Resource CTemplar GUIDE : secure/private email + delayed MissingInAction/CTB feats

[enjolras]

Intro : this is both a development for rookie and advanced users interested at safer emails, so peeps stop to fear to perform mishaps in general, leading to risk of prosecution (not only with CTemplar, because some of the advices can be transposed elsewhere). Apologies if the amount of info lies on the IN YOUR FACE side, but I've compiled most of the important info I know (extensively, indeed)

—————————————-

CTemplar is a new kid on the block (work in progress), competing on the scene of the encrypted email providers, like the well established ProtonMail, Tutanota, etc. Comparatively, it comes with it's own approach at handling the security & privacy, trying to fix some of the issues of its' opponents. To familiarise yourself with the distinctive functionalities & concept schemes applied, here are the infomercial speeches (obviously, always judge them with a grain of salt, still it's the reference basis)

Features - CTemplar

ctemplar.com

Security - CTemplar

ctemplar.com

Transparency Report - CTemplar

ctemplar.com

Icelandic Privacy Laws - CTemplar

ctemplar.com

CTemplar’s 4 Wall Protection - CTemplar

4 Wall Protection was defined by the CTemplar team with the goal of helping people review their privacy needs. Imagine that your privacy is a four-walled fortress. If a wall is missing, then an enemy can quickly get into your fortress. Therefore it’s vital that you make sure you receive adequate...

ctemplar.com

Due to the focus to carry on sensitive communications, it can be used as an improved messaging service, by default, between SS members (opposed to PMs or the Telegram app mishandled) ...and why not towards merchants (if/when arranged) : if you manage to convince your contacts to switch to CTemplar, then end-to-end encryption occurs automatically between in-house users (i.e. similar to ProtonMail, requested mandatorily by A for this very reason of perfected default cryptography), otherwise sending encrypted email to non-CTemplar users is still possible, by protection through a password that will serve the recipient to decrypt the message (like Tutanota, except that CTemplar allows also to include, as extra, a Hint to guide the revelation of the password at the time the email will be received, so your correspondants don't have to be warned in advance... which is key to cool down any alert suspicion)

Disclaimer : CTemplar (like any solution) is not perfect / void of criticism, but is generally better than the flaws of many other providers. An in-depth overview describing most accurately the do's and don'ts of a good secure private email service can be found here

E-mail providers - which one to choose?

digdeeper.neocities.org

It's a fantastic read (attention : geek talk) to build a broad understanding of the keypoints to review while choosing a mail provider. It gives RiseUp (almost impossible to access for the Random Joe anyway) as a winner, which personally, I would disagree with, as a matter of the type of protections aimed at. I believe that if CTemplar is used appropriately with best practices in mind, it positions itself advantageously over other contenders.
NB: as is analysed, ProtonMail or Tutanota, which have the most popular marketshares, are in fact complete catastrophes when it comes to proper opsec and trust versus claims.

—————————

Now, down to the point : additional benefits of CTemplar suited for CTBers specifically. 2 unique particular features (with a twist) are proposed :

* delayed mail scheduler (paid) ...allows to prepare a draft mail in advance, set to be sent at a later datetime (through a delay) into the future





* dead man timer (paid) ...same principle, except that the delivery activates itself after a certain time of inactivity instead of a fixed datetime. Basically, it triggers after the surveillance has observed the email's owner has been missing in action for a given period (in brief, that there was a failure to log in / use the mailbox)





Once the preparation of the email(s) is finalised, their status can be reviewed and canceled out inside the Outbox folder



Alternatively, or additionally, it's possible to setup an auto-responder (free), that triggers an alt pre-written(/formatted) email all the times you'd be contacted. Use case ? Potentially if you treat some persons more or less importantly ? then it could filter them with a generic, different response, past the time you reached out to LE/family with delayed / dead mail.
RISK WARNING : if you'd be contacted before CTB or shortly after (before the delayed mails), it could lead to interruption or rescue...
NB: otherwise, the auto-responder would work during 1 full year for a free account, or infinitely for Prime (paid just one, even 1 month) accounts





———————————-

What's the catch between CTemplar & a delayed mail add-on to Gmail like Boomerang ? (or other, miscellaneous)

Well :

- you don't have to trust the oppressive Gmail (or another not qualified email service) to not read your scheduled communication in advance of CTB. CTemplar is a closed private environnement, fully encrypted (the contact list, bodies of mail - the internal search engine can't even scan them, possibly the subject lines if activated - paid option)

- you don't have to use a secondary locked container (like a passworded Word document), attached to mail, to achieve an extra layer of prevention against Google/website. The paranoia can be put aside with confidence

- in extension, you don't have to dispose the password of any locked container or encrypted mail to the targeted recipients in advance, therefore you don't reveal any leak of intention

- up to, the scheduled mail (except auto-responder) at the time of the postponed delivery will be transmitted encrypted (automatically to other CTemplar users) ...or at your choice (yes or no, to setup) towards non-CTemplar users, then you tie the decryption of the mail & attachements to a password that can be Hinted by a short explanation (including the full password in clear) that is not necessary to share prior... the recipient will receive the password when the mail is delivered, not before

- since you'll obtain almost perfect opsec with CTemplar by following the registration/routine instructions to mask your IP, you can also use CTemplar for other CTB goals safely. One danger people may not be aware of, is for instance that even emails on purpose sent with anonymous content (up to no sender's alias), forward your approximate geolocation (which can be fine tuned to become precise with further cross-analysis). Indeed in the email header, your IP has been collected, stored and transmitted to your contacts when you emailed them... the info could be retrieved easily both at the other end or if seized at rest or in transit (LE action, investigating servers - sometimes agencies hijack servers if a court order fails). Sadly, this is as well true for ProtonMail & the likes, as long as you don't hide your IP always (from the application to the closure of the account, and all the time spent on it), you're putting your head under water unknowingly.

Spoiler: How to retrieve IP addresses of senders with Gmail, Yahoo, Outlook

What's the catch between CTemplar & another "secure" email service like ProtonMail (recommended and used by Exit International, plus references inside the PPH) & the likes ?

Well :

- unaware, people use Proton recklessly, because the behemot company tries to enforce poor opsec through restrictions if Tor or a VPN is pulled during the registration to blur the IP (it tells a lot about their so-called "anonymous" stance), typically by asking for a phone number or a donation by PayPal/card instead of submitting an email or NO identifying connection (at the moment, CTemplar tolerates registrations with Tor freely, which is RARE nowadays, plus does not request neither email, or SMS or association to a financial institution at this stage, while offering anonymous payment directly through Monero afterwards, again very rare)

- deleted messages (even consequently to the deletion of account) with ProtonMail or Tutanota, remain as stored data for 6 months as mandated by the swiss & german laws... the jurisdictions chosen by CTemplar (Iceland/Seychelles, the most protectives worldwide for free speech and data retention) avoid this abuse : the deletion is acted without delay following user's action. In other words, when you're advised to delete your emails(/account) with ProtonMail, you should still shake in your shoes for a period when prosecution stays possible

- Proton's particular encryption model, does NOT allow to send encrypted subject lines (even on a paid plan, unlike CTemplar). Therefore, if/when you contact a seller titling "Nembutal" you're making a mistake, leaving a trail behind ...nobody warns you ! Write an innocent approach line instead, whether with CTemplar (Free, if email sent to non-CTemplar users as non-encrypted, or if paid & subject encryption disabled) or Proton

- CTemplar's foundations (self-funded, not financially backed by venture capital funds - Proton with US company - or any government - Tutanota locally in Germany) & operational roots (physical servers, not cheap in the clouds in danger to be taken unexpected control, subject to the icelandic laws, outside of the 14 Eyes' aggression) are the cleanest to avoid legal infiltration & complications

- unlike Proton, there is no backdoor access to 2FA, which means CTemplar cannot reset/disable this secondary physically owned password's layer (isolated from the main pw, which could be obtained from other online services if reused, or by police/family if saved with a password manager). It's impossible at the user's request, by asking a list of weak privacy violating questions, like Proton commits to offer. If the recovery codes of the 2FA are not backed up or lost with CTemplar, then there's no safety net, the account is lost forever. That's how real security is achieved, preventing awkward loopholes

- Metadata encryption is on the roadmap, and should take care to conceal the IP from retrieval out of CTemplar for those who disengage to take care of their IP in the first place (unavailable today at competitors)

——————————-

The only downside of CTemplar is its cost : $8 once, IF delayed mail is wanted (except for the auto-responder which is free). Ponder if it's worth it for the extra peace of mind & convenience.

Plans : the service comes either free, thus limited (most notable restrictions : lack of delayed mail functions, plus max 3 outgoing emails per hour to non-CTemplar users) or paid, among which, only the most basic subscription is sufficiently useful (in case delayed email is sought after) at $8 for 1 single month (by debit/credit card via Stripe, or PayPal) or $72 for 1 year if there's a preference to pay with cryptocurrencies (notably Monero, but also Bitcoin) for improved anonymity (especially if used extensively before CTB, otherwise strictly unnecessary - just buy the $8 one month upgrade at the "last minute" - no need for anonymity once you'll be dead!)

 

[enjolras]

IN PRACTICE

Registration : on invite ONLY (like RiseUp, making it a closed circle niche as well) and even then, not deemed to remain opened for subscriptions eternally (it may be a commercial tactic but so is the current claim)

Email Creation Restriction - CTemplar

ctemplar.com

Therefore, book your seat in advance, NOW, or you could be left out in the futur.

3 ways to get an invite code (please follow the instruction tips of the next chapter, as closely as possible) :
1) send an email to [email protected] ...answer generally acknowledged within a couple of hours or a day maximum
2) post a request at one of their social media canals, why not Reddit in this specific topic
3) non-autonomously, through the intermediary of a paid CTemplar user (each one is granted to distribute up to 3 invitations - managed at the webmail's console, under "General" settings)

——————————-

Instruction tips to follow during the registration, ultimately not mandatory but strongly recommended to educate yourself at practicing clever opsec, & certainly to seal your privacy hermetically... (righteous attitude = distrust all partners ! >> take preventive measures)

* Inquire about the invite code anonymously :

- beforehand, go as far as your competency/means permit it, to apply, in that order of preference, on computer, Tails OS (installation guide by @HelensNepenthe) + Tor browser (included with Tails), or a VPN (to acquire) + Tor (to install), or Tor alone as last resort.
NB1 : pay attention not to rely on a mobile device, because the Tor inspired apps on Android (official) & especially iOS (unofficial) are of sub-par quality with breaches and won't offer the same degree of cover than the brand name Tor on PC/Mac/Linux
NB2: to install Tor on computer (outside of Tails which integrates it already), download & install the Brave browser firstly, then open one of its "private tab proxied w/ Tor" (or private tab, then immediatly turn Tor ON)

Visit the URL dark.fail to retrieve the Tor Project .onion URL, copy/paste it on the address bar, then download the Tor executable from there

- for code requests 1) & 3), refer yourself behind a disposable email, created/used just for the purpose, instead of a personal email that already left a footprint identifying you online (you'll decide for a random login username and complex long password if prompted to). Several options of disposable email (a. is the favorite solution up to c. which is the least bothersome):
a) use the alias feature of RiseUp emails (unfortunately, RiseUp invitations are hard to get...). NB: RiseUp has a .onion URL at dark.fail
b) open a free Tutanota email ...due to the registration w/ Tor being blocked, use a Brave private tab (non-proxied w/ Tor) + VPN like a free trial at Mullvad VPN (ask for a demo request to [email protected]) or at cryptostorm ([email protected]), or at BolehVPN w/ their web form. If Tutanota rejects the VPN, switch of server(s) until it works. It's also possible Tutanota will apply a 48h hold period to clear away from abuse, before emails can be received/sent...
c) with Tor (+/- Tails or VPN), head over to Tempr.Email, which is a service that permits to RECEIVE emails temporarily (in case it ever goes down, alternatives: MyTrashMail or Mailinator but this latest one bans Tor plus is on trial)

- for code request 2), use a fake social media account. If you already own a Reddit account, create a new separate one that you'll only use once

* Once you got an invite code, launch the Tor browser, visit https://ctemplar.com/tor-onion (it's possible that CTemplar will get added to dark.fail later. In this case, start to use dark.fail instead), copy/paste the .onion URL into the address bar, then head to signup for a free/paid CTemplar email.

Same as always, choose a unique username & complex password (you can get some inspiration from a password generator but out of paranoia exceptionally, generate it yourself with your imagination, paper & pen)

During the generation of the account, you'll be invited to save the recovery codes (keys for the encryption) to retake an account after a stolen password. Printscreen the codes, open the image (with a viewer or Paint), print it on paper, then erase the image - you don't want any file in danger of robbery through an attack over internet.
NB : a CTemplar account has zero way to be recovered if the recovery codes are missed... it's the only backup available

——————————

Configuration / settings (recommended - circled in red are critical items in terms of pinpointing the security)



Notes:

- auto-save contacts of the recipients, we don't want to, in case the mailbox would be entered

- external images can come with malicious scripts, notably if loaded/opened/clicked on (same for documents attached). It can inject spy-malwares eventually. Choose to load them manually (there's a button to) only if confident about their origin.





Notes:

- setting up the 2FA will be described in full details in the next post (in 2020, some users don't know what it is good for. I've been contacted in PM for guidance so here we go)

- subjects encryption, self explanatory, cannot be configured on a Free plan but paid upgrade and anyways concerns CTemplar to CTemplar emails strictly. Processing without on the Free plan, despite the option disabled, the subject will be encrypted towards a non-CTemplar email IF you choose to encrypt the external message sent out with a password

Spoiler

Password protected emails that are not consulted by the recipient within the given expiration time will self-destruct.

- contacts encryption. Your hypothetical saved contact list will be encrypted. If an extremely unlikely prosecution would be acknowledged by CTemplar after a court order against a procedure facing the super tight icelandic laws, or if an employee of CTemplar would betray the company, nobody would know which persons you were contacting frequently or infrequently (if contact manually added, since we disabled their automatic saving once emails are sent out)
As a direct consequence, you won't be able get contact suggestions on composed emails, neither to use the search engine applied on email addresses (if your mailbox is messy full)

- attachements encryption, basically the same logic behind images encryption, more or less. Activated, the attachements will not be incorporated in the formatted email bodies received by the recipients, but isolated as files to download. You do them a service

- anti-phising helps to verify that you're not logged in at a fake CTemplar mirror site with bad intents (typically, this can happen by clicking on a top search result of a Google query, showing as an "Ads", but in reality carries a hidden redirection with a slightly twisted URL. Always check that the URL in the address bar makes sense https://ctemplar.com if you don't use Tor ...which you really SHOULD. You should use the .onion URL from dark.fail with Tor, then the anti-phishing measure likely becomes obsolete!



————————

Routine process (guidelines) :

* Each time you'll consult CTemplar, opt for their webmail behind Tor (+/- Tails or VPN if no Tails) + .onion URL on computer.
Optional at the login phase : use the built-in virtual keyboard to enter the password (and/or login) ...or at least part of it (if it sucks to type it all). That way, the pw cannot be intercepted by a keylogger installed on your computer (if under malicious attack), especially if you don't have a good anti-virus installed (i.e. BitDefender, or else)



* IF mobile apps are favoured (cannot be bypassed), well you should use a good trusted VPN (like Mullvad, at 5€ per month, paid by cash or Monero indirectly via Bitcoin), connect to it before the app is opened and until it's closed, in order to mask your IP

* If under a Free plan, a supplier of a CTB method is contacted, who doesn't have CTemplar and likely won't be adventurous to open an encrypted/passworded email (hinted to), send the mail unencrypted but do NOT write an evocative subject line cause it wouldn't be obfuscated (same with ProtonMail which NEVER encrypts subject lines).
If you purchased a Prime account and the option to "Encrypt the subject line" is enabled, then you can be not shy with another CTemplar user (beware, still NOT with an unencrypted email to non-CTemplar, it won't make a difference) !

* Although, it shouldn't be necessary (if your "account" records, on server - not the access - were handled to an authority again or other leak: all the info surrendered would be encrypted (except the subject lines eventually...) ...still, don't be a believer, delete the emails everywhere (all folders, Inbox, Sent, Outbox, Draft, Trash, etc) once done

* Similarly, if you don't use the delayed mail options, delete your whole account permanently once you completed your tasks. There will be no traces left, immediately, commenting that your mission was a success ! ;)

—————————

Useful links
- FAQ
- support : ticket or [email protected]
- Reddit for bug reports (free paid subscriptions are given away if you're active at reporting issues, as a bounty) & suggestions / feature requests (as a sticky in front of community, instead of private by mail)[/SPOILER][/SPOILER]

 

[enjolras]

TWO-FACTOR AUTHENTICATION (2FA) step-by-step procedure

Edito :

2FA is an extra layer of security applied by certain security-driven services online. Remarkably, it is very popular at the cryptocurrencies' exchanges/services to prevent coins' theft, where at times, it is even mandatory to activate, but can be found with secure email providers (CTemplar, ProtonMail) and ...many more places

It aims to set apart of the normal password, a secondary password that rotates every 30 seconds usually, normally made of 6 digits (but can vary). It requires to install a 2FA software/app on a physical device, like a mobile phone or tablet (a computer is unwise unless not remotely connected to the internet). The principle relies on the fact that this code is detained by the user only, has never leaked previously (because unique every time).

2FA is a MAJOR step towards protecting an online account, but is not foolproof. Eventually, it can be hacked if poorly implemented by the website. Since it works by comparing cycling codes on the server side to the one held physically by the person, based on a timer. In theory & practice, it could be short-circuited by a hacker if the site's security is low, or through a phishing copy of the said site, with the user mistakenly fooled, then the code entered is passed on to the real site simultaneously.
Of course, it's not meant to arrive.

There's only one single norm which is more secure than 2FA, not so frequently applied, called FIDO U2F, which works with physical keys, to plug into the device (or via airwave throuh the NFC norm, on certain mobile phones, rarely laptops) which access the site, then validate the authentication by the tap press of a button. The most famous brand of this tool is the YubiKey, can be bought most everywhere, at Amazon or eBay. But prefer to buy it at the manufacturer's website, having in mind to purchase an intact, perfectly sealed, never pirated key.
When both U2F/YubiKey is available aside 2FA, prefer to choose U2F ! (it's either one or the other, their use case don't overlap)

————————

IN PRACTICE

* There's only one 2FA app to remember : Google Authenticator, to get at the GooglePlay (Android) or AppStore (iOS), for free.
Do NOT pick other software instead, especially Authy which is often advised due to having a nicer UI and more practical to use than Google Auth (austere). Unfortunately, Authy has a quirck. It is account based, to tie to a phone number ...this is abused by hackers who call phone companies, pretending to be the SIM owner on despair, to try to get a replacement or secondary SIM, then they can accomodate Authy to recover a duplicate of your 2FA accounts on a newer device of theirs...

* Install Google Auth, if possible, on a device which is DIFFERENT than the one you access the site (CTemplar/ProtonMail) with. Why ? In the event that the device would be infiltrated, or if you were to have it stolen or lost, then your internet history could indicate the sites used, and if you got passwords pre-filled, you're doomed, both the password and 2FA will be at disposal for the stranger.
So, if you have 1 computer (for the site visited) & 1 mobile/tablet, 2 phones, or 1 phone & 1 tablet, install Google Auth on the secondary device instead of primary, the one which you don't go outside with, neither on the internet frequently or at all.
If you have only a single device all in all, well, there's no choice, proceed at installing nonetheless.
Lastly, it will be easier/quicker to enable 2FAs at sites, if you can scan the QR codes on screen or printed, with a device handled manually rather than on computer or on the same mobile device (2 ways to be defined later)

—————————

Activation of 2FA with CTemplar





The large square is the QR code. The secret key below, is an alternative to the QR code, less practical since should be typed in full (typically if your Authenticator app would be on the computer), instead of the QR code scanned by the camera of a mobile device.
>> print this screen (QR code & secret) on a piece of paper. It will be your backup to replicate the 2FA on another device (if device lost or stolen) ...if you miss the backup, you could be locked away from CTemplar forever with bad luck.
Do NOT keep an image of the backup as a file on your computer/mobile connected to internet...

Now launch Google Auth where it's installed, and find the button to scan a new QR code (the other option is to enter the secret key, skip it)

(pardon the french)


With your mobile's camera, shoot the QR code printed on paper within the frame proposed by Google Auth. A random account name will be assigned. The account can be renamed with an extra step. Pick an irrelevant label (like CT ...hinting for CTemplar, but only you know)



Almost there, head back to CTemplar, type password, and rapidly the 2FA temporary code. Validate



That's it ! From now on, at the login stage of CTemplar, on top of the traditional password, you'll be asked for a temporary 2FA code that is going to cycle every half a minute.

————————-

Anecdotal sidenotes :

* Instead of scanning the QR code, you could have instead entered manually the secret key ...but there's no point (unless, as certain time, it triggers the ability to custom name the 2FA account)



* The timer progresses until it ends, pushing for a new code, renewed. You're warned that there's little time left by the digits turning from blue to red also. Then, might as well wait for the next code.

 

[Viro_Major]

The seller B (=D) mentioned inside the PPeH is switching to CTemplar, giving him an edge about stealth & peace of mind. Get it from his Tutanota contact directly rather than through PM (distrust any non-"accredited" individual in general)

Comparison of email services

 

[Viro_Major]

By the way, those who want an invite code to register with CTemplar can contact me by PM. I'm a paid customer and therefore can grant a maximum of 3 per week...

 

[Viro_Major]

The seller B (=D) mentioned inside the PPeH is switching to CTemplar, giving him an edge about stealth & peace of mind. Get it from his Tutanota contact directly rather than through PM (distrust any non-"accredited" individual in general)

Comparison of email services
View attachment 47393

...Same for A setting up CTemplar. Soon ready.

 

[Viro_Major]

A is set up. B is upcoming next. Exit agreed to update the PPeH accordingly.

 

[Viro_Major]

SCAMMERS BEWARE
some forum lurkers are quick to react... noticed that close variations of the email that A booked and has been validated by Exit are already registered with CTemplar...

do NOT contact :
* [email protected]
* [email protected]
* [email protected]

if you do deal with these fake accounts, don't dream, you'll lose your hard-earned money! Period

 

[Viro_Major]

A is set up. B is upcoming next. Exit agreed to update the PPeH accordingly.

B is also set up
PPeH is updated

Finally super safe communications for all parties ! Relieved

 

[Viro_Major]

When communicating through CTemplar, take advantage of the fact you can program the self-destruction of the emails on both sides (sender and recipient) through a timer to set accordingly



Don't trust the third party to take this action (manual deletion) for yourself. Instead, prevent and lead the way

 

[Viro_Major]

 

[Umbrellaterm]

This literal wall of text, does it justify its content or is much of this just gibberish?
To me it's weird that an email service needs a tutorial this big.

 

[Viro_Major]

Not worth commenting, I guess

If your use is typical of a routine every day one, you don't need it. Think about what you're trying to achieve first.
Secondly, ask yourself whether or not your quest is a lonely one ? Or if there may be people risking to pay the price of your inactions ?