Candidate stack for Edgeryders' community crypto setup

alberto · December 29, 2014, 3:46pm

Introduction: We try to patch together a VERY SIMPLE solution for edgeryders who, while they don’t want or need to encrypt all their email, still occasionally need secure email; or who are simply curious about secure communication, but have limited time or skills.

A candidate stack would be, basically:

an edgeryders.eu email address for who wants one – a mailbox dedicated to encrypted stuff.
Mailpile (simple installation and setup, great user interface).
A carefully written, rookie-friendly step-by-step guide to setting the whole thing up.
Community help, with more skilled edgeryders up for helping less skilled ones.

Dreaming it up now at 31C3 with @msanti.

(Introduction from former category added by @matthias 2017-09-10 when reorganizing content.)

alberto · December 29, 2014, 9:31pm

Mostly works – but SMTP error

Everything works except outgoing mail (what Mailpile calls “Send Routes”).

A successful Send Route test (through GMail) returns the following log:

SendMail: from alberto.cottica@gmail.com (), to [u’alberto.cottica@gmail.com ', ‘test@mailpile.is’] via smtp.gmail.com:587


SMTP connection to: smtp.gmail.com:587 as alberto.cottica@gmail.com
connect: (u’smtp.gmail.com’, 587)
reply: ‘220 mx.google.com ESMTP l9sm40919136wic.21 - gsmtp\r\n’
reply: retcode (220); Msg: mx.google.com ESMTP l9sm40919136wic.21 - gsmtp
connect: mx.google.com ESMTP l9sm40919136wic.21 - gsmtp
send: ‘ehlo mailpile.local\r\n’
reply: ‘250-mx.google.com at your service, [151.217.212.176]\r\n’
reply: ‘250-SIZE 35882577\r\n’
reply: ‘250-8BITMIME\r\n’
reply: ‘250-STARTTLS\r\n’
reply: ‘250-ENHANCEDSTATUSCODES\r\n’
reply: ‘250-PIPELINING\r\n’
reply: ‘250-CHUNKING\r\n’
reply: ‘250 SMTPUTF8\r\n’
reply: retcode (250); Msg: mx.google.com at your service, [151.217.212.176]
SIZE 35882577
8BITMIME
STARTTLS
ENHANCEDSTATUSCODES
PIPELINING
CHUNKING
SMTPUTF8
send: ‘STARTTLS\r\n’
reply: ‘220 2.0.0 Ready to start TLS\r\n’
reply: retcode (220); Msg: 2.0.0 Ready to start TLS
send: ‘ehlo mailpile.local\r\n’
reply: ‘250-mx.google.com at your service, [151.217.212.176]\r\n’
reply: ‘250-SIZE 35882577\r\n’
reply: ‘250-8BITMIME\r\n’
reply: ‘250-AUTH LOGIN PLAIN XOAUTH XOAUTH2 PLAIN-CLIENTTOKEN\r\n’
reply: ‘250-ENHANCEDSTATUSCODES\r\n’
reply: ‘250-PIPELINING\r\n’
reply: ‘250-CHUNKING\r\n’
reply: ‘250 SMTPUTF8\r\n’
reply: retcode (250); Msg: mx.google.com at your service, [151.217.212.176]
SIZE 35882577
8BITMIME
AUTH LOGIN PLAIN XOAUTH XOAUTH2 PLAIN-CLIENTTOKEN
ENHANCEDSTATUSCODES
PIPELINING
CHUNKING
SMTPUTF8
send: ‘AUTH PLAIN AGFsYmVydG8uY290dGljYUBnbWFpbC5jb20gAGJwZndoZnZoeXplcXRscXM=\r\n’
reply: ‘235 2.7.0 Accepted\r\n’
reply: retcode (235); Msg: 2.7.0 Accepted
send: u’mail FROM:<alberto.cottica@gmail.com>\r\n’
reply: ‘250 2.1.0 OK l9sm40919136wic.21 - gsmtp\r\n’
reply: retcode (250); Msg: 2.1.0 OK l9sm40919136wic.21 - gsmtp
send: u’rcpt TO:<alberto.cottica@gmail.com>\r\n’
reply: ‘250 2.1.5 OK l9sm40919136wic.21 - gsmtp\r\n’
reply: retcode (250); Msg: 2.1.5 OK l9sm40919136wic.21 - gsmtp
send: ‘rcpt TO:<test@mailpile.is>\r\n’
reply: ‘250 2.1.5 OK l9sm40919136wic.21 - gsmtp\r\n’
reply: retcode (250); Msg: 2.1.5 OK l9sm40919136wic.21 - gsmtp
send: ‘DATA\r\n’
reply: ‘354  Go ahead l9sm40919136wic.21 - gsmtp\r\n’
reply: retcode (354); Msg: Go ahead l9sm40919136wic.21 - gsmtp

SendMail: from alberto@edgeryders.eu (ugrazyd_xfa6mcsvx36pwasaamq), to [‘alberto@edgeryders.eu’, ‘alberto.cottica@gmail.com’] via mail.edgeryders.eu:143

When I try the same with mail.edgeryders.eu, I get:

SMTP connection to: mail.edgeryders.eu:143 as alberto@edgeryders.eu


connect: (u’mail.edgeryders.eu’, 143)
reply: ‘* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot (Ubuntu) ready.\r\n’
reply: retcode (-1); Msg: [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot (Ubuntu) ready.
connect: [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot (Ubuntu) ready.
send: ‘ehlo mailpile.local\r\n’
reply: ‘ehlo BAD Error in IMAP command received by server.\r\n’
reply: retcode (-1); Msg: BAD Error in IMAP command received by server.
send: ‘helo mailpile.local\r\n’
reply: ‘helo BAD Error in IMAP command received by server.\r\n’
reply: retcode (-1); Msg: BAD Error in IMAP command received by server.

SendMail: from alberto@edgeryders.eu (ugrazyd_xfa6mcsvx36pwasaamq), to [‘alberto@edgeryders.eu’, ‘alberto.cottica@gmail.com’] via mail.edgeryders.eu:143

I triple-checked my settings: I definitely set the port on mail.edgeryders.eu to 587, NOT 143. However, the damn thing definitely tries to connect to mail.edgeryders.eu on port 143 (compare the first lines of the two tries).

alberto · December 29, 2014, 10:42pm

Put up an issue on their GitHub

github.com/mailpile/Mailpile

Mailpile contacts SMTP server on the wrong port?

opened 10:40PM - 29 Dec 14 UTC

closed 05:05PM - 18 Jan 15 UTC

albertocottica

Hello all, we are trying to run Mailpile on our own self-hosted email addresses.… IMAP works, SMTP does not. I am no expert, but it seems that Mailpile contacts the SMTP server on the wrong port (my settings are correctly set to 587): `SMTP connection to: mail.edgeryders.eu:143 as alberto@edgeryders.eu` If I try the same thing with Gmail, I get instead `SMTP connection to: smtp.gmail.com:587 as alberto.cottica@gmail.com` Below I paste the whole logged error message: ``` SendMail: from alberto.cottica@gmail.com (), to [u'alberto.cottica@gmail.com ', 'test@mailpile.is'] via smtp.gmail.com:587 SMTP connection to: smtp.gmail.com:587 as alberto.cottica@gmail.com connect: (u'smtp.gmail.com', 587) reply: '220 mx.google.com ESMTP l9sm40919136wic.21 - gsmtp\r\n' reply: retcode (220); Msg: mx.google.com ESMTP l9sm40919136wic.21 - gsmtp connect: mx.google.com ESMTP l9sm40919136wic.21 - gsmtp send: 'ehlo mailpile.local\r\n' reply: '250-mx.google.com at your service, [151.217.212.176]\r\n' reply: '250-SIZE 35882577\r\n' reply: '250-8BITMIME\r\n' reply: '250-STARTTLS\r\n' reply: '250-ENHANCEDSTATUSCODES\r\n' reply: '250-PIPELINING\r\n' reply: '250-CHUNKING\r\n' reply: '250 SMTPUTF8\r\n' reply: retcode (250); Msg: mx.google.com at your service, [151.217.212.176] SIZE 35882577 8BITMIME STARTTLS ENHANCEDSTATUSCODES PIPELINING CHUNKING SMTPUTF8 send: 'STARTTLS\r\n' reply: '220 2.0.0 Ready to start TLS\r\n' reply: retcode (220); Msg: 2.0.0 Ready to start TLS send: 'ehlo mailpile.local\r\n' reply: '250-mx.google.com at your service, [151.217.212.176]\r\n' reply: '250-SIZE 35882577\r\n' reply: '250-8BITMIME\r\n' reply: '250-AUTH LOGIN PLAIN XOAUTH XOAUTH2 PLAIN-CLIENTTOKEN\r\n' reply: '250-ENHANCEDSTATUSCODES\r\n' reply: '250-PIPELINING\r\n' reply: '250-CHUNKING\r\n' reply: '250 SMTPUTF8\r\n' reply: retcode (250); Msg: mx.google.com at your service, [151.217.212.176] SIZE 35882577 8BITMIME AUTH LOGIN PLAIN XOAUTH XOAUTH2 PLAIN-CLIENTTOKEN ENHANCEDSTATUSCODES PIPELINING CHUNKING SMTPUTF8 send: 'AUTH PLAIN AGFsYmVydG8uY290dGljYUBnbWFpbC5jb20gAGJwZndoZnZoeXplcXRscXM=\r\n' reply: '235 2.7.0 Accepted\r\n' reply: retcode (235); Msg: 2.7.0 Accepted send: u'mail FROM:<alberto.cottica@gmail.com>\r\n' reply: '250 2.1.0 OK l9sm40919136wic.21 - gsmtp\r\n' reply: retcode (250); Msg: 2.1.0 OK l9sm40919136wic.21 - gsmtp send: u'rcpt TO:<alberto.cottica@gmail.com>\r\n' reply: '250 2.1.5 OK l9sm40919136wic.21 - gsmtp\r\n' reply: retcode (250); Msg: 2.1.5 OK l9sm40919136wic.21 - gsmtp send: 'rcpt TO:<test@mailpile.is>\r\n' reply: '250 2.1.5 OK l9sm40919136wic.21 - gsmtp\r\n' reply: retcode (250); Msg: 2.1.5 OK l9sm40919136wic.21 - gsmtp send: 'DATA\r\n' reply: '354 Go ahead l9sm40919136wic.21 - gsmtp\r\n' reply: retcode (354); Msg: Go ahead l9sm40919136wic.21 - gsmtp SendMail: from alberto@edgeryders.eu (ugrazyd_xfa6mcsvx36pwasaamq), to ['alberto@edgeryders.eu', 'alberto.cottica@gmail.com'] via mail.edgeryders.eu:143 ```

danohu · December 31, 2014, 3:25pm

I like this plan

I’m sorry I missed talking with you about this at 31C3. I very much approve – and agree that the problem with security is getting enough momentum that you have somebody to communicate with.

I’m generally very happy to help people trying to use encryption. Incidentally, you (and anybody else) is welcome to send me encrypted mail – key is https://hkps.pool.sks-keyservers.net/pks/lookup?op=get&search=0xCADE22BCDEEBB418

alberto · December 31, 2014, 3:38pm

This is why we need comunity infrastructure!

You can find my public key here: https://www.cottica.net/alberto-who/contacts/

BUT we should do a proper key exchange, at least over voice. Maybe we can use the first community call of 2015 for this?

Which is why a community, even a small one as Edgeryders, is essential to get crypto going: there is no point having a PGP key if none of your friends have one. We tried to do a session on easy crypto at LOTE4 (based on Thunderbird + Enigmail, which does work with mailaddress@edgeryders.eu but is a bit more cumbersome), but it fell through the cracks. @Noemi was very interested.

The Community Crypto project means that we bake key exchange parties, how-to sessions for beginners etc. in all major Edgeryders events. This is also a technical task that is accessible to non-engineers like myself – I managed to set up PGP + Enigmail + Thunderbird by myself in about 2 hours, and it worked on the first try. Maybe you, @danohu, could act as the senior skilled crypto guy, and teach people how to teach people how to set up stuff.

noemi · January 5, 2015, 11:37am

I’m still interested

Love the idea, and thanks for giving it another thought after the Lote4 attempt. Being completely illiterate in this subject, I’m excited to have come across one good argument in the post 31c3 wiki: We should not do it for our own security, which is perceived as low priority by most of us as we have nothing to hide; we should do it for others, like the courageous journalists and whistleblowers keeping our society marginally truer and more free, who need more people to use crypto so they can “get lost in then crowd”: and for ourselves, as a shared learning journey to upskill all of Edgeryders.

We’d clearly need one of you guys to lead this, but I’d happy to help gather newbies around and have a themed community call or more of an online workshop to work through this. For the first part of your list above, a while ago Matt had started useful wikis for creating and setting up edgeryders.eu email addresses. I found those kind of instructions easy to follow.

alberto · January 19, 2015, 3:05pm

Answer received, but no progress

Bjarni from Mailpile replied to my issue on GitHub, but I think he did not understand it. No doubt I did a bad job of explaining it.

github.com/mailpile/Mailpile

Mailpile contacts SMTP server on the wrong port?

opened 10:40PM - 29 Dec 14 UTC

closed 05:05PM - 18 Jan 15 UTC

albertocottica

Hello all, we are trying to run Mailpile on our own self-hosted email addresses.… IMAP works, SMTP does not. I am no expert, but it seems that Mailpile contacts the SMTP server on the wrong port (my settings are correctly set to 587): `SMTP connection to: mail.edgeryders.eu:143 as alberto@edgeryders.eu` If I try the same thing with Gmail, I get instead `SMTP connection to: smtp.gmail.com:587 as alberto.cottica@gmail.com` Below I paste the whole logged error message: ``` SendMail: from alberto.cottica@gmail.com (), to [u'alberto.cottica@gmail.com ', 'test@mailpile.is'] via smtp.gmail.com:587 SMTP connection to: smtp.gmail.com:587 as alberto.cottica@gmail.com connect: (u'smtp.gmail.com', 587) reply: '220 mx.google.com ESMTP l9sm40919136wic.21 - gsmtp\r\n' reply: retcode (220); Msg: mx.google.com ESMTP l9sm40919136wic.21 - gsmtp connect: mx.google.com ESMTP l9sm40919136wic.21 - gsmtp send: 'ehlo mailpile.local\r\n' reply: '250-mx.google.com at your service, [151.217.212.176]\r\n' reply: '250-SIZE 35882577\r\n' reply: '250-8BITMIME\r\n' reply: '250-STARTTLS\r\n' reply: '250-ENHANCEDSTATUSCODES\r\n' reply: '250-PIPELINING\r\n' reply: '250-CHUNKING\r\n' reply: '250 SMTPUTF8\r\n' reply: retcode (250); Msg: mx.google.com at your service, [151.217.212.176] SIZE 35882577 8BITMIME STARTTLS ENHANCEDSTATUSCODES PIPELINING CHUNKING SMTPUTF8 send: 'STARTTLS\r\n' reply: '220 2.0.0 Ready to start TLS\r\n' reply: retcode (220); Msg: 2.0.0 Ready to start TLS send: 'ehlo mailpile.local\r\n' reply: '250-mx.google.com at your service, [151.217.212.176]\r\n' reply: '250-SIZE 35882577\r\n' reply: '250-8BITMIME\r\n' reply: '250-AUTH LOGIN PLAIN XOAUTH XOAUTH2 PLAIN-CLIENTTOKEN\r\n' reply: '250-ENHANCEDSTATUSCODES\r\n' reply: '250-PIPELINING\r\n' reply: '250-CHUNKING\r\n' reply: '250 SMTPUTF8\r\n' reply: retcode (250); Msg: mx.google.com at your service, [151.217.212.176] SIZE 35882577 8BITMIME AUTH LOGIN PLAIN XOAUTH XOAUTH2 PLAIN-CLIENTTOKEN ENHANCEDSTATUSCODES PIPELINING CHUNKING SMTPUTF8 send: 'AUTH PLAIN AGFsYmVydG8uY290dGljYUBnbWFpbC5jb20gAGJwZndoZnZoeXplcXRscXM=\r\n' reply: '235 2.7.0 Accepted\r\n' reply: retcode (235); Msg: 2.7.0 Accepted send: u'mail FROM:<alberto.cottica@gmail.com>\r\n' reply: '250 2.1.0 OK l9sm40919136wic.21 - gsmtp\r\n' reply: retcode (250); Msg: 2.1.0 OK l9sm40919136wic.21 - gsmtp send: u'rcpt TO:<alberto.cottica@gmail.com>\r\n' reply: '250 2.1.5 OK l9sm40919136wic.21 - gsmtp\r\n' reply: retcode (250); Msg: 2.1.5 OK l9sm40919136wic.21 - gsmtp send: 'rcpt TO:<test@mailpile.is>\r\n' reply: '250 2.1.5 OK l9sm40919136wic.21 - gsmtp\r\n' reply: retcode (250); Msg: 2.1.5 OK l9sm40919136wic.21 - gsmtp send: 'DATA\r\n' reply: '354 Go ahead l9sm40919136wic.21 - gsmtp\r\n' reply: retcode (354); Msg: Go ahead l9sm40919136wic.21 - gsmtp SendMail: from alberto@edgeryders.eu (ugrazyd_xfa6mcsvx36pwasaamq), to ['alberto@edgeryders.eu', 'alberto.cottica@gmail.com'] via mail.edgeryders.eu:143 ```

Can you help me with the explanation, @danohu?

almereyda · January 20, 2015, 4:25pm

Federated Conversation

Let’s discuss this issue over there.

Your explanation @Alberto was actually right, but you were kind of missing some details.

gandhiano · January 20, 2015, 4:40pm

Since Ecobytes also has as top priority to setup a reliable and friendly MTA, and @almereyda already had proposed MailPile, I would like to ask if there is the possibility of joining some resources and working together on this, providing then a solution that is usable for the enlarged federated community of Ecobytes, Edgeryders, etc.

Do you have someone, apart from @almereyda, that could work on this (@alberto seems at least motivated, @danohu)?

If you agree with this, I suggest building up a multi-skilled team (architects, developers, security experts, users) and driving an own scrum to develop this product, which is essential for a large group of users. And would help a lot us to get finally rid of the old Ecobytes MTA and account management - very efficient and secure, but a management nightmare

danohu · January 21, 2015, 7:26pm

I think this is great. But I probably wouldn’t be willing to dedicate substantial amounts of volunteer time to it, I’m afraid. There are just too many other things going on

alberto · January 26, 2015, 4:53pm

Emphasis on “community”

@gandhiano, I think what Edgeryders can bring to the table is the “community” in “community crypto”. We can write instructables, provide help to community members who get stuck, organize key exchange bars in Edgeryders events, and in general lower the threshold for people, in Edgeryders or without it, to use crypto. I don’t think we have either the ability or the interest to get involved in development. Several of us – myself included – supported the Mailpile crowdfunding campaign, and that is our contribution to development proper.

If you think this is in any way useful, this is what this group is here for. A simple idea is:

work out a stack. Mailpile would be great, but if not we'll fall back on Thunderbird + Enigmail, which works already
write an instructable
use one of our community calls to help the first five-six interested people with setup.

Works?