<div>Hello Arrakis</div>
<div> </div>
<div>thanks for this idea and software. Many replies already in the archive of or-talk.</div>
<div>Some suggestions.</div>
<div> </div>
<div>I would devide the license question</div>
<div>a) we need an open source GPL email client, which sends only PGP encrypted email</div>
<div>b) we need an underlaying mix network with outproxies, which is could be another license maybe. </div>
<div>(as the mail is encrypted, then no matter which outproxy is used, if open soruce trasnport or not).</div>
<div>The mixing network is hiding the original IP adress. Tor or mixmaster or i2p with recoded outproxies for one port for mail.</div>
<div> </div>
<div>There are 3 similar projects, which should be considered:</div>
<div> </div>
<div>NUNTIUS LEO EMAIL</div>
<div><a href="http://nlcreator.sf.net">http://nlcreator.sf.net</a> </div>
<div>is developing a Qt Email client, which is sending PGP encrypted emails.</div>
<div> </div>
<div>RetroShare Email Client</div>
<div><a href="http://retroshare.sf.net">http://retroshare.sf.net</a></div>
<div>QT as well and has PGP Key pair encrpyted Messaging, instant and offlline.</div>
<div>The offline mail is queued until both clients are online for a handshake. So currently @-mail is not possible, as it is serverless.</div>
<div> </div>
<div>-> Merge: As retroshare uses XPGP key currently, and a change is soon done to PGP keys, it is a good idea to add Nuntius Leo Email client as well to RetroShare Gui as integration or as a plugin.</div>
<div> </div>
<div>So the basic concept is, to have an adressbook, which pre-defines your Friends or Mailadresses.</div>
<div>In one Email client, which is based on PGP Keys, you need to swap with your mail-partner the key.</div>
<div>That is no lack, as you can send your PGP key as well over one first unencrypted email (into one special folder for approval it arrives).</div>
<div>But I think it is better encryption is you have no end to end encryption but swapping keys.</div>
<div>Mailinglists then need to be redefined, as you need from each participant the key, tha could be done as well over one first approval/joining email, which all participants sign.</div>
<div> </div>
<div>Third there is SIMPLE-MAIL as a Firefox addon</div>
<div><a href="https://addons.mozilla.org/en-US/firefox/addon/5593">https://addons.mozilla.org/en-US/firefox/addon/5593</a></div>
<div>Telega is the author and is currently coding a XUL gui for retroshare instant messenger, you find it here:</div>
<div><a href="http://retromessenger.sf.net">http://retromessenger.sf.net</a></div>
<div>This library is currently not open source, but the auther may think about that.</div>
<div>XUL allows as well a standalone application.</div>
<div> </div>
<div>The idea, to join as well in XUL a mail client with PGP keys and the libretroshare Instant Messenger is already placed.</div>
<div> </div>
<div>You see, 2 Projects, on its way bringing online and offline communication together, both based on PGP keys.</div>
<div> </div>
<div>That is why you should be compatible to PGP key exchange. Does FirePGP provide this?</div>
<div>Please answer, if you are interested in one or the other project to join the acting persons and projects.</div>
<div> </div>
<div> </div>
<div>If one of that projects has been done, it allows, to send PGP email out of the box and maybe as well there is a RELEASE email client, which allows ONLY to send PGP emails (excapt the one incoming folder for approval mails with the PGP key of users, which want to connect to you).</div>
<div> </div>
<div> </div>
<div>If THAT is done, then the project needs an underlaying network to maybe spoof the IP adress by a mixing cascade.</div>
<div>It would be good, to have that seperated, so that as well other applications use that mix network,</div>
<div>So that is tor or i2p.</div>
<div>Mixmaster dunno who set those nodes up?<br> </div>
<div>Do you really think, mixmaster has enough nodes? Do you really think that a tif-for-tat model is good, so that each one running the PGP-Email-Client should be as well at the same time an Outproxy for other mails? No..</div>
<div> </div>
<div>And: Regarding webmail: I want an email client, With Tor it is already possible to surf to webmail accounts.</div>
<div>What we need is an email client, so either simple mail, which needs a join and an adresses idea to be made open source, or either Nuntius Leo email client.</div>
<div> </div>
<div>Do you really want to make a new proxy network only for email-mixture?</div>
<div>More important is to have an GPL open source email client, which is sending by default only PGP-key-Encrypted emails to pre-defined recievers. The mailinglist problem and approval problems are just a question of precesses and approval culture.</div>
<div> </div>
<div>Then the underlaying network: </div>
<div>Tor is a good idea, if there are enough outproxies.</div>
<div>Otherwise i2p could get an addon in java, to have mail-outproxies only.</div>
<div>third model would be a mixmaster code integrated into the email client, so that each one is an outproxy, but then please consider, that it needs to be PGP encrypted email, so that sending only to-pre-defined recievers is possible, otherwise the outproxies would not be established, and on the other hand: All mails MUST be PGP key encrypted, so that the Outproxies cannot read them,</div>
<div> </div>
<div>So ideally a good way is to start with retroshare/retromessenger over Tor, to have this online communication established, later then the Nuntuis leo or Simplemail client is ready to be added for <a href="mailto:serverbased-@-mail">serverbased-@-mail</a>.</div>
<div> </div>
<div>RetroShare itself has played around with i2p, as it solves some internal connection problems, but that was one year ago and now they are solved over STUN. So choose Tor or Mixmaster, to Spoof the IP adress for offline and online messages.</div>
<div> </div>
<div>Thanks for a feedback, how you go on</div>
<div> </div>
<div>Regards Max<br><br> </div>
<div><span class="gmail_quote">On 8/20/08, <b class="gmail_sendername">Arrakis</b> <<a href="mailto:arrakistor@gmail.com">arrakistor@gmail.com</a>> wrote:</span>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">I am writing an anonymous email client. The main<br>delay has been getting it compatible with the xerobank<br>
installer so that it automatically downloads mail<br>credentials and creates the secmod/key3/cert8 PKCS11<br>databases and performs automatic encryption of the<br>user credentials, locking it with the users' PIN code<br>
as the master password.<br><br>The design idea is to use an anonymous email server<br>/ service, or to take any freemail provider and turn<br>it into an anonymous account (assuming a clean acct).<br><br>So I decided while I picked up a cold at defcon that<br>
I would sit down and finally finish it. It works.<br><br>It is built using Mozilla Thunderbird. It will contain<br>the Enigmail extension, and a self-contained GPG<br>distribution. It will probably also contain NoScript<br>
because it has an html renderer inside it. The program<br>already has a built-in auto-updater from xerobank that<br>will download and install it's own PGP signed updates.<br>The enigmail will be configured to use 5+ keyservers<br>
such as mit, sks, pgp, etc.<br><br>The threat model includes content and context obscurity.<br><br>Where this meets Tor and anonymity is the question. It<br>is my intention to filter by protocol, blocking all<br>communication that is not using either SSL or TLS. Are<br>
there any other considerations we should have, other<br>than blocking updates? Should we force OCSP and cert<br>revokation checking? Is there any reason we shouldn't<br>include the CACert root certificate? Should we scrap<br>
Tor and make it use mixmaster? Should we force users<br>to create/import PGP Keypairs?<br><br>The more I understand email threats/issues over Tor<br>the better. I am aware that there are only occasionally<br>any exit servers allowing port 25, but if we are<br>
forcing SSL/TLS, then it won't matter what port they<br>pick. So any preferences for extensions and behavior are<br>welcome.<br><br>Suggestions will be used to craft an opensource software<br>released under TESLA license which prevents malware /<br>
spyware additions, and unauthorized modification for<br>the purpose of commercial profit.<br><br>This program will be completed today, and ready for<br>testing tomorrow, so the sooner I get comments the<br>better.<br><br>
Arrakis<br></blockquote></div><br>