[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-talk] SMTP & POP3 Email over Tor.. Anonymity breaking?
tor@xxxxxxxxxxxxxxxxxx wrote:
On 02/06/2011 11:59, Anon Mus wrote:
Is it true that email SMTP & POP3 hosts (e.g. gmail's servers) can
obtain from SMTP & POP3 clients (e.g. Thunderbird) data such as,
1. client time zone
2. client machine clock time
3. client machine time since last boot
even though its over Tor?
I have a pretty decent knowledge of the SMTP, POP3 and IMAP4 protocols,
and I'm not aware of any part of the protocol which transmits this
information.
I was just looking at the header received by another Tor list subscriber
and there is definitely some data above leaked in the manner I mentioned.
Extract of header via Tor list from my email starting this thread...
Date: Thu, 02 Jun 2011 11:59:38 +0100
From: Anon Mus <my.green.lantern@xxxxxxxxxxxxxx>
User-Agent: Thunderbird 2.0.0.24 (Windows/20100228)
MIME-Version: 1.0
So there is my machines timezone (+0100) for starters...
and then there is my machines clock time (Thu, 02 Jun 2011 11:59:38) as
well (its my clock time not google's), I don't know if more accurate
values (down to milliseconds say) are shared to the mail server.
You should all be able to see that in your own headers.
Again, you could fingerprint my mail by client (User-Agent: Thunderbird
2.0.0.24 (Windows/20100228))
I am sure I read somewhere (eons ago) that the "3. client machine time
since last boot" could also be seen by the mail servers (or was that
just javascript??).
If so, can't these be used to trace a client machine which might also be
accessing other, say gmail, accounts via the open internet (not via Tor)
? (I know it sounds paranoid, but surely it is theoretically possible)
SMTP *might* leak your machine name or hostname or LAN IP address when
transmitting the EHLO. When you send an email, it's going to include
your local system time and local time zone in the Date header. It may
also include information about your email client and/or OS in some
header like X-Mailer or User-Agent.
In this case the sending machine is the exit node, but I suppose some
email clients might leak that, mine appears to leak (0.0.0.0).
I reckon IMAP4 and POP3 are relatively safe protocols. I don't think
they leak any useful information. It may be possible to fingerprint what
actual IMAP client you're using by analysing the protocol, such as how
many connections are open, command execution order, the format of tag
names, IMAP extension usage, how the client responds to certain types of
protocol errors, etc.
And ... is there ANY software/email clients out there that can
counteract/obfuscate this kind of tracing, say by changing the
parameters returned? (Preferably Windows OS but others will do if available)
Not sure. If I wanted to access my email over Tor, but using a proper
client rather than webmail, I'd probably set up fetchmail to fetch the
email using SSL secured POP3 over Tor, and drop it in a local Maildir,
and point Thunderbird at that. For SMTP, I'd stick Exim inbetween
Thunderbird and Tor, and configure it to remove/sanitise headers and to
use a custom HELO.
An advantage of using fetchmail to retrieve the mail, is that mail
retrieval would be done on a regular interval, rather than just when
you're actually reading it. You might not want an attacker to be able to
determine the times that you're online checking your email.
One thing to note. For SMTP submission over Tor. If you can use port
465+SSL rather than TLS on ports 587 or 25, then do that. If you're
using TLS rather than SSL, even though the majority of your connection
is encrypted, the welcome banner and your initial EHLO are transmitted
in the clear. smtp.gmail.com has both options.
------------------------------------------------------------------------
_______________________________________________
tor-talk mailing list
tor-talk@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Does anyone else have anything to offer?
Does anyone know if there is a mail client source code out there that I
could modify to create a client that would send settable/random values?
Thanks,
Jo
_______________________________________________
tor-talk mailing list
tor-talk@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk