccc.de might be releated in some way?
Title: Re: Missing emails with Tormail? Anyone else?
Post by: LouisCyphre on August 05, 2012, 09:14 pm
Damn, this all makes me want to steer clear of Tormail now... What about keys for PGP? When you list the email in GPA when you generate your keys, could that mean the keys are compromised if Tormail is too? I doubt it, but I'd rather not be using a set of compromised keys.

No, having a Tor Mail address in the user ID has no bearing on the security of your keys.
Title: Re: Missing emails with Tormail? Anyone else?
Post by: LouisCyphre on August 05, 2012, 09:16 pm
Is Hushmail (after you register an account through Tor) a viable alternative to Tormail?

No, it's worse.  Hushmail is known to work with law enforcement to compromise the keys it stores for its users.
Title: Re: Missing emails with Tormail? Anyone else?
Post by: random0 on August 05, 2012, 09:44 pm
Thanks for clearing that up Guru, I didn't really know how Twitter works.

On the other hand, just because Tormail tells customers to use PGP if they want better privacy, they can still be a honeypot. It just makes them to be seen more legit.

But since non of the email providers are safe, and anyone of them can be or become a honeypot my question was rather pointless.

Anyway my main question was supposed to be:
     
            Anyone ever experienced missing sent or incoming mails in the past? Not just now when Tormail has/had obviously some problems.
Title: Re: Missing emails with Tormail? Anyone else?
Post by: pine on August 05, 2012, 10:16 pm
IMO, there are a couple of possible reasons for Tormail's existence.

1. Civic minded civilians. Yes, this is possible.
2. An intelligence agency is doing something like the following:

2.1 By analyzing the network topography of emails sent they can work out the relative importance of the users.

For example, responses from a boss to most underlings are likely to be relatively brief, whereas a report from an underling could be pages. Even with padding, this could be obvious with a large enough sample. Of course it would be far more sophisticated than what I'm describing, this is just an idea. Basically the users sort themselves in a kind of pattern which can be interpreted.

2.2 Then, once a target is selected, the agency brings the full power of a distributed network to brute force to obtain the target's private key. From then on, it is easy to exploit downstream.

So, any plaintext intercepted from the naive is really just icing on the top.

3. It is run by the equivalent of long con selective scammers hunting for interesting titbits for blackmail etc, esp. since almost certainly some pedophiles use the service. Given that I believe the RBN corporation controls this service, this would tally up. The US nationals might be in Germany, but I think the servers are in Russia.

--

Whether the reality, diversification is required. If SR is to come under attack then Tormail could also be a target. However, I think that will mean the FBI will have overstepped the mark into a hornets nest given who I believe runs Tormail and also the composition of Tormail end users. Unless 2.0 is true, in which case they could be negotiating some selective attack by removing SR accounts.

Finally, while there are other services on the darknet that provide channels of communication, it concerns me that if you attacked two hosting services then it could make life somewhat difficult to regroup.

Hence, we require a truly decentralized support mechanism that is easy to use, even if it's a bit slow. Do you have any suggestions? What about the Association of Aquatic Mammals. Can they help us? :)

Title: Re: Missing emails with Tormail? Anyone else?
Post by: randomOVDB#2 on August 06, 2012, 10:21 am
A vendor I talk to a lot on here thinks Tormail has been compromised, seriously considering abandoning it.

Jacob Appelbaum has tweeted to the effect that he thinks it's a honeypot or could easily be one.  As long as everything sent through it is encrypted it can still be used, but it has to be everything.

https://twitter.com/payloadDLL/status/224551392881295361
Quote
@ioerror It's a honeypot run by two U.S. nationals probably based in France/Germany. In short, don't refer anyone to use it.

I think this recent glitch might have been intentional on Tormail, because nobody was able to access Tormail with the non-js squirrelmail, but the javascript enabled roundcube client was still working to some extent. This could force some people to use the javascript instead of their usual non-js, so Tormail could use a malicious script to get their IPs.
This is just my fantasy of course.

On the other hand I received 2 mails recently after a couple of days I sent them, and these have interesting headers although I don't know if they mean anything.

1.
    Domain nodomain.com has exceeded the max emails per hour (363/300 (121%))
allowed.  Message will be reattempted later
------- This is a copy of the message, including all the headers. ------
Received: from tor19.anonymizer.ccc.de ([31.172.30.2]:49970 helo=internal.tormail.org)
        by server4.allsitecontrol.com with esmtpsa (TLSv1:RC4-SHA:128)

2.
    Domain nodomain.com has exceeded the max emails per hour (375/300 (125%))
allowed.  Message discarded.
------ This is a copy of the message, including all the headers. ------
Received: from [62.140.252.8] (port=61089 helo=internal.tormail.org)
        by server4.allsitecontrol.com with esmtpsa (TLSv1:RC4-SHA:128)

I noticed the ccc.de server. Is that just a Tor node that Tormail used, or Tormail and ccc.de might be releated in some way?

One of Computer Chess Club's nodes.

What I'm interested in, is the lack of Tor based email providers. We have nodes, we have websites but no email. Is setting up an email server really that different or that more difficult than setting up an on Tor website ? CCC, Tor Project, EFF... All credible and possible providers.

To all people migrating from Tormail because of "something". Isnt't spreading FUD a known tactic of the enemy  :-X
Title: Re: Missing emails with Tormail? Anyone else?
Post by: pine on August 06, 2012, 11:43 am
One of Computer Chess Club's nodes.

What I'm interested in, is the lack of Tor based email providers. We have nodes, we have websites but no email. Is setting up an email server really that different or that more difficult than setting up an on Tor website ? CCC, Tor Project, EFF... All credible and possible providers.

To all people migrating from Tormail because of "something". Isnt't spreading FUD a known tactic of the enemy  :-X

Computer Chess Club? I think you were a bit tired when you wrote that, got to admit I read it the way you wrote it the first time :)

Yeah, it is interesting that there is a lack of Tor based email providers for sure. I think that's partly a result of jurisdictional issues e.g. having the physical servers someplace where the government isn't necessarily going to kowtow to the U.S government or other ones. e.g. Russia, China (the irony).

I think the practical issue is, like another person said, that while you might have a hidden service, you still need some nodes outside the Tor network, otherwise you're stuck with just an internal email system for Tor like TorPM. So, that node(s) is going to be seize-able as a result, hence the jurisdictional challenges. There ought to be some elegant privacy enhancing method (Guru was talking about a.a.m, but I don't know enough about it). There is probably already a solution in some crypto academic journal some place, but maybe it's not so well known.

Yup, this could all be FUD, but then again Applebaum has been dogged by the FBI for long enough to obtain the correct type of intuitive paranoia. Besides like I said already, there's the more fundamental question of diversification. There ought to be a kaleidoscope of publicly available Tor based email services, I mean it's 2012, not 1995.



Title: Re: Missing emails with Tormail? Anyone else?
Post by: randomOVDB#2 on August 06, 2012, 12:29 pm
One of Computer Chess Club's nodes.

What I'm interested in, is the lack of Tor based email providers. We have nodes, we have websites but no email. Is setting up an email server really that different or that more difficult than setting up an on Tor website ? CCC, Tor Project, EFF... All credible and possible providers.

To all people migrating from Tormail because of "something". Isnt't spreading FUD a known tactic of the enemy  :-X
Computer Chess Club? I think you were a bit tired when you wrote that, got to admit I read it the way you wrote it the first time :)

Chaos Computer Club. 4 AM post while playing chess :o
Title: Re: Missing emails with Tormail? Anyone else?
Post by: pine on August 07, 2012, 08:01 pm
God I'm such a retard, I already know the solution, I just forgot about what it meant. Ugh explain later. :-/

Edit: good thing too, or we'd be needing help from the otter people
Title: Re: Missing emails with Tormail? Anyone else?
Post by: pine on August 07, 2012, 10:42 pm
God I'm such a retard, I already know the solution, I just forgot about what it meant. Ugh explain later. :-/

Edit: good thing too, or we'd be needing help from the otter people

I'm on a first-name basis with the Otter people, have been for years now.   Speaking of which, I hve a requst to make. See below.

-----BEGIN PGP MESSAGE-----


-----BEGIN PGP MESSAGE-----
Version: GnuPG v2.0.17 (MingW32)

hQIMA/+VT6MEj7MNARAAmDZ4ltp6bw+e9cUhkWhX7OC3naXj2gdkJz9Q54LjJRtr
ftBsSetzA2Xh6S+3MIIPMozsorY4E4RtG8VmSH8pDvMcZLELX3H74j/cMt9KLPq0
/LaU9HFo/av9wDxrf2oBT71I7vuFdhFfxALQVZ7Qd15Ga7OgdLmcT1XaPIDW0Jcg
wdBCE9Cgds7C+tEBMiKxR4xmaNcD/qSudQDouGDZPTD8Okay3rKPFmvoQvsO3Uz4
iWhpS30KE5B9sEwLrQDOQOANKbviD2v/8I0vljUwYQooRt6lGomOayQFTD9h673t
K9zyelurgz4TuTyGUHNYDYTgnOeVUYEm/2ff3AWwQKBDc5BzS9WxIfJtzsmBvgsu
nF2/P1OYmO/2HPB87TtMTGeSxGD9XX/op9GMTbxmVUyRTJ//POVMskeC1BiJVGGb
C8o1gTnzuIr9OI0pm4IdAdDrCxkDx/otCbZ1dggIVd6LlxTd7IXLUPSm0Avc1Dyn
iigS5WQSjK5wcjtEJSj64R151/QMFDD2eKBN8fRiuIdYDf9j23c48GPImxUc+cPq
7s3EcAk7ntvmdTvWOtCa0XusyiX6xse83I03vDkmlv+NtRkpsi0JIgJJ2BkNrdwq
MN+xEwZvMQ6H+9OiJ2stpJLFPH9rj6iHOI78lqC5o8w2CVk3Ls4f1LGnhF/u+s3S
6QFqMO7ZOfLHUvcCc9AUpL2EfG5TOafmgzjy3nWayK3Q3RoA3mfORcj2Yn1Rqcfy
dvvPmC1rzWV9toonN/fjShgNZaF4hRGLo4gD/LEgA536Czfwf9+Z3KAO2anQ8wmS
/zk7ZgsQmrxsMN3uogvHLckRp2yKJX982xH3ybSbR5bWG3+IKCEdfWwDRDNFOaV9
QKyYNS5D4u4l7/HPZiyP/o+Xezd39AtPaIwMwm59D5krJD8xq1h+z1tB//T9P69C
H4la/PdSMB9F3WHCC8j0eVYXl423cfIfRzr/ShKqSq/qx3umTsJGtqQuxORqS9iV
ech+1CFZqpW5323FGIOj4RKPkj1omDNyS1Ziube7b4xH7EfhwG3E+7eQgwSMuHso
1V/Nprn/8pm5L8onJIcyM5MogtPHslTXQJMBjqDvGwsq76xK2+wVnxaBUFA0s31D
FhdVpHWXHdikFi/9sitbcQySYSWTDiTeKJ5vxmPsTtoeDbuk8DNXrowjJwrHnn5m
SnJdyukpDabF+eNg3BN3iFxleM+TgsEvRD54D3D4QPHALwbWUQFG8lYp5VJKd1u8
C+IuOPCEhDxBsG6NzWojSnFJk69XPRt6ovpHLch13mznABzQZZ/BkNMVHzzXQZP7
iILw8Qougxyi5nIVC2QLyRx/iswRD+RVkK7o3J80m41qwLoL18Tafw0YLDsJpMoy
nJH7vT6JoY2r8jn4L88jFZUA9/gEayNcn3Nrt9u53+RKKDIU33SqTgjAxiEAaPP6
kS60VGmdiOG/d9jrtRKziRzH1q2Y8UvoyKVjPSvnfcn2FcxnEBYxkACEt9lvXMHn
Nspdq60eDiQxTHp+DwxE1AMN4mKUMLXgeWuVvOOlBTDjvvyWo/awQG+hJ12k1iYL
FsDRSUA2NZ1WB1mGzWxME1yit26FZnzegb3z8tbCXpM4LYdfXevcv4RyxAF5m6fS
i4iwb/P+Srs+d79zTO6GRA1cfOA8herBXERCeIi2dTrjeHQcg7/WmyoErfysIE2a
C2AIymKch7XP70YwirVdn0/oH+ZRsc9Iu7BfsjKiclgj29eWz5vfIFduCsekbWD6
4B1vX4hfXVWRcHjVYTH7XEh2QaWpKpV9+78YSDqC5EQ5zdTj/HlBBvARrdKP5CTF
vAjFEO7MWrRkjN5Q4jVY5opk2M4Rih/Qvpc5yKg=
=2bCC
-----END PGP MESSAGE-----