I am very new to all this (meaning strong privacy and anonymity, tails, tor, etc.)
I hope I am not intruding, or posting inappropriately. First let me say that I am NOT repeat NOT wanting to do anything illegal, harmful, or even unethical. I just want privacy. I have my reasons, and I’ll leave it at that.
What I want is a truly isolated email account for which I do not have to provide ANY personally identifiable information that gets back to my real identity. Proton wants a real permanent “backup” email. Tutanota seems to be hostile to tor.
My Requirements:
– Hosted in a country with strict privacy laws and not one of the five eyes
– Tor-friendly, even better if they have a .onion service
– Only want to supply them with a userid and strong password. That’s it. No backup emails, no phone 2FA, none of that.
– A paid service is fine as long as I can use BTC, or even better XMR(monero)
– I am even willing to pay to set up my own domain, provided I can do it with the same isolation requirements as above)
Futher I’d like to know if anyone can recommend other forum sites where issues like mine (strong, isolated anonymity and privacy) are discussed.
Tutanota accepts Tor Browser users creating email accounts with their service for free as in gratis: see this blog article for further details.
I have a shortlist of webmail providers that do not have secondary requirements and are free as in gratis, but they may or may not be hosted in the Five Eyes; I do not consider it in my threat model. Other than Tutanota, I have not tested the others for Tor-friendliness.
My specific testing criteria was: English; free tier without third-party invitation requirements and/or a trial period; no advertisements; no email address and/or phone number requirements for signup and/or service usage.
Note that unlike your requirements, my focus was on free as in gratis, because I believe secure and private email should be available to everyone first; using them anonymously is an entirely separate issue that is very difficult to practically address.
Other than the Tor Project, I know and am personally involved in a few more related forums to varying degrees:
I hope I am not intruding, or posting inappropriately.
I think you are quite off-topic here, the General Discussion category is still dedicated to “Anything related to Tor ecosystem which does not fit into the Support or Feedback category” (italics is mine).
Anyway…
What I want is a truly isolated email account for which I do not have to provide ANY personally identifiable information that gets back to my real identity
My Requirements:
I use Disroot. It’s from Netherlands (I don’t know about Dutch privacy law, but it’s not in the Five Eyes); has an onion service; supports backup email and TOTP 2FA but they are not mandatory; is free to use but accepts donations including BTC and XMR.
Disclaimer: I never used anything I’m going to write about below.
I also read intereseting stuff about Posteo but I never cared to study it in detail. It’s pay-only but accepts cash and doesn’t link the payment to the account.
– I am even willing to pay to set up my own domain, provided I can do it with the same isolation requirements as above)
Every domain name is linked to the real identity of the owner (it can be either published through WHOIS or not, but the register and registrar know it). The only way to buy a domain anonymously I am ware of is through Njalla, that registers it to itself and then lets you use it, but it feels quite shady to me. However, if you are to trust it you may purchase a domain name and a VPS and set up your own mail server, e.g. as described here.
The last time I was testing their registration services, they also do not permit account creation during the weekends. I forgot their reasoning and exact quote for it, but perhaps that situation has changed since.
Yes, that is indeed one of the anonymous domain registrars. The other one I also know about is IncogNET, as I was made aware of them by their Tor reduced exit policy.
You can try danwin1210.de. It has onion and clearnet domains, supports mail clients and does not need any personal info from you - only login and password. But this is a volunteer project.
This is only for the one-time email for verification. He can later use his strong password on Disroot.
By the way, using only passwords is outdated. I use 2FA almost everywhere. All my weblogins, SSH keys, mail accounts, etc. require 2FA with OnlyKey or NitroKey.
I think Disroot is a good option. It’s free, they’re based in Amsterdam, and it doesn’t collect your data. Personally, I use it. Riseup and Systemli are good options but they’re invite only, which makes it difficult to get an email address from them.
To sign up for forums. including this forum, requires an email address. Unfortunately, it seems very difficult to get an anonymous email address. If I try to sign up for an email address, it asks me to verify using either my phone number (not private) or ANOTHER email address (which pushes the problem back a step). If someone wants to contribute anonymously to forums over tor, including this forum, how can they get an anonymous email address for signup purposes?
There is another issue. Suppose we do have another email which we can safely use for verification. If I want to make a protonmail account on their onion over tor, very often nowadays they will not even give me the option to use a verification method. They will say “no verification method available.” Given this, what is a good, zero-access encryption privacy email that DOES allow me to verify with another email address (an email address that might not have zero-access encryption)?
Since my first contribution at the beginning of this thread, MsgSafe.io is undergoing a transitional acquisition, and Skiff is shutting down, so that leaves Autistici/Inventati as the only other remaining webmail provider fitting the OP’s criteria.
Otherwise, you can try your luck with ephemeral email addresses, but they tend to be placed on third-party blacklists. For example, AdGuard provides such a service:
Sadly Daniel’s had to close danwin1210.de to new email subscribers due to persistent spam abuse of the service. However, danwin1210.de remains available to those who had a subscription prior to the service closing to new subscribers which happened approximately since the start of 2024.
(Riseup too) I can understand that very well. Most of those who are calling for total anonymity have never offered a service on the Internet themselves and therefore have no idea what the legal and financial consequences are. Every morning the cops can show up at your door to search your house and take away all your computers, cell phones and other IT stuff. Then there’s your wife, the children, the neighbors and maybe your boss, none of whom are amused by these house searches. To them, you’re a criminal because they don’t understand what you’re doing. Currently Indian terrorists have sent bomb threat emails via my IPs. Now I am having fun with the Indian police and gov. Or just a few spam emails can render the email service unusable for everyone!, for weeks or months.
On the other hand, you read that people have problems sending an anonym email to Disroot.
Guys, can you still think? The people behind Disroot are squatters and street fighters who engage in battles with the cops every few weeks! They offer a lot of infrastructure for activists for free. No matter if it’s Disroot, Riseup, Systemli or the dozens of others on the Radical Server list. The people there work their asses off and have half a foot in jail to offer these services to the community.
For this, I have used FlokiNETand I am quite happy with them.
They do not require any personal info to create an account and you can pay with Monero. Their site works over Tor (they have a .onion site) and you can ssh into your VPS over Tor using torsocks. On top of all that, they also have free WHOIS protection for domains hosted with them. They are headquartered in Iceland and have VPSs in Iceland, Romania, and Finland, none of which are part of the Fourteen Eyes. They also have a wide variety of OSs to choose from, including OpenBSD for extra security.
It sounds like I am shilling them, but I am really just trying to share. I spent a lot of time looking for a VPS provider that checked all these boxes and they were the only one I found. I hope this helps!
Yes, Floki is one of the oldest and best known in this business. Especially recommended for journalists and activists who are looking for a professional service.
Other nonKYC services that can be paid with XMR: KYCnot.me Businesses, stores, services where you pay with XMR
1984 is also hosted in Iceland, with Monero as a supported payment method. This combination of information is not provided in either of the above links.
Also, to follow up on Disroot:
Accessing the Disroot link quoted above during the weekends leads to this message:
If you require email registration during the weekends, use a different webmail provider.
@Tangerine,
Unfortunately the The Five Eyes alliance (FVEY) plus “others” is far more extensive than it might appear, at a glance, due to the inclusion of so-called “Third Party Contributors”
"What are third-party contributors?
Aside from the 5-9-14 Eyes country groups, there are other third-party contributors to the UK-USA Agreement alliance. These countries share with and receive intelligence data from the Eyes group, but have fewer rights and responsibilities.
Among the third-party contributors are countries belonging to NATO (Iceland, Greece, Hungary, Romania, the Baltics including Finland [1] and many other European countries), as well as other strategic allies - Israel, Singapore, South Korea, Japan, and more." [2]
[1] Baltic region - Wikipedia
[2] https://cybernews.com/resources/5-eyes-9-eyes-14-eyes-countries/
A presentation series about the FVEY+ streamed in 2019 stated at the time an estimated, approximate 100 countries were linked-in to the FVEY framework. Perhaps it’s likely such a large number of countries might primarily function as third-party contributors, in varying degrees & possibly also depending on the operational requirements of the core FVEY alliance.
Finally as a matter of operational security you still have to trust your VPS host, as so many of us Tor relay operators are obliged to do & that’s not in any way a criticism of FlokiNET or any other VPS provider, it’s simply to state a possible OPSEC consideration. In this context self-hosting a Tor relay might be a viable alternative, in certain instances, when the operator holds control of the server’s physical hardware, perhaps omitting Tor exit relays for a number of feasible reasons, many littering the broader history of the Tor network.
It can sometimes take a few days longer. What do you actually expect?!
These services are offered by people with their money in their spare time. Even at RiseUp and Systemli, someone will answer you until they have time. This is a friendly offer that we can use their services. They get nothing out of us using them, except costs and work.
There are plenty of offers for a quick throwaway email and SMS.
You are welcome to set up an email + Nextcloud service for people with your own money in your spare time and offer a 24/7 service.