Regarding anonymous e-mail accounts:
Many people think that because they've signed up to a web-based mail service that
their identity is protected, this may or may not be the case. As far as the recipient
of the e-mail is concerned, your identity is relatively secure (providing you entered
non-specific information when setting up your account). To a certain extent this is
true. Setting up this type of account will certainly mask any revealing information
that may be contained in the
.
In this way it acts the same way an HTTP proxy server does when you're surfing the net.
Transactions made by you appear to have been made by the proxy device from the receiving end.
This should be sufficient for non-critical messages (i.e. information that would not get you in
trouble if it fell into wrong hands). If you're in China, and you feel like telling the party
exactly what you did with Mao's mother, then web based e-mail won't prevent you from
winding up as an organ donor in some prison camp.
The problems with web based mail:
With the prevalance of spam, many of these free e-mail services use a form of
authentication called ident which provides very basic information about the remote end.
This service is used to confirm that the user or process relaying the mail to it's first
hop isn't trying to fake it's identity, this is to cut down on spam.
To clarify: This process occurs when you are sending mail TO and not FROM your
web-based mailer. I discovered this by accident when one of my server's automated
security countermeasures failed to send me mail about an intruders's system. Looking
at my logs, I discovered that when sendmail tried to send mail to my hotmail address,
an IDENT query was being performed by the hotmail mail server on my machine. Since I
configured my ident daemon to lie when queried, hotmail told me to "stuff it" and
bounced my mail right back at me. I got around this by forwarding my mail to my
Iname address, which doesn't do spam filtering, but forwards directly to my hotmail
account. If the mail server performs this ident query, it is quite reasonable to
assume that they CAN log the IP of the machine performing the mail transfer as well
as the results of the ident lookup. I say again, this is only a problem for people
who want to send TO you web mail account. But, there are very similar mechanisms in
place for HTTP connections so it's a catch-22. If you don't proxy your http connections
you can expect the web based mail service to be aware of your IP and when you sent the mail.
Why anonymous remailers are better:
Anonymous remailers, especially those of the "mixmaster" variety are truly the progeny of a vary
paranoid mind. Anonymous remailers are a series of cascades mail servers which repetitively
strip all the source info from the mail message (preserving the info for the target), adds
bogus information in it's place and routes the message through the mail server chain in a
random order at random intervals before sending to message out to the recipient.
This prevents traffic analysis - all messages are kept for a random amount of time
before being pushed up the chain. It also makes it impossible to track the sender
because all the info that identified him was destroyed on the first hop. It also makes
it impossible to reply, but paranoia has it's price. This was a deliberate design decision
to maximize the anonymity to the sender above all else. Semi-anonymous remailers allow you
to receive the reply, but if someone puts the boots to the service's administrator, you
could be compromised. I invite you to browse through some info regarding
and
.
Regarding anonymous e-mail accounts: