I am very new to all this (meaning strong privacy and anonymity, tails, tor, etc.)
I hope I am not intruding, or posting inappropriately. First let me say that I am NOT repeat NOT wanting to do anything illegal, harmful, or even unethical. I just want privacy. I have my reasons, and I’ll leave it at that.
What I want is a truly isolated email account for which I do not have to provide ANY personally identifiable information that gets back to my real identity. Proton wants a real permanent “backup” email. Tutanota seems to be hostile to tor.
My Requirements:
– Hosted in a country with strict privacy laws and not one of the five eyes
– Tor-friendly, even better if they have a .onion service
– Only want to supply them with a userid and strong password. That’s it. No backup emails, no phone 2FA, none of that.
– A paid service is fine as long as I can use BTC, or even better XMR(monero)
– I am even willing to pay to set up my own domain, provided I can do it with the same isolation requirements as above)
Futher I’d like to know if anyone can recommend other forum sites where issues like mine (strong, isolated anonymity and privacy) are discussed.
Tutanota accepts Tor Browser users creating email accounts with their service for free as in gratis: see this blog article for further details.
I have a shortlist of webmail providers that do not have secondary requirements and are free as in gratis, but they may or may not be hosted in the Five Eyes; I do not consider it in my threat model. Other than Tutanota, I have not tested the others for Tor-friendliness.
My specific testing criteria was: English; free tier without third-party invitation requirements and/or a trial period; no advertisements; no email address and/or phone number requirements for signup and/or service usage.
Note that unlike your requirements, my focus was on free as in gratis, because I believe secure and private email should be available to everyone first; using them anonymously is an entirely separate issue that is very difficult to practically address.
Other than the Tor Project, I know and am personally involved in a few more related forums to varying degrees:
I hope I am not intruding, or posting inappropriately.
I think you are quite off-topic here, the General Discussion category is still dedicated to “Anything related to Tor ecosystem which does not fit into the Support or Feedback category” (italics is mine).
Anyway…
What I want is a truly isolated email account for which I do not have to provide ANY personally identifiable information that gets back to my real identity
My Requirements:
I use Disroot. It’s from Netherlands (I don’t know about Dutch privacy law, but it’s not in the Five Eyes); has an onion service; supports backup email and TOTP 2FA but they are not mandatory; is free to use but accepts donations including BTC and XMR.
Disclaimer: I never used anything I’m going to write about below.
I also read intereseting stuff about Posteo but I never cared to study it in detail. It’s pay-only but accepts cash and doesn’t link the payment to the account.
– I am even willing to pay to set up my own domain, provided I can do it with the same isolation requirements as above)
Every domain name is linked to the real identity of the owner (it can be either published through WHOIS or not, but the register and registrar know it). The only way to buy a domain anonymously I am ware of is through Njalla, that registers it to itself and then lets you use it, but it feels quite shady to me. However, if you are to trust it you may purchase a domain name and a VPS and set up your own mail server, e.g. as described here.
The last time I was testing their registration services, they also do not permit account creation during the weekends. I forgot their reasoning and exact quote for it, but perhaps that situation has changed since.
Yes, that is indeed one of the anonymous domain registrars. The other one I also know about is IncogNET, as I was made aware of them by their Tor reduced exit policy.
You can try danwin1210.de. It has onion and clearnet domains, supports mail clients and does not need any personal info from you - only login and password. But this is a volunteer project.
This is only for the one-time email for verification. He can later use his strong password on Disroot.
By the way, using only passwords is outdated. I use 2FA almost everywhere. All my weblogins, SSH keys, mail accounts, etc. require 2FA with OnlyKey or NitroKey.
I think Disroot is a good option. It’s free, they’re based in Amsterdam, and it doesn’t collect your data. Personally, I use it. Riseup and Systemli are good options but they’re invite only, which makes it difficult to get an email address from them.
To sign up for forums. including this forum, requires an email address. Unfortunately, it seems very difficult to get an anonymous email address. If I try to sign up for an email address, it asks me to verify using either my phone number (not private) or ANOTHER email address (which pushes the problem back a step). If someone wants to contribute anonymously to forums over tor, including this forum, how can they get an anonymous email address for signup purposes?
There is another issue. Suppose we do have another email which we can safely use for verification. If I want to make a protonmail account on their onion over tor, very often nowadays they will not even give me the option to use a verification method. They will say “no verification method available.” Given this, what is a good, zero-access encryption privacy email that DOES allow me to verify with another email address (an email address that might not have zero-access encryption)?
Since my first contribution at the beginning of this thread, MsgSafe.io is undergoing a transitional acquisition, and Skiff is shutting down, so that leaves Autistici/Inventati as the only other remaining webmail provider fitting the OP’s criteria.
Otherwise, you can try your luck with ephemeral email addresses, but they tend to be placed on third-party blacklists. For example, AdGuard provides such a service:
Sadly Daniel’s had to close danwin1210.de to new email subscribers due to persistent spam abuse of the service. However, danwin1210.de remains available to those who had a subscription prior to the service closing to new subscribers which happened approximately since the start of 2024.