3

Tor doc says :

You can also get bridges by sending mail to [email protected] with the line "get bridges" by itself in the body of the mail. You'll need to send this request from a Gmail, Riseup!, or Yahoo! account, though — we only accept these providers because otherwise we make it too easy for an attacker to make a lot of email addresses and learn about all the bridges."

Can we explain why a Gmail or Yahoo account is more secure ? Gmail is under Patriot Act and has been releasing info to government agencies.

Improve this question

2 Answers 2

Reset to default
1

One important point with bridges is that they should not be easily available. Because if that happens an attacker could just retrieve the addresses and block them.

Bridges are distributed in several ways. One of them is by mail. Some mail providers make it quite easy to set up hundreds, if not thousands of addresses. So an attacker could just set up many mail addresses and send a get bridges mail. This way he learns about all bridges.

GMail, Yahoo and RiseUp make setting up lots of mail addresses considerably hard. So an attacker has to put lots of effort into this. Thatswhy the Tor Project chose those mail providers.

So the point is not more security in terms of security against mass surveillance, but keep the addresses of bridges hidden/raise the bar for the attacker.

Improve this answer
1

The methodology to get bridges by any email account as described in your question is categorically unsecure and jeopardize the anonymity of the user. For additional explanation of this issue please read this question. Does using Email to send bridges and pluggable transport bridges hinder anonymity?

Gmail, Yahoo or others does not make any difference as far as the users are concerned. Tor restrict the Email providers to put some cap on the botnet for their internal advantage.

Improve this answer
3
  • I had alreay read the suggested question (Does...). The non answered part of my question refers to " we only accept these providers because otherwise we make it too easy for an attacker to make and learn about all the bridges.", the same "objection" applies for Gmail account ? Does'n it ? And, if not, why?
    – user6548
    Commented Jan 28, 2015 at 16:26
  • @R8888S Dear R8888S, Yes it is a categorical problem. Gmail or Yahoo does not make any difference as far as the user is concerned. Tor restrict the email providers to put some cap on the botnet for their internal benefit.
    – Roya
    Commented Jan 28, 2015 at 16:35
  • @R8888S Dear R8888S, By the way I have added a new answer to that question minutes ago. tor.stackexchange.com/questions/3511/…
    – Roya
    Commented Jan 28, 2015 at 16:38

You must log in to answer this question.