[tor-talk] SMTP & POP3 Email over Tor.. Anonymity breaking?

[Anon Mus]

tor at lists.grepular.com wrote:
> On 02/06/2011 11:59, Anon Mus wrote:
>
>   
>> Is it true that email SMTP & POP3 hosts (e.g. gmail's servers) can 
>> obtain from SMTP & POP3 clients (e.g. Thunderbird) data such as,
>>
>> 1. client time zone
>> 2. client machine clock time
>> 3. client machine time since last boot
>>
>> even though its over Tor?
>>     
>
> I have a pretty decent knowledge of the SMTP, POP3 and IMAP4 protocols,
> and I'm not aware of any part of the protocol which transmits this
> information.
>
>   
I was just looking at the header received by another Tor list subscriber 
and there is definitely some data above leaked in the manner I mentioned.

Extract of header via Tor list from my email starting this thread...

Date: Thu, 02 Jun 2011 11:59:38 +0100
From: Anon Mus <my.green.lantern at googlemail.com>
User-Agent: Thunderbird 2.0.0.24 (Windows/20100228)
MIME-Version: 1.0

So there is my machines timezone (+0100) for starters...

and then there is my machines clock time (Thu, 02 Jun 2011 11:59:38) as 
well (its my clock time not google's), I don't know if more accurate 
values (down to milliseconds say) are shared to the mail server.

You should all be able to see that in your own headers.

Again, you could fingerprint my mail by client (User-Agent: Thunderbird 
2.0.0.24 (Windows/20100228))

I am sure I read somewhere (eons ago) that the "3. client machine time 
since last boot" could also be seen by the mail servers (or was that 
just javascript??).
>> If so, can't these be used to trace a client machine which might also be 
>> accessing other, say gmail, accounts via the open internet (not via Tor) 
>> ? (I know it sounds paranoid, but surely it is theoretically possible)
>>     
>
> SMTP *might* leak your machine name or hostname or LAN IP address when
> transmitting the EHLO. When you send an email, it's going to include
> your local system time and local time zone in the Date header. It may
> also include information about your email client and/or OS in some
> header like X-Mailer or User-Agent.
>
>   

In this case the sending machine is the exit node, but I suppose some 
email clients might leak that, mine appears to leak (0.0.0.0).

> I reckon IMAP4 and POP3 are relatively safe protocols. I don't think
> they leak any useful information. It may be possible to fingerprint what
> actual IMAP client you're using by analysing the protocol, such as how
> many connections are open, command execution order, the format of tag
> names, IMAP extension usage, how the client responds to certain types of
> protocol errors, etc.
>
>   
>> And ... is there ANY software/email clients out there that can 
>> counteract/obfuscate this kind of tracing, say by changing the 
>> parameters returned? (Preferably Windows OS but others will do if available)
>>     
>
> Not sure. If I wanted to access my email over Tor, but using a proper
> client rather than webmail, I'd probably set up fetchmail to fetch the
> email using SSL secured POP3 over Tor, and drop it in a local Maildir,
> and point Thunderbird at that. For SMTP, I'd stick Exim inbetween
> Thunderbird and Tor, and configure it to remove/sanitise headers and to
> use a custom HELO.
>
> An advantage of using fetchmail to retrieve the mail, is that mail
> retrieval would be done on a regular interval, rather than just when
> you're actually reading it. You might not want an attacker to be able to
> determine the times that you're online checking your email.
>
> One thing to note. For SMTP submission over Tor. If you can use port
> 465+SSL rather than TLS on ports 587 or 25, then do that. If you're
> using TLS rather than SSL, even though the majority of your connection
> is encrypted, the welcome banner and your initial EHLO are transmitted
> in the clear. smtp.gmail.com has both options.
>
>   
> ------------------------------------------------------------------------
>
> _______________________________________________
> tor-talk mailing list
> tor-talk at lists.torproject.org
> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
>   
Does anyone else have anything to offer?

Does anyone know if there is a mail client source code out there that I 
could modify to create a client that would send settable/random values?

Thanks,

Jo