back
114 comments
I will admit that after the RIAA/youtube-dl story I felt that it confirmed my belief that it was a mistake for anyone to host anything on US based servers. This takedown with complete lack of transparency from a French provider (OVH) really proves me wrong.

Unless this is some extreme security situation/investigation where it was being used for communication between groups I can't really see this holding up in a European Court?

As an aside Guerrila Mail/ Shark Lasers was my go to service for that kind of 'subscribe this' throw-away email. Anybody has recommendations for alternatives?

OVH do have datacentres in a number of countries, a dig of guerillamail.com and WHOIS suggests they may have been hosted in Montreal, Canada.
>>> Unless this is some extreme security situation/investigation where it was being used for communication between groups I can't really see this holding up in a European Court?

I feel the need to point out that each EU country has its own judiciary system and laws. There isn't such a thing as an European court. There's are laws/agreements set at the European level that are supposed to trickle down to each country and the process is fairly complicated and messy.

It's a very strong misconception from US readers to think that there is an Europe court, like there is a supreme court or something in the US.

Without knowing the inside story, it seems like an overreaction for OVH to take down an entire service based on law enforcement requests, unless there's more to the story, which there probably is.

FWIW, DNSimple was blocked by an entire country because we adhere to our local laws in the US and we didn't take down a site that was illegal in their country. This is the Internet we have today.

10minutemail.com and anonbox.net are both good.

If I need a new service, I look at the list of temporary email services supported by the Bloody Vikings Firefox extension [1]. There are quite a few there.

[1]: https://addons.mozilla.org/en-US/firefox/addon/bloody-viking...

I don't know your use-case, or what your purpose for the throwaways are, but my solution is a domain I only use for email where *@mydomain.tld is redirected to something I read.

So when I register for hackernews I would likely just register hackernews@mydomain.tld, and if their data is ever leaked, or they sell it, I know who did it, or can block that email.

It's obviously not anonymous if that's your use-case, but it solves my issues of not wanting one email registered everywhere and eventually getting spam, and having accountability per service.

The US is a toxic jurisdiction as far as any technology is concerned. They were the ones to give us the wonderful gifts of forever Disney copyright and the DMCA.
This may be unrelated and a coincidence, but:

France has a strong and growing body of anti-terrorist legislation, and I believe that some of it prevents providers from discussing some law enforcement notices (I believe that the same also exists in the US, hence some companies disclosing that they have NOT received any such requests. So when they stop saying that, you know what's up).

8chan which was banned by USA based CNServers and Cloudflare uses Russian based : ddos-guard[.]net
This is only my personal opinion but considering how weak the European cloud market is compared to the US one, it wouldn't surprise me if European cloud providers would bend to police requests because they are already in a vulnerable position.
getnada.com has been great for me, I used to use guerrilla but it often got blacklisted on some forms getnada usually goes without issue
> I will admit that after the RIAA/youtube-dl story I felt that it confirmed my belief that it was a mistake for anyone to host anything on US based servers. This takedown with complete lack of transparency from a French provider (OVH) really proves me wrong.

There is a huge difference between these two cases. Most hosting providers in the world are not going to challenge law enforcement in their jurisdiction and will just cooperate. That's what OVH did, as everyone should have expected.

But at the same time most hosting providers in the world will oppose overreach of copyright trolls. That's what Github didn't do.

Still, if you need some minimal resilience it's never enough to rely on a single hosting provider from a single jurisdiction. Multiple different providers in different countries for frontend servers with some primitive DNS failover can easily solve this and similar problems.

I use GuerrillaMail regularly. This is a security tool. There is an absolute need for easy anonymous throwaway email addresses. Hopefully, this will be resolved quickly. Tell us how to help!
mailinator?
You can create throwaway emails pretty easily if you register a domain name, they're not quite anonymous but they're practically the same.
It takes like 30 seconds to register a GMail address. I understand it's a bit less convenient, but how often do you need a throwaway email with zero prior use?
Can someone explain why a throw-away email service such as Guerrilla Mail has to go offline as a result of law enforcement?

I understand that shady people are doing a lot of shady things with such services, but when equally shady people (criminals, terrorists, pedophiles, etc.) use platforms like Facebook or WhatsApp to commit extremely serious crimes nobody is taking Facebook or WhatsApp offline.

What is the rationale behind this?

As an old girlfriend told me: “Size matters”.

Closing Guerrilla Mail will upset us a lot but the rest of the world will ignore it. Close Whatsapp and the world will be a chaos.

For the comparison, Facebook/WhatsApp would fully cooperate with the police, if an account is identified to be some sort of fraud/terrorism/drugs, they will communicate the known identity of the user with last known IP and any information they have (under warrant).

OVH cannot do that, they only rent physical servers, they have no information about the software or the user. If the police comes knocking, the only thing that can be done is to shutdown or seize the servers.

The police must have something against some users of guerilla mail (not a surprise given the nature of the service), they probably went against the servers because they couldn't get a reply or any action from guerilla mail. I checked and found no contact information and no ownership information on their website.

It is selective application of the law. It is easy to shut down a small company without army of lawyers and infinite resources. If you don't have broad shoulders, then you need to accept that you have to follow the law. Law does not apply to large companies.
For one, Facebook is its own hosting provider. Not only do they have their own servers, they have their own datacenters and networks. There's quite literally no one to take them offline like that.
I guess it is called a double standard.
"Can someone explain why a throw-away email service such as Guerrilla Mail has to go offline as a result of law enforcement?"

It doesn't. Guerrilla Mail could very easily (and relatively cheaply) house their own infrastructure (a single 1U server ?) in their own rack and self provide their hosting.

The takedown notices would go to them. Subpoenas would go to them. They would be served and have great leeway in deciding how to respond and what information to share.

Further, placing the entire operation inside a corporate entity would insulate the owners and allow them to slow down the entire legal/notice/response process.

You do not have to rely on intermediary providers to publish your website.

Prevent destruction of evidence in an ongoing case?
Probably lack of oversight, that is, the US law enforcement systems do not have access to the information shared.

Whatsapp may not be secure and the NSA and co may be listening in. I don't believe their end-to-end encryption claim has to be accurate. And it may be end-to-end encrypted but the NSA has a master key to said encryption.

Given how there's services like Encrochat, I believe the dodgy side of society is aware of Whatsapp not being secure and are avoiding it.

WhatsApp and Facebook are tied to real identities (phone numbers, names, etc.) so while law enforcement may not know what is said they know who said it. So if they compromise one end of a conversation they can probably find all the other participants. Guerrilla Mail on the other hand did not allow for that.
Maybe they should look at hosting at 1984.is instead, as they seem to have a more robust policy in place regarding take downs:

"Unwavering loyalty to our customers and their fundamental rights is a core value of 1984, hence the name to remind us of what can happen if we fall asleep on our watch. We state that 1984 as a company and its officers will always go the extra mile to protect our customers' civil rights, including the freedom of expression, the freedom of the press, the right to anonymity and privacy. 1984 will always do everything within its legal power to inform our customers of any inquiries from any authorities, lawyers or courts into the customer's affairs that we may become aware of. It is essential that the jurisdiction that the company operates in is Iceland, where the IMMI legislation is forthcoming, making Iceland a haven for freedom of the press and freedom of expression in general." [1]

[1]: https://www.1984.is/about/

exoscale.com would be a good alternative as well
Not sure what they've been doing, but in my experience the handling of law enforcement requests by OVH is hit and miss.

So far they have always forwarded requests to us, but in some cases they shut down some of our servers if we didn't respond within a few hours.

This looks like the request was directly addressed to them and they may be legally prohibited from talking about it.

Years back I used to run a similar service (dudmail) which I eventually shutdown due to the time sink (and the unbelievable pain of trying to handle unicode in a million different languages correctly)

I was definitely a lot younger and naive back then and whilst I had intended it as mostly a way to avoid site registration email spam, until reading that wiki link I had never really thought of the potential for abuse.

I'd have to go back and look but I'm pretty sure it was running on OVH towards towards the end as well.

For those who don't know what Guerrilla Mail is: https://en.m.wikipedia.org/wiki/Guerrilla_Mail
Non-mobile link:

https://en.wikipedia.org/wiki/Guerrilla_Mail

I use them on a weekly basis :(

If a site asks a mail, enter random-6-characters@pokemail.net , in 30 seconds, go to guerrillamail.com and enter the same random 6 characters for the verification link, if any.

Thanks for helping me avoid spam

I host my temp mail https://getnada.com service @ OVH for the last 6-7 years and I hope they don't shut me down like that, They do from time to time send takedown requests to phishing attempts and other criminal activity which we take down ASAP but usually their response team is doing a good job.
If they have control over DNS, could they just move to another cloud service?
I’ve been trying for months to get OVH to take down a phishing site that targets my company and I can’t get any response whatsoever from them.
Admin of Guerrilla Mail here.

I've been hosting the site on OVH since 2016. The site hasn't changed much during this time, and I've been quite happy with their services until now.

A little bit about Guerrilla Mail: It its' first and foremost, an anti-spam solution. Nowhere on the website it says that's an "anonymous email" provider. In fact, the email sending feature prominently warned the user that their IP address would be included in the headers of the email sent. (The sending feature was not for anonymous email, but for the rare chance that a user needed to send an email from there or reply. Guerrilla Mail is mostly used for receiving)

The timeline for the suspension went like this:

On October 12th, I received what seemed like a canned message from the OVHCloud Abuse team, saying that my server was (quote) "used for a fraudulent activity" and threatening termination within 48 hours.

There was no further details about the nature of the "fraudulent activity". I've replied to the message asking to give more details.

On October 16, I've received a reply, but still no details about the specific case. They mentioned that, their quote: "the problem here is clearly, that your service is too easy to use for fraudulent and illegal activities. ", further threatening to shut down the service within 7 days "if the situation does not improve". They also suggested a list of measures that the site should take.

I've replied informing that most of measures that they suggested were already taken, plus some other measures including an anti-abuse policy that has worked well over the years.

On October 19, I received a reply, this time hinting that I should pay them for an additional service, their quote "Maybe you see an option in using a service which lets you customize the Whois-Record, so your contact details can be mentioned for abuse instead of ours.".

I've started to deeply consider such a service, but before I would take it up, I wanted to get more info about the alleged law enforcement requests they receive, that are never forwarded, so I've asked them for more information about these once again.

On November 2nd, I received a reply, but still no details about the specific case, or the rate of such requests, questions that I've asked previously were ignored. Again, they were offering the additional service, their quote "change of infra to have your own abuse contact in registry info".

At this stage I was ready to buy whatever they were offering. I've replied to the email with only two sentences "Is there someone I can speak with directly on your team? Let's do a 30 minute call and reach an understanding."

On November 4th, I received a reply notifying that the server has been suspended.

Btw, if there's anyone at OVH that wants to look at the issue, it is WTLXFRCVSG.85a1

Way back in the day when I worked for some server rental place, we had an AUP and all of that, but an internal policy: if the cops came knocking about your stuff, we were gonna shut it all down.

Basic reason is that the effort involved in such an account cost us more money than we made in dealing with it. Easier to just cut the relationship.

My bet is guerilla mail was pursued for fraud/terrorism/drug charges, it's not a stretch to guess how an anonymous email service is used by some users.

Looking at guerilla mail, there is no way to contact them and no information about who runs the service. It's a shady company with no legal information as far as anyone can tell. (nothing in the about us or the terms or service pages).

If the police wanted to investigate some users/mails, they would have to get a warrant to OVH to figure out who to contact in the first place (who runs that thing?). It's a fair guess that OVH receiving anything of that sort would shutdown the account immediately.

It's also possible that the police would purposefully shutdown the service and/or seize the servers but rather unlikely. Either way, all the roads lead to the site being dead.

Was GM generating revenue?
We were considering using OVH for a huge upcoming project, not any more.
Most people in HN use Disposable Email Address services like Guerrilla Mail almost on a daily basis to avoid companies spamming us or even worse: sell our email as PII. But bad actors also use these services to anonymize themselves and not only abuse of legit services, but commit fraudulent activities like extortion, porn revenge, identity theft... and also terrorism. I don’t know why OVH shuts down this service, but knowing in first person how laxe OVH rules are compared to other providers, it must be a serious thing. Probably they found out they could break the law (GDPR?) seriously keeping Guerrilla Mail as a customer.
This is criminal. How can they do this to us? It was a great service.
OVH added to personal shitlist of companies never to go near.

Edit: downvotes from OVH I suspect. It's perfectly rational if you read the comments about the abuse team being mostly useless. It's best to judge a company at the point something goes wrong and how it's handled not when it's going right. This is badly handled.

Any service of any importance should be run on hardware you own.

There should be nothing even slightly surprising about this. OVH is a shitty company that will let anyone do anything they want until enough complaints are made. They don't communicate.

Guerrilla Mail should colocate some servers and/or find a company that is small enough to have humans with whom they can actually communicate.