RISEUP tutorial

*************************************************************************************
Privacy Tips: Operations Security Comments for Beginners

        Hello my friends, you've reached the most secret, sacred place in the world!
        Feel free to invite your friends to improve this pad or ask anything in chat.

                                                Last edit: 2018-03-12T06:30:00Z
                                                (periodically touch this in case of
                                                 deletion of pad for 30-day inactivity)
*************************************************************************************

----------------------
General Recommendation
----------------------

Terminology

[Privacy](https://en.wikipedia.org/wiki/Security)
        Privacy is the ability of an individual or group to seclude themselves, or information about themselves, and thereby express themselves selectively.
[Security](https://en.wikipedia.org/wiki/Privacy)
        Security is freedom from, or resilience against, potential harm (or other unwanted coercive change) from external forces.

Can you distinguish Privacy from Security? Let's do a small test.
Imagine you have a budget computer. (We only focus on data at rest and data in transit) Inside its hard drive you got a pre-installed Operating System - of course you are givin full permission of the OS. It is connected to the network too. Consider the following:
        Q1. How do you protect your *privacy* while interacting with computers? Please demonstrate it on this budget computer.
        Q2. What can you do to *secure* this budget computer (physically, or through the OS abstract layer; you have many choices.)?
        (Answers to Q1,Q2 is located at the very end of this document.)
Assume your budget computer is stolen somehow, base on your action in Q1, can you still ensure no data leak is occurred? Think again from an attacker's view.


Preface

Riseup.net help pages have a great explaination, and decompose the concept "security" down into four aspects: https://riseup.net/en/security Another link https://we.riseup.net/riseuphelp+en/email is more focused on anonymity than privacy, but it gets you on the right track.

For privacy most important think is to not share too many personal details. And for more sensitive topics where you can get exposed to larger audience, trolls, evil kids, malicious hackers, political opponents, or anything controversial its best to use new fresh internet persona that cant be linked to your real ID or other internet persona.

Using same nick on all pages/platforms is not best idea (unless you use it as a brand, but then privacy is not your concern since you want to spread your brand) since your nick can be tracked all over internet and people can get quite good picture about your interests and traits from that. Its best to use nicks that return thousands of google results (famous ple, common objects, titles of books/songs/movies, popular phrases) than to use some unique string that only you use and all google results are links with your content. Also change your persona every few years or use new one for different fields, so that links with your posts dont start accumulating on top if you sort google results by time.


Mistake

There are many mistakes beginners do, and in OPSec the slightest mistake can compromise everything.

        Always use Tor.

        Create new email with new username you haven't used anywhere before, and new secure password you haven't used anywhere before.

        Never send email to or from any of your other email accounts (Disagree, IMHO it's fine to treat your other email accounts as if they are your friends account, i.e. for obfuscation), don't use them for recovery email either.

        Never log into your new accounts from your regular IP, always use only Tor (or VPN or open proxy but dont use same VPN for private email too).

        Never talk about anything personal on new anonymous accounts, any personal data can be later used to deanonymize you.

        Never mention, use or link your new account on any social media or forum; dont put it in any address book. Be very carefull to not contaminate your new email with anything from your previous internet activities.

        For encryption of emails, learn how to use PGP (I can make some tutorials or provide links later).

        Its very important that you NEVER contaminate your new internet persona with any of your previous emails, nickanmes, accounts, I3Ps. Its equally important that even passwords need to be different.

        Some email providers like email.com and Yahoo! show senders computer IP in email header which exposes you geographical location. SMTP's HELO/EHLO directives contains NAT IP, Thunderbird does this. This can in some cases (specific NAT settings) also be used to identify sender. Do some tests to figure out if your provider also does that. Make another throwaway account and send few emails to it. Check header of recieved emails, check all "Received: from" lines and make sure your LAN IP is not shown anywhere. Avoid email clients if they aren't set up correctly.

                Related Knowledge

                We are going to send telnet requests to mail servers. On modern Linux distribution with GNU inetutils installed, open your terminal: enter `telnet  sender's mail server  port', this connects if the ports(25 for Simple Mail Transfer, 465 for Message Submission over TLS, 587 for Message Submission)(https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt) aren't blocked by your ISP; you should then type `EHLO  recipient's mail server'. This is roughly what you should see:

                (the bold parts are commands you should type in)
                $ telnet mail.riseup.net 587
                Trying 198.252.153.227...
                Connected to mail.riseup.net.
                Escape character is '^]'.
                220 cotinga.riseup.net ESMTP (spam is not appreciated)
                EHLO smtp.gmail.com
                250-cotinga.riseup.net
                250-PIPELINING
                250-SIZE 25600000
                250-ETRN
                250-STARTTLS
                250-ENHANCEDSTATUSCODES
                250-8BITMIME
                250 DSN

                It's worth to mention that STARTSSL/STARTTLS falls back to cleartext transmition if the destination server doesn't support encryption while pure SSL/TLS just stop right there and throw out an exception, so StartTLS is considered harmful and shall be avoid whenever possible.

Maybe all these seem a bit overkill, but in future we can expect more hacked servers and more lists of usernames related emails, passwords, hashed passwords, birth dates; all those data can be gathered and used to analyse ones internet activity, find all his accounts, find all public posts, find all memes... XKeyscore, revealed by Snowden, is one of such databases. In future things like that will be even more advanced.


Project

Be carefull with whom you share your clernet, use proxies, VPN and/or Tor to conceal it when necessary.

        Combining Tor with a VPN:
                https://www.deepdotweb.com/jolly-rogers-security-guide-for-beginners/combining-tor-with-a-vpn
        VPN -> Tor -> Twitter -> Jail      (your ISP doesnt know you are using Tor but knows your VPN)
        Tor -> VPN -> Twitter -> Not Jail  (your ISP knows you are using Tor but not about VPN)
        Conclusion: VPN will not go to jail instead of you.

        There is a well known VPN provider named HideMyAss that previously claimed not to keep logs of its users. Unfortunately, when met with a court order from their government in the UK, they handed over evidence of a suspected hacker from an internet group LulzSec which helped lead to his arrest. The story can be found below:
                HideMyAss defends role in LulzSec hack arrest: http://www.theregister.co.uk/2011/09/26/hidemyass_lulzsec_controversy

        Want to learn more about how deep web resolving works under the hood?
                https://www.torproject.org/docs/onion-services.html.en

Even doing all this you can still be tracked based on specifics of your browser.
        Here are few pages that show how unique your browser fingerprint is:
                https://amiunique.org
                https://panopticlick.eff.org
        Make sure you browser is blocking WebRTC. Test:
                https://whoer.net
                https://browserleaks.com/webrtc
                https://www.perfect-privacy.com/webrtc-leaktest

People can make you click on an unknowingly open (hidden in html elaments of email, the so called "web bug") links that are either on servers they control or are links that log IPs of all visitors. This sort of links can be shared via chat apps or via emails. In emails if they are html it is even possible that email includes link to picture on attackers server that revelas your IP as soon as email is opened, without clicking any links. Its even possible that picture is 1px*1px big and invisible.
        Some pages that can be used:
                https://grabify.link
                https://iplogger.org
                http://www.blasze.com
                http://www.vbooter.org
                http://whatstheirip.com
        Links can be combined with link shorteners like
                https://bitly.com/
                https://goo.gl/

You can search for your leaked usernames and passwords on few XKeyscore similar free tools available to anybody.
        Lists of leaked emails where you can check how many times your email/username have been hacked:
                https://hacked-emails.com
                https://haveibeenpwned.com
                https://www.leakedsource.com
                http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks
        Pages where you can check if your username is available on multiple other pages show how easy it is to follow certain username across internet:
                https://namechk.com
                http://checkusernames.com
                https://www.namecheckr.com
                http://knowem.com/checkusernames.php


Link

Best way to learn good OPSec is reading how some hackers were cought. Knowing their mistakes and avoiding making them for yourself is best thing one can do.
        #HITB2012KUL D1T3 - The Grugq - OPSEC: Because Jail is for wuftp
                https://www.youtube.com/watch?v=9XaYdCdwiWU
        Very good OPSec presentation
                http://www.slideshare.net/grugq/opsec-for-hackers
        Doxing of one of admins of hillarys email server on 8chan;
        His mistake was that he used his personal reddit account to ask for help how to alter addresses in emails.
                https://archive.fo/wbpLg
        "namshub" BacktraceSecurity Table with information gathered on anonymous IRC members
                https://www.scribd.com/document/55381908/namshub
        The 'one tiny slip' that put LulzSec chief Sabu in the FBI's pocket
                http://www.theregister.co.uk/2012/03/07/lulzsec_takedown_analysis
        3 ways to get busted on the dark web
                https://nakedsecurity.sophos.com/2015/09/04/3-ways-to-get-busted-on-the-dark-web
        Everything the Silk Road Founder William Ulbricht AKA, Dread Pirate Robert Did to Get Caught
                https://motherboard.vice.com/blog/everything-the-silk-road-founder-did-to-get-caught
        Funny article about security
                This World of Ours James Mickens: https://www.usenix.org/system/files/1401_08-12_mickens.pdf
        Legal papers exposing how one moderator of some darkent market got caught. OPSec lesson! : DarkNetMarkets
                https://www.reddit.com/r/DarkNetMarkets/comments/72ws9e/legal_papers_exposing_how_one_moderator_of_some
        US Indicts Russian Hacker Allegedly Behind Dropbox, LinkedIn Breaches
                https://motherboard.vice.com/read/hacker-allegedly-behind-linkedin-breach-also-indicted-for-dropbox-hack

Opening microsoft excel, word or even PDFs can expose your IP (If you cannot disconnect from the Internet, the best way to prevent all potential leaks is to install a software/hardware firewall and set rules manually):
        https://www.thedailybeast.com/this-is-how-cops-trick-dark-web-drug-dealers-into-unmasking-themselves
        https://www.reddit.com/r/DarkNetMarkets/comments/6oix7d/hansas_newest_feature_was_a_vendorlocktimetxxlsx
        http://www.independent.co.uk/life-style/gadgets-and-tech/news/dark-web-us-government-alphabay-hansa-marketplace-down-not-working-offline-shutdown-a7851321.html

Information on email specification:
        https://tools.ietf.org/html/rfc5322 (This is the newest, RFC 822 is really really obsoleted)

Useful documentation for determining scam or phishing emails:
        http://squirrelmail.org/docs/user/user.html#toc3.1 (Check each `Received' header from the bottom up)



--------
Password
--------

Do not (try to) memorize passwords, instead, use generators. There are basically two kinds of password generator:

        Password manager   : They use CSPRNG^[1] to generate passwords and since the passwords are not computed you'll
                             need space to store them. Backuping password database is a tough job. Software: KeePass

        Stateless generator: You need a master password as one of the input, plus mnemonic symbols, then the two inputs is run
                             through a hash function, the outcome is the password. ^[2] No storage needed. BUT, if the generated
                             password is compromised, you have to reconsider the symbol that will be used to generate a new one;
                             I'm getting paranoid with this flaw inherently come with the stateless generator. Software: LessPass

Footnote:

        [1] CSPRNG: Cryptographically secure pseudo-random number generator

        [2] Flow: argon2(hash_function)['aaaaaA@2'(master_password)+'riseup.net'(mnemonic_symbol)]
                                -> mapping_printable_character() -> '1hHdp?Rf'(password_generated

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

I have some stupid bash scripts that I personally use for generating passwords, gonna
paste them below (Reference: https://en.wikipedia.org/wiki/Random_password_generator):

        1. dwgen.sh

        #!/usr/bin/env bash

        # The below three hardcoded EFF wordlists are available at
        # https://www.eff.org/deeplinks/2016/07/new-wordlists-random-passphrases.
        # Once you have got those three files, place them as follow:
        #
        # $ tree -a diceware
        # arbitrary-folder
        # |-- this-script
        # `-- dict
        #     |-- eff_large_wordlist.txt
        #     |-- eff_short_wordlist_1.txt
        #     `-- eff_short_wordlist_2_0.txt
        #
        # 1 directory, 4 files

        case $1 in
                '-L'  | '--large' )
                        dict=eff_large_wordlist.txt && head=5
                        ;;
                '-S'  | '--short' )
                        dict=eff_short_wordlist_1.txt && head=4
                        ;;
                '-S2' | '--short2' )
                        dict=eff_short_wordlist_2_0.txt && head=4
                        ;;
                * )
                        cat <<-EOF

                        Diceware(TM) Generator, version rel.ver.patch
                        (GNU version of bash, grep, sed and coreutils
                        are mandatory for this script to run.)

                        Copyright (C) $(date +%Y) Cryptonymous
                        License GPLv3+: GNU GPL version 3 or later
                        <http://gnu.org/licenses/gpl.html>

                        One monkey is sitting in front of the typewriter,
                        let's see whether it could type up the complete
                        works of William Shakespeare. - That's you, faggot!

                        Description: Generate passphrase, one per line.

                        Usage: $0 [wordlist] [word] [passphrase]

                        [wordlist]
                                -L , --large            Use EFF large wordlist;
                                -S , --short            Use EFF general short wordlist;
                                -S2, --short2           Likewise, but with words that hav-
                                                        e unique three-character prefixes.

                        [word]
                                {1,2,...,INT_MAX}       This many word(s).

                        [passphrase]
                                {1,2,...,INT_MAX}       This many passphrase(s).

                        EOF
                        exit 1
                        ;;
        esac

        word=${2:-6}
        phrase=${3:-1}
        prng=/dev/urandom
        word_all=$[$word*$phrase]

        for (( i = 0; i < $word_all; i++ )); do
                dice_num=$(tr -cd '1-6' <"$prng" | head -c $head)
                dice_all=$(grep $dice_num "${0%/*}/dict/$dict")
                dice_word=$(sed -E "s/^$dice_num\s//" <<<"$dice_all")
                printf '%s' "${dice_word^}"
                [[ $[$[i+1]%$word] -eq 0 ]] && printf '\n'
        done

        exit 0


        2. ~/.bashrc

        # Description: Print out passwords in batches using all printable chars.
        # Usage:       pwgen2 [character#] [password#]
        # Hack:        Simply change '[:graph:]' to '[:alnum:]' to get an `idgen';
        #              for advanced input control, see `man tr'.

        pwgen2 () { LC_ALL=C tr -cd [:graph:] </dev/urandom | head -c $[$1*$2] | grep -Eao .{$1} }



-------------------------------
Email provider and self-hosting
-------------------------------

General

Make sure to check each one carefully, check some reviews and reccomendations you can find on other sites, and decide which one to use. I suggest you use more than one for redundancy, so that in case you lose account for whatever reason you have backup email already set and your contacts already have adress of that one too.

Those free, private, anonymous email providers are not reliable. Use two emails, from two different providers for initial contact with every new person. In case one email provider goes down, you still have second email where you can contact same person. (Just make sure you aren't sending passwords for one email account to another since in that case, once one is compromised second one is too)

There's better choice on email solution:

        You can buy your own domain using for email, if you do so, nobody(except ICANN) can take over your email address unless your domain's expired;

        You park your domain on any email hosting service or you build email server yourselves. ESP can go down without notice, in which case you should be prepared, simply change the domain's MX records and move for another ESP - this procedure is painless, may only result in email not reaching your address for up to 24hrs(a Time-To-Live value of 86400) This depends on (recursive) DNS cache, if you had set TTL to 300(s) beforehand, then you can say that you are almost unaffected;

        For the maximum flexability to set up a catch-all address to bounce all emails that are sent to non-exsist address of your domain to that address. That's cool because whenever you need to register sites you don't trust, you can make an throw-away address with which you can fill in the registration form;

        Some mail servers its MTA(Message Transfer Agent) can be configured to support sub-addressing (https://en.wikipedia.org/wiki/Email_address#Subaddressing, like Postfix), means that all emails sent to username[delimer]suffix@domain.tld will be delivered - by MDA(Message Delivery Agent) - directly into the INBOX username@domain.tld, so once you are seeing a funny marketing email in your Spam folder you are able to trace back easily. In reality, however, most scenarios are that spammers grab your address and filter that through a regular expression, thus getting your real username@domain.tld.

How to communicate with a person you have never met securely:

        Confirm each other's public key fingerprint in proper ways (offline, phone, etc), without completing this step you CANNOT move on further;

        Using asymmetric crypto, you should agree with a shared password and cipher (symmetric crypto), e.g. password='aaaaaA@2', cipher='AES-256';

        You have successfully negotiated a secure connection! Keep in mind the word `secure' do not mean `trustworthy', if that person is bad, nothing is changed;

        Above I explained the basic schema of modern approach used in communication around the world, its varieties OpenPGP, S/MIME and SSL/TLS are used for different purposes, and fortunately these schemas already have respective open source implementation, e.g. GnuPG for OpenPGP(gpg) and S/MIME(gpgsm), OpenSSL for SSL/TLS(there used to be some misunderstanding, actually OpenSSL is a common provider of TLS libraries; the others are MS's one and GnuTLS); Those do not have standardization document (IETF RFC) are not mention, like Off-the-Record Messaging for XMPP (although OTR implemented its Forward Secrecy and Deniable Authentication).

        For one-way anonymous contact maybe chaining two or more cypherpunk remailers (Type I) is enough? Check the Remailer section below for details.


Clearnet

In general I suggest using sigaint.org or sigaintevyh2rzvw.onion (defunct: https://en.wikipedia.org/wiki/SIGAINT)

I am currently liking https://cock.li I like how cock.li admin Vincent handled situation when some of his servers were seized due to some bogus bomb threats. Also they have few funny domains like @dicksinmyan.us and @national.shitposting.agency... Yeah you can download the entire https://cock.li/transparency using `wget -rk -np https://cock.li/transparency/' and browse them, especially those funny subpoena callings.

There are also good alternatives:
        https://tutanota.com
        https://mail.teknik.io
        https://www.msgsafe.io
        https://protonmail.com
        https://scryptmail.com
        https://www.hushmail.com
        https://www.safe-mail.net
        https://www.autistici.org/en/services.html
        Some reccomendations from Riseup: https://riseup.net/en/security/resources/radical-servers

/!\ Caution: Keep an eye on [Mailfence](https://mailfence.com) as I suspect that it's a shadow company. How comes? Well, I once found a website which claims to provide email service, and I immediately noticed its website's style is incredibly similar to the one Mailfence has. It's exactly a clone LOL. I don't remember the URL, but its domain is end with ".be"(Belgium TLD); and that Mailfence is also a Belgium company. I think there's some kind of relationship between the two. :hmm:

I have seen people use Israel based https://www.safe-mail.net

New thing I found: anyone heard of https://unseen.is ?
^ Unseen - Unseen.is secure chat, calling, and email ^
Private and Secure. Messaging, Calling, Email and Hosting From Iceland.

And I was recently reading about some new system: https://www.mailpile.is, never tried it but it looks like you have your own personal mail client on your box, so you dont have to trust your email provider that they really do what they claim they do. However this only make sense if your provider has opened POP/IMAP and SMTP ports... By the way, what about RainLoop? It's a not-that-old(in contrast to SquirrelMail, Roundcube and Horde) webmail client shipped with a modern UI and have native support for OpenPGP too.

Reason I suggest other providers is only because Riseup.net haven't renewed their canary recently. Which means that they are under some kind of investigation. Probably some smaller thing targeted at few specific accounts, but still be careful. There are many posts on internet abut their canary. Here is one: https://www.reddit.com/r/WhereIsAssange/comments/5p1b5a/julian_answered_my_question_today_about_the
EDIT: Canary has been updated in 2017. Everything is fine now. Although new canary is less usefull since it doesnt cover minor subpoenas and investigations.
        https://riseup.net

You have many very good suggestions regarding privacy and security on this page:
        https://www.privacytools.io

Similar link
        https://ssd.eff.org (highly recommended to have a look at it)
        https://prism-break.org/en (introduced many FLOSS software)
        https://thatoneprivacysite.net (email and VPN comparison chart)
        https://www.reddit.com/r/privacy/wiki/index (miscellaneous things)

Also to avoid using JavaScript for providers where webemail client demands it you can use Thunderbird desktop client and addon TorBirdy that redirects POP/IMAP and SMTP traffic through Tor network.


Deep Web

Reference(lots of them are dead):
        https://en.wikipedia.org/wiki/List_of_Tor_hidden_services
        https://www.reddit.com/r/emailprivacy/comments/3gf2ta/email_providers_with_onion_tor_hidden_service

Here are the email providers I know of which offer webmail access via Tor hidden servers. They are roughly organized in order of most appealing to least appealing for general use in my opinion although they are not precisely organized.

Hidden Webmail Services (sort by name in ascending alphabetical order to eliminate implicit unfairness):
        AnonInbox.net / http://ncikv3i4qfzwy2qy.onion | Paid accounts only; responsive support.
        Autistici.org / http://wi7qkxyrdpu5cmvr.onion | For anti-capitalist activists, they have a rather strong political stance - Thus it's hard to request their service account.
        BitMai.la / http://oxicsiwet42jw4h4.onion | Very low-cost, paid accounts. /u/bitmaila
        BitMessage.ch / http://bitmailendavkbec.onion | /u/AyrA_ch | built-in support. Forces Google scripts at signup; otherwise good. Onion site was under DoS and down Jan-June 2016.
        Cock.li / http://mail.cockmailwwfvrtqj.onion | JavaScript(hereinafter - JS) required (Roundcube only). Many alt-domains!
        GuerrillaMail.com / http://grrmailb3fxpjbwm.onion | Temporary, disposable addresses. JS required. Emails deleted after 24 hours.
        Lelantos.org / http://lelantoss7bcnwbv.onion | Paid accounts only; lacking support; Service is not well run.
        Mail2Tor.com / http://mail2tor2zyjdctd.onion | Unreliable service sometimes. Was unable to connect from April to May 2016.
        ProtonMail.com / https://protonirockerxow.onion | JS is required for OpenPGP.js; signup is redirected to clearnet website.
        RayServers.com / https://nmf6cg7tiyqlhsg3.onion | Paid accounts only; responsive, competent support.
        Riseup.net / http://nzh3fv6jc6jskki3.onion | For horizontal collectivists, SquirrelMail access which can be set not to use JS at all.
        SCRYPTMail.com / http://scryptmaildniwm6.onion | JS required.
        Sigaint.org / http://sigaintevyh2rzvw.onion | /u/sigaint Defunct now.
        Systemli.org / http://h2qkxasmmqdmyiov.onion | JS required (Roundcube only). Account by invite or request only. Onion address not working...
        TorBox / http://torbox3uiot6wchz.onion | 100% Tor, no clearnet.
        VFEMail.net / https://344c6kbnjnljjzlz.onion | 3rd party, clearnet JS required at signup. Many alt-domains!

History Lesson
        The first free .onion accessible email service that was widely used was tormail.net / tormail.org during 2011-2013. Tormail was taken down by the FBI because it happened to be hosted at FreedomHosting (a free .onion web host) whose server(s) the FBI seized because FH was allowing other things that were horrible (CP) to be hosted. The FBI now has full access to all the non-PGP encrypted information that was on the tormail server when they seized it, and they have used their access to that information in multiple investigations. Remember this when using such email services.



----------------------------
Email signing and encryption
----------------------------

Software

Maybe it is more appropriate to involve another solution and let you choose between
        OpenPGP: https://tools.ietf.org/html/rfc4880 (most popular among the world)
        S/MIME:  https://tools.ietf.org/html/rfc5751 (easy to deploy in companies)

Use command prompt or dedicated PGP packages: http://openpgp.org/software

Microsoft Windows
        GnuPT:      http://www.gnupt.de (site is in German)
        Java-based: http://ppgp.sourceforge.net (seems not maintained)
        GPG4USB:    http://gpg4usb.cpunk.de/index.html
        GPG4Win:    https://www.gpg4win.org
        (GPG4Win gives you wonderful experiences on Explorer's shell integration; GPGOL is
         also very helpful to those who keep sticking with the evil proprietary MS Outlook)

Apple macOS
        https://gpgtools.org
        https://www.deepdotweb.com/2015/02/20/pgp-tutorial-os-x
        http://notes.jerzygangi.com/the-best-pgp-tutorial-for-mac-os-x-ever

UNIX and derivatives
        Mutt: http://mutt.org
        ("All mail clients suck. This one just sucks less.")
        (built-in support, just copy the sample file and source it)

Multi-platform or web browser extensions

        Enigmail:   https://www.enigmail.net/index.php/en
        (Thunderbird has become less and less active developing since Dec 2015 while
         Mozilla is phasing out its own XUL/XPCOM extension framework on Firefox 57)
        (addon TorBirdy routes your traffic through Tor network)

        Mailvelope: https://www.mailvelope.com/en
        (is developed using WebExtensions API, and is ported to Chromium-based
         browsers and newer versions of Firefox; It is OpenPGP.js backended so
         that it doesn't support ECC as for now unless OpenPGP.js implements it.)


Notice

        If you find a new tool to encrypt your email, make sure that the attachment(inline MIME) is also encrypted.

        When you are composing your message some email clients (B/S or C/S) might save drafts of unencrypted emails in your folders, make sure to delete them and turn off automatic saving. Use a local mail client really... Most webmail clients are proprietary and some of which consist of crappy(why? https://www.gnu.org/philosophy/javascript-trap) JavaScript code; while even more email servers are proprietary and not audited: You can see ProtonMail and Tutanota opensource'd their webmail clients but that does not include the server-side implementation, but well, if they opensource'd their servers it's easily imagined sth like bankruptcy.

        When you are sending encrypted email, know that email subject is NOT encrypted, so dont include anything that reveals nature of content of email in email subject (example of no no subjects: "meeting at Joes bar on Friday 13" or "Hi Bob greetings from Alice", replace it with "NSA go away" or something irreleveant and deceptive). There are of course other sensitive metadata in email header that are able to reverse your identity, for example MUA(Message User Agent) string, sent time and zoneinfo(always use UTC/GMT) and encoding(always use UTF-8 for portability; one cannot split your preferrd language given only that info); Sadly email header is NOT encrypted referring to the RFC of OpenPGP Message Format.


Tutorial and Quirk

        https://wiki.archlinux.org/index.php/GnuPG (ArchWiki's always good)
        http://uncovering-cicada.wikia.com/wiki/PGP_TUTORIAL
        http://uncovering-cicada.wikia.com/wiki/PGP_and_RSA_theory
        http://uncovering-cicada.wikia.com/wiki/Verifying_PGP_signatures

        https://www.keylength.com/en/4
        https://eprint.iacr.org/2010/006.pdf
        https://gist.github.com/grugq/03167bed45e774551155
        http://world.std.com/~dtd/sign_encrypt/sign_encrypt7.html
        https://www.usenix.org/system/files/1401_08-12_mickens.pdf
        https://arstechnica.com/security/2016/12/op-ed-im-giving-up-on-pgp
        https://www.theregister.co.uk/2010/01/07/rsa_768_broken/?mt=1486963827317
        https://thehackernews.com/2014/08/cryptography-expert-pgp-encryption-is_19.html
        https://www.enisa.europa.eu/publications/algorithms-key-size-and-parameters-report-2014
        https://www.deepdotweb.com/security-tutorials/word-warning-versions-pgp-created-equally
        https://security.stackexchange.com/questions/33752/will-encrypting-the-same-file-with-gnupg-and-the-same-key-produce-the-same-ciphe



--------
Remailer
--------

Needs basic knowledge of using OpenPGP-compliant software to start off. Give it a try, send yourself an email using a remailer to observe how remailed email's header is different from the normal/regular one.

Terminology
        https://en.wikipedia.org/wiki/Anonymous_remailer
        https://www.whonix.org/wiki/Remailer
        https://www.whonix.org/wiki/Nymservers

Tutorial
        https://www.autistici.org/docs/anon/remailer
        https://en.wikipedia.org/wiki/Cypherpunk_anonymous_remailer

Useful Link
        http://www.noreply.org/echolot
        http://www.cypherpunks.to/remailers
        https://www.autistici.org/crypto/index.php/remository/Remailer-clients



----------
Stylometry
----------

29C3 - Stylometry and Online Underground Markets (EN) - YouTube
        https://www.youtube.com/watch?v=zkh7dwwfrHM

(Saluton!) Esperanto the artificial language is one of the coolest thing to learn (Kio estas tio?), it is designed that whoever uses it enjoys the equality of personality; the grammars of Esperanto rarely lead to ambiguity. You can learn Esperanto online at: https://lernu.net.

The researchers declared that every user tend to adopt his own writing style during his internet experience, peculiarity that make it identifiable. The identification is possible thanks the analysis of "function words" that are words that serve to express grammatical relationships with other words within a sentence and are strongly related the attitude or mood of the speaker.
        TheShadowBrokers and their "Russian English" is good practical example of language obfuscation
                https://twitter.com/shadowbrokerss/status/851260161020764161
                https://steemit.com/shadowbrokers/@theshadowbrokers/grammer-critics-information-vs-knowledge
        Many Russian native speakers confirmed that mistakes in TheShadowBrokers messages are not mistakes russians would make
                https://news.ycombinator.com/item?id=1406828

Miscellaneous
        https://github.com/psal/JStylo-Anonymouth
        https://events.ccc.de/congress/2012/Fahrplan/events/5230.de.html
        http://www.techfleece.com/2013/01/09/up-to-80-of-anonymous-users-can-be-identified-by-using-linguistic-software
        http://www.infosecisland.com/blogview/22846-Stylometric-analysis-to-track-anonymous-users-in-the-underground.html



Answers

Q1: Deploy full disk encryption and use a varient of SSH Tunnel for data transfer on the network.
Q2: No, absolutely you cannot HAHA. Actually *nobody* could stop one from physically manipulating (including destroying) that computer even if  you put it in a solid-rock safe, in extreme cases organ of violence forces you to hang it out (a piece of cake, yes).