Bridges can be advertised by Email to clients. This procedure hinders anonymity as in new revelations by Das Erste. May this procedure be halted until more anonymous ways are found and/or the procedure continues with the strict warning that it is only for purposes of circumvention and anonymity can not be achieved in this fashion?
Following, please find an excerpt from Das Erste:
Users can request a bridge address via Email or on the web. The following fingerprints show two ways that XKeyscore attempts to track Tor bridge users. First, the fingerprint "
anonymizer/tor/bridge/tls" records connections to the bridges.torproject.org server. Second, in order [to] obtain the actual bridge addresses for the purpose of tracking connections to them in the future, the "microplugin" fingerprint called "
anonymizer/tor/bridge/email" extracts data from the body of the emails that the Tor Project sends to its users. [And], This code demonstrates the ease with which an XKeyscore rule can analyze the full content of intercepted connections. The fingerprint first checks every message using the "email_address" function to see if the message is to or from "[email protected]". Next, if the address matched, it uses the "email_body" function to search the full content of the Email for a particular piece of text - in this case, "https://bridges.torproject.org/". If the "email_body" function finds what it is looking for, it passes the full email text to a C++ program which extracts the bridge addresses and stores them in a database. The full content of the Email must already be intercepted before this code can analyze it.