Problems Handling Multiple Accounts

[BobsUncle]

Hey vlad, first of all great work thanks for sharing.

I currently have your software deployed in following configuration:

1. 4 x Protonmail accounts (separate identities)
2. All are accessed via the onion site/tor gateway

Problem: Each account is constantly logging back out and logging back in automatically. It happens every 90 seconds. One account will login the other will log out. This is probably not good because unless it is a bug it means the Protonmail server is logging you out which means isolation between accounts is not good.

Also I am wondering can you give option in future update to set specific proxy parameter for each account? That was a person managing multiple accounts can implement stream isolation via TOR so each account has a different circuit. Just requires ability set IP and PORT.

FYI. I am using this app on Debian 9 (whonix workstation).

Thanks

[vladimiry]

• Can you confirm the app works well with your setup if you use only one account?
• Does it work well if you map your browser to Tor and login into several accounts?

It happens every 90 seconds. One account will login the other will log out. This is probably not good because unless it is a bug it means the Protonmail server is logging you out which means isolation between accounts is not good.

I know there are users who go with multiple accounts and so far there was no such kind of issue revealed you describe. But still, there is a way to enable better account isolation.

set specific proxy parameter for each account

I think it's feasible.

[vladimiry]

• Build with improved accounts isolation is uploaded here. Does it work better with your setup?

• The new build also supports configuring proxy per account. Can you confirm it works as expected?
  

[BobsUncle]

Hi Vlad,

I tried downloading from the dropbox link but the link is no longer valid.

I look forward to testing out the changes.

Thanks

[BobsUncle]

* Can you confirm the app works well with your setup if you use only one account?

Yes, works fine with just one account

* Does it work well if you map your browser to Tor and login into several accounts?

You mean one tor browser instance but multiple tabs? No that does not work fine it also risk the accounts being suspended because it does not isolate (cookies, etc) each tab.

[vladimiry]

I tried downloading from the dropbox link but the link is no longer valid.

I removed the dropbox links as recently published v3 release includes new changes.

I'd ask you to try the app:

• with one account first
• then with several accounts (the original case)
• and then using the proxy

[BobsUncle]

I know there are users who go with multiple accounts and so far there was no such kind of issue revealed you describe. But still, there is a way to enable better account isolation

I think full and proper isolation is imperative. The app should come with a warning that it is not designed for identity or isolation if these features you speak of for isolation are not yet implemented so any other users not might make same mistake i make.

[BobsUncle]

I tried downloading from the dropbox link but the link is no longer valid.

I removed the dropbox links as recently published v3 release includes new changes.

I'd ask you to try the app:

* with one account first

* then with several accounts (the original case)

* and then using the proxy

OK I will test it out now and report back!

[BobsUncle]

When I enable proxy it is not working. I entered it as IP:Port (since no field specific for port). I entered it like "127.0.0.1:9052"

[BobsUncle]

Perhaps it does not work with Socks 5 proxy?

[BobsUncle]

OK it should be entered like this socks5://10.152.152.10:9180

[vladimiry]

OK it should be entered like this socks5://10.152.152.10:9180

Yep, see the documentation link near to the field. I think it's quite flexible.

[BobsUncle]

Everything seems to be working beautifully. I'll keep you updated.

Vlad, can you explain a little how isolation is implemented in this new version between different accounts?

[BobsUncle]

FYI: (possibly unrelated) I just added six accounts total and hit a "ENOMEM, Cannot allocate memory" error.

[vladimiry]

• How much RAM do you have?
• Is local store option enabled and initial syncing got finished?
  • If so, are there a lot of emails in your account?
  • If so, what is the database.bin file size?

See here how to save some memory #108
See here how to enable extended logs if you are going to send them to me #110

Vlad, can you explain a little how isolation is implemented in this new version between different accounts?

I enabled individual in-memory sessions for each account. Before that, the default single session was used for everything.

[BobsUncle]

• I am using a bare-bones debian 9 VM with 1536 RAM.
• Local store is setup for everyone and yes sync was finished i think except for one account (the account i just added when the error popped up). The app continued just fine and loaded everything including from the new account.
• No, not a lot of emails.
• 10.6MB

Everything is working a lot smoother now the new v3 update.

How do you disable the full text search option? That sounds like what I need to do.

[vladimiry]

Do like here and restart the app then (you can also tweak the respective options in config.json manually):

This will save you some RAM. I think something like up to 200MB in summary. But I have to admit that 1536 MB for 6 accounts does not look promising.

Please close the issue if it's resolved.

[nil0x42]

Hey, just for the record, i sounds like i have EXACTLY the same setup as @BobsUncle , and also exactly the same issues.
I'll try electronmail v3 now to see if it resolves

EDIT: electronmail 3.0 seems to work like a charm 👍
PS: i loved the 'per account proxy' feature

Thank you @vladimiry !

[vladimiry]

Closing as resolved.

[ghost]

I think a very simple way to get stream isolation is to use the protonmail onion server for one account and the surface web for the other account. It only works for protonmail and only if you have two accounts, but for that case it's much simpler and easier to trust than multiple proxy ports. I say trust because there is no concern for whether the isolation code works because the surface web must use an exit node, and the onion server needs no exit node.

I'm a bit fuzzy on why account-dependent ports are needed. Is that a whonix particular need? It seems IsolateDestAddr and IsolateDestPort tor options are applied to the proxy port, and then all traffic through that port gets stream isolation. So all accounts can be configured to use the same SOCKS port, no?

[nil0x42]

I'm a bit fuzzy on why account-dependent ports are needed. Is that a whonix particular need? It seems IsolateDestAddr and IsolateDestPort tor options are applied to the proxy port, and then all traffic through that port gets stream isolation. So all accounts can be configured to use the same SOCKS port, no?

No, because "IsosolateDestAddr" and "IsolateDestPort" will pick a different route for each different "IP:PORT" tuple.
So using the same proxy port for' let's say tutanota and protonmail will lead to different routes, but the same route will be used to 2 tcp streams to "protonmail.com:443".

Note that whonix has pre-defined alternative open ports that will lead to different routes.
Take a look at "/usr/share/tor/tor-service-defaults-torrc".

Therefore using .onion for all already provides stream isolation, as all tcp connexions from an onion service are viewed as comming from 127.0.0.1 for servers, so there is no difference between, your first onion, your second onion, any worldwide protonmail's onion users.

The only issue would be a correlation attack by protonmail based on connection/disconnection time from multiple accounts. Note that it also applies if you use different tor routes (clearnet stream isolation).

That's why a randomized & delayed connection or something similar would be greatly appreciated as a future feature of Electronmail (@vladimiry)

[vladimiry]

That's why a randomized & delayed connection or something similar would be greatly appreciated as a future feature of Electronmail (@vladimiry)

This is being discussed here and planned for implementing.

[vladimiry]

Here is brief info of how to use Tor v3 Proton address API entry point on Windows:

• Install the Tor Browser package. Get here https://www.torproject.org.
• Locate the tor.exe somewhere in your program files. Then run tor.exe | more in cmd.exe console or .\tor.exe in PowerShell console and wait until bootstrapping completed (you should see the log lines get printed to console). The default on-the-fly config will be used as we didn't specify the custom one. If you need to you could look up on the internet how to use a custom Tor config, how to set up Tor as a hidden Windows service, etc.
• In the app select the "Tor version 3 address" option from the "API entry point" input control (the option previously was named as "https://protonirockerxow.onion/" but got renamed during moving to Tor v3 Proton address).
• In the app specify socks5://localhost:9050 as a proxy address for the account. The respective/proxy form input control is hidden under the collapsed by default "Advanced Options" block.

Referencing this info with #146.