How to send an email anonymously?

Whether you are a whistleblower, journalist, dissident, or simple citizen concerned about preserving the confidentiality and security of your personal data, it is perfectly legitimate to want to ensure your anonymity on the web and the truly private nature of your personal data. online communications. How can you guarantee the confidentiality of your emails and your identity as sender and recipient?

Why does an email compromise your online anonymity?

If, in theory, messages sent by email only concern participants in the same exchange, practice reveals a completely different reality. An email is never truly private and discloses as many identifying elements (last name, first name, email address, IP address of the sender, therefore ISP and geolocation), as confidential information contained in the text (identifiers, passwords stored in plain text, administrative information, centers of interest). Data that can be accessed by overly curious government authorities, intrusive online services or malicious third parties.

Despite their ease of use, secure storage options, and authoritative status conferred by their popularity, services like Gmail, Outlook, and ISP-managed platforms do not grant more privacy and anonymity to their users than other less known messaging services.

For example, Google can read and analyze emails sent and received on Gmail in order to offer personalized advertisements to its Internet users.

Likewise, in France, ISPs are required to keep for between one and five years information relating to the civil identity of the user, information provided by the user himself when subscribing to the contract, data techniques to identify the source of the connection. In the event of an injunction from the Prime Minister, ISPs must also provide rapid access to data relating to electronic communications (Post and Electronic Communications Code).

How to guarantee the confidentiality of your emails?

Taking into account the various observations made above, it is important to take several basic measures to protect the confidentiality of your electronic exchanges, guarantee the security of your personal data and preserve your anonymity, both as sender and recipient.

The first thing to do is to never disclose sensitive information by email, such as passwords or clear identifiers.

It is also imperative to abandon general public messaging services which, although they encrypt your communications in transit, do not hesitate to analyze your correspondence for advertising purposes. Same observation for platforms managed by ISPs, while Internet access providers are legally obliged to keep connection and traffic data, as well as to offer, in certain special cases, direct access to messages on the orders of the competent authorities.

Finally, even if you take steps to make your emails unreadable, it will still be possible to trace your connections to encrypted and secure messaging services using your IP. Hence the importance, in addition to all the precautions taken, of masking your IP address.

So, concretely, how do we do it?

Create a fake email address

Internet users who simply wish to conceal their civil identity can simply create an email address under a false name. Simply create a new account with any consumer email provider and provide false information (last name, first name, possibly address and telephone number). This type of address is sufficient when you wish to open an account on a web platform requiring verification of the address at the time of registration.

Other solutions, such as disposable email addresses, promise better security of private information and respect for anonymity, particularly for companies profiting from the processing and resale of personal data. Various free and/or premium services, such as Guerilla Mail or AnonymouseMail, allow you to send and receive messages from a temporary, randomly generated address, the validity period of which varies from a few minutes to a few days.

If you want to keep track of all communications, aliases are a good alternative to disposable addresses. For example, Firefox Relay offers its users the ability to create secondary email addresses (aliases). All messages received by aliases are automatically transferred to the Internet user’s real email address. In the event of massive spam receipt on one of the aliases, it is possible to delete it and create a new one.

Use an encrypted and truly private email service

The solutions previously discussed have the advantage of effectively combating spam and other unwanted emails. The ephemeral nature of temporary addresses, however, prevents regular communication with an interlocutor, while the obligatory link between alias and main email address does not guarantee 100% anonymity for Internet users.

This is where encrypted messaging providers come in. These services are based on a mode of operation identical to that of general public messaging, with the difference that all incoming and outgoing emails are locked using end-to-end encryption. Therefore, if the message is intercepted between two inboxes compatible with the same encryption algorithm, it cannot be read or attributed to a sender/recipient. In the most secure cases, encrypted emails can also be protected by an additional password, guaranteeing the anonymity of emails sent to contacts using a standard messaging service.

Among the encrypted email providers most respectful of anonymity, we can obviously cite ProtonMail, Mailbox.org or MailFence.

Hide your IP with a VPN

Even when using a highly secure encrypted email service, some identification data can still leak through. We are thinking in particular of the metadata of attachments which must be deleted beforehand.

The IP address, always accessible to ISPs, web platforms and other third parties monitoring the network, also makes it possible to identify Internet users, to trace their online activities, and therefore to know which messaging services they use, and how often. Hence the importance of activating a VPN every time you connect to the Internet, even if it is just to check your inbox.

Ranked among the best VPN services on the market, ExpressVPN allows you to effectively hide your IP address. Equipped with a fleet of more than 3,000 RAM servers distributed in 94 countries (160 locations), it also makes it possible to hide the real geolocation of the Internet user and make the websites consulted believe that they are connecting from another country than his own. The connection between the connecting device and the selected VPN server is encrypted using the military AES-256 algorithm and passes through one of the secure VPN protocols supported by the service, namely its in-house solution open source Lightway, OpenVPN (TCP and UDP), IKEv2 or L2TP/IPSec.

By activating ExpressVPN each time they connect to the Internet, the user ensures that their connection, their traffic, and therefore their personal data, cannot be intercepted or decrypted by overly curious and/or malicious third parties. In the event of a VPN disconnection (power outage, Internet outage, network change), the kill switch instantly blocks Internet traffic entering and exiting the device to prevent data leaks outside the VPN tunnel. Consequently, personal communications are permanently certified confidential and anonymous, especially if the Internet user has taken care to use an encrypted email provider.

Available on desktop (Windows, macOS, Linux), mobile (Android, iOS) and compatible with many routers and Internet boxes, ExpressVPN supports up to five simultaneous connections. In order to allow Internet users to test the service before making a long-term commitment, the VPN provider has a 30-day money-back guarantee.

In order to completely preserve the anonymity of its users, ExpressVPN applies a very strict zero logs policy (VPN domicile in the British Virgin Islands) and accepts crypto payments.