Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Problems Handling Multiple Accounts #113

Closed
BobsUncle opened this issue Mar 7, 2019 · 21 comments

Comments

Projects
None yet
3 participants
@BobsUncle
Copy link

commented Mar 7, 2019

Hey vlad, first of all great work thanks for sharing.

I currently have your software deployed in following configuration:

  1. 4 x Protonmail accounts (separate identities)
  2. All are accessed via the onion site/tor gateway

Problem: Each account is constantly logging back out and logging back in automatically. It happens every 90 seconds. One account will login the other will log out. This is probably not good because unless it is a bug it means the Protonmail server is logging you out which means isolation between accounts is not good.

Also I am wondering can you give option in future update to set specific proxy parameter for each account? That was a person managing multiple accounts can implement stream isolation via TOR so each account has a different circuit. Just requires ability set IP and PORT.

FYI. I am using this app on Debian 9 (whonix workstation).

Thanks

@vladimiry

This comment has been minimized.

Copy link
Owner

commented Mar 7, 2019

  • Can you confirm the app works well with your setup if you use only one account?
  • Does it work well if you map your browser to Tor and login into several accounts?

It happens every 90 seconds. One account will login the other will log out. This is probably not good because unless it is a bug it means the Protonmail server is logging you out which means isolation between accounts is not good.

I know there are users who go with multiple accounts and so far there was no such kind of issue revealed you describe. But still, there is a way to enable better account isolation.

set specific proxy parameter for each account

I think it's feasible.

@vladimiry

This comment has been minimized.

Copy link
Owner

commented Mar 9, 2019

  • Build with improved accounts isolation is uploaded here. Does it work better with your setup?

  • The new build also supports configuring proxy per account. Can you confirm it works as expected?
    proxy

@BobsUncle

This comment has been minimized.

Copy link
Author

commented Mar 15, 2019

Hi Vlad,

I tried downloading from the dropbox link but the link is no longer valid.

I look forward to testing out the changes.

Thanks

@BobsUncle

This comment has been minimized.

Copy link
Author

commented Mar 15, 2019

* Can you confirm the app works well with your setup if you use only one account?

Yes, works fine with just one account

* Does it work well if you map your browser to Tor and login into several accounts?

You mean one tor browser instance but multiple tabs? No that does not work fine it also risk the accounts being suspended because it does not isolate (cookies, etc) each tab.

@vladimiry

This comment has been minimized.

Copy link
Owner

commented Mar 15, 2019

I tried downloading from the dropbox link but the link is no longer valid.

I removed the dropbox links as recently published v3 release includes new changes.

I'd ask you to try the app:

  • with one account first
  • then with several accounts (the original case)
  • and then using the proxy
@BobsUncle

This comment has been minimized.

Copy link
Author

commented Mar 15, 2019

I know there are users who go with multiple accounts and so far there was no such kind of issue revealed you describe. But still, there is a way to enable better account isolation

I think full and proper isolation is imperative. The app should come with a warning that it is not designed for identity or isolation if these features you speak of for isolation are not yet implemented so any other users not might make same mistake i make.

@BobsUncle

This comment has been minimized.

Copy link
Author

commented Mar 15, 2019

I tried downloading from the dropbox link but the link is no longer valid.

I removed the dropbox links as recently published v3 release includes new changes.

I'd ask you to try the app:

* with one account first

* then with several accounts (the original case)

* and then using the proxy

OK I will test it out now and report back!

@BobsUncle

This comment has been minimized.

Copy link
Author

commented Mar 15, 2019

When I enable proxy it is not working. I entered it as IP:Port (since no field specific for port). I entered it like "127.0.0.1:9052"

@BobsUncle

This comment has been minimized.

Copy link
Author

commented Mar 15, 2019

Perhaps it does not work with Socks 5 proxy?

@BobsUncle

This comment has been minimized.

Copy link
Author

commented Mar 15, 2019

OK it should be entered like this socks5://10.152.152.10:9180

@vladimiry

This comment has been minimized.

Copy link
Owner

commented Mar 15, 2019

OK it should be entered like this socks5://10.152.152.10:9180

Yep, see the documentation link near to the field. I think it's quite flexible.

@BobsUncle

This comment has been minimized.

Copy link
Author

commented Mar 15, 2019

Everything seems to be working beautifully. I'll keep you updated.

Vlad, can you explain a little how isolation is implemented in this new version between different accounts?

@BobsUncle

This comment has been minimized.

Copy link
Author

commented Mar 15, 2019

FYI: (possibly unrelated) I just added six accounts total and hit a "ENOMEM, Cannot allocate memory" error.

@vladimiry

This comment has been minimized.

Copy link
Owner

commented Mar 15, 2019

  • How much RAM do you have?
  • Is local store option enabled and initial syncing got finished?
    • If so, are there a lot of emails in your account?
    • If so, what is the database.bin file size?

See here how to save some memory #108
See here how to enable extended logs if you are going to send them to me #110

Vlad, can you explain a little how isolation is implemented in this new version between different accounts?

I enabled individual in-memory sessions for each account. Before that, the default single session was used for everything.

@BobsUncle

This comment has been minimized.

Copy link
Author

commented Mar 15, 2019

  • I am using a bare-bones debian 9 VM with 1536 RAM.
  • Local store is setup for everyone and yes sync was finished i think except for one account (the account i just added when the error popped up). The app continued just fine and loaded everything including from the new account.
  • No, not a lot of emails.
  • 10.6MB

Everything is working a lot smoother now the new v3 update.

How do you disable the full text search option? That sounds like what I need to do.

@vladimiry

This comment has been minimized.

Copy link
Owner

commented Mar 15, 2019

Do like here and restart the app then (you can also tweak the respective options in config.json manually):
img

This will save you some RAM. I think something like up to 200MB in summary. But I have to admit that 1536 MB for 6 accounts does not look promising.

Please close the issue if it's resolved.

@nil0x42

This comment has been minimized.

Copy link

commented Mar 15, 2019

Hey, just for the record, i sounds like i have EXACTLY the same setup as @BobsUncle , and also exactly the same issues.
I'll try electronmail v3 now to see if it resolves

EDIT: electronmail 3.0 seems to work like a charm 👍
PS: i loved the 'per account proxy' feature

Thank you @vladimiry !

@vladimiry

This comment has been minimized.

Copy link
Owner

commented Mar 19, 2019

Closing as resolved.

@ghost

This comment has been minimized.

Copy link

commented Mar 25, 2019

I think a very simple way to get stream isolation is to use the protonmail onion server for one account and the surface web for the other account. It only works for protonmail and only if you have two accounts, but for that case it's much simpler and easier to trust than multiple proxy ports. I say trust because there is no concern for whether the isolation code works because the surface web must use an exit node, and the onion server needs no exit node.

I'm a bit fuzzy on why account-dependent ports are needed. Is that a whonix particular need? It seems IsolateDestAddr and IsolateDestPort tor options are applied to the proxy port, and then all traffic through that port gets stream isolation. So all accounts can be configured to use the same SOCKS port, no?

@nil0x42

This comment has been minimized.

Copy link

commented Mar 26, 2019

I'm a bit fuzzy on why account-dependent ports are needed. Is that a whonix particular need? It seems IsolateDestAddr and IsolateDestPort tor options are applied to the proxy port, and then all traffic through that port gets stream isolation. So all accounts can be configured to use the same SOCKS port, no?

No, because "IsosolateDestAddr" and "IsolateDestPort" will pick a different route for each different "IP:PORT" tuple.
So using the same proxy port for' let's say tutanota and protonmail will lead to different routes, but the same route will be used to 2 tcp streams to "protonmail.com:443".

Note that whonix has pre-defined alternative open ports that will lead to different routes.
Take a look at "/usr/share/tor/tor-service-defaults-torrc".

Therefore using .onion for all already provides stream isolation, as all tcp connexions from an onion service are viewed as comming from 127.0.0.1 for servers, so there is no difference between, your first onion, your second onion, any worldwide protonmail's onion users.

The only issue would be a correlation attack by protonmail based on connection/disconnection time from multiple accounts. Note that it also applies if you use different tor routes (clearnet stream isolation).

That's why a randomized & delayed connection or something similar would be greatly appreciated as a future feature of Electronmail (@vladimiry)

@vladimiry

This comment has been minimized.

Copy link
Owner

commented Mar 26, 2019

That's why a randomized & delayed connection or something similar would be greatly appreciated as a future feature of Electronmail (@vladimiry)

This is being discussed here and planned for implementing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.