Using private email over Tor and without JavaScript

A private mailbox protects what you store. It does not, on its own, hide the fact that you are using it. Your internet provider, your employer's network or anyone watching the connection can see that you visited your mail provider, when, and from where.

For most people that is acceptable. For journalists, researchers, activists and anyone on a network they do not trust, it is not. Tor and JavaScript-free webmail close that gap.

What Tor changes

Tor sends your connection through several relays run by volunteers. Each relay knows only the hop before it and the hop after it, so no single relay knows both who you are and where you are going.

When you visit an ordinary website over Tor, the last relay, called the exit, connects to the site for you. An onion service goes further: both sides connect into the Tor network and meet in the middle. The connection never leaves Tor, so there is no exit relay that could watch or tamper with your traffic.

Diagram of a Tor onion service connection: you, two relays, a rendezvous point, service-side relays, and the Neir onion service. — With an onion service, both ends meet inside Tor. No exit relay ever sees the traffic.

Neir's onion address

Neir runs an onion mirror of the full site. Open Tor Browser and go to:

http://itlmjjwnpraaxvm5gkjeebwhjy5zycildwyg2u3lyrfigz5e6hntdqqd.onion

It is the same service with the same accounts, so you sign in with your existing Account Key. Onion addresses are long on purpose and easy to imitate, so:

Bookmark it in Tor Browser instead of typing it.
Compare it with the address linked from neir.io the first time.
Never trust an onion address you found in a random forum post or search result.

Why JavaScript matters

Tor Browser's "Safest" security level disables JavaScript entirely, because scripts are the most common way to attack or fingerprint a browser. Most webmail stops working at that setting.

Neir has a separate webmail built for exactly this case at nojs.neir.io. It works with JavaScript turned off and loads no remote images, so a message cannot ping a tracking server when you open it. It is also reachable through the onion service, so you can keep Tor Browser at its safest level and still read and send mail.

What stays the same, and what does not

Using Tor changes how you reach Neir, not what Neir stores. Our web and mail-login logs never record IP addresses whether you use Tor or not, and the webmail copy of your mail is encrypted to your own key either way.

Tor also has limits worth stating plainly:

Email travels between providers over SMTP. The people you write to see your address and everything in the message.
Content can identify you. Tor hides where you connect from. It cannot hide a signature, a writing style or a detail only you would know.
Your account history matters. If you once signed in without Tor, that connection already happened.

A practical setup

Install Tor Browser from the official Tor Project website.
Create your Neir account over Tor from the start, so the sign-up is never linked to your home connection. Neir does not ask for a phone number or recovery email.
Use the onion address or the no-JavaScript webmail for everyday reading.
Keep your Account Key and recovery phrase offline.

You can sign up at neir.io/signup or through the onion address above.

Photo: Markus Petritz on Unsplash.