Delivery-Date: Sat, 26 Jul 2014 03:56:46 -0400
Return-Path: <tor-talk-bounces@lists.torproject.org>
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on moria.seul.org
X-Spam-Level: 
X-Spam-Status: No, score=-4.7 required=5.0 tests=BAYES_00,DKIM_ADSP_CUSTOM_MED,
	DKIM_SIGNED,FREEMAIL_FROM,RCVD_IN_DNSWL_MED,RP_MATCHES_RCVD,T_DKIM_INVALID
	autolearn=ham version=3.3.1
X-Original-To: archiver@seul.org
Delivered-To: archiver@seul.org
Received: from eugeni.torproject.org (eugeni.torproject.org [38.229.72.13])
	(using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by khazad-dum.seul.org (Postfix) with ESMTPS id E1F071E0A07
	for <archiver@seul.org>; Sat, 26 Jul 2014 03:56:44 -0400 (EDT)
Received: from eugeni.torproject.org (localhost [127.0.0.1])
	by eugeni.torproject.org (Postfix) with ESMTP id 057F42F7EC;
	Sat, 26 Jul 2014 07:56:43 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1])
 by eugeni.torproject.org (Postfix) with ESMTP id E8B52301CB
 for <tor-talk@lists.torproject.org>; Sat, 26 Jul 2014 07:47:37 +0000 (UTC)
X-Virus-Scanned: Debian amavisd-new at eugeni.torproject.org
Received: from eugeni.torproject.org ([127.0.0.1])
 by localhost (eugeni.torproject.org [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id fjn9tDOMln10 for <tor-talk@lists.torproject.org>;
 Sat, 26 Jul 2014 07:47:37 +0000 (UTC)
Received: from mail-wg0-x234.google.com (mail-wg0-x234.google.com
 [IPv6:2a00:1450:400c:c00::234])
 (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits))
 (Client CN "smtp.gmail.com",
 Issuer "Google Internet Authority G2" (not verified))
 by eugeni.torproject.org (Postfix) with ESMTPS id A01AF2F7EC
 for <tor-talk@lists.torproject.org>; Sat, 26 Jul 2014 07:47:37 +0000 (UTC)
Received: by mail-wg0-f52.google.com with SMTP id a1so5074303wgh.11
 for <tor-talk@lists.torproject.org>; Sat, 26 Jul 2014 00:47:34 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=from:date:to:subject:message-id:references:mime-version
 :content-type:content-disposition:in-reply-to:user-agent;
 bh=QPq8ixO8xqd2/13+RjPGD41VYEsYx4F6DiAQrjJ/oiI=;
 b=oO9tWnVfiKr3fk3nB1fNzU+pYpcwowm5aVnXZlVKNDO99zHCS/2MuAybwlw4vFRO9b
 OgWHS3ox5E2U9GKkkweqq2SBJdBiwCSiE8ScOptXBlfN4nzqyAYgzwkq/AsvU0TEqi1c
 sbli/pNdpP3L2h17qscJDtr60pRgG9P+iILQNFXgG+NjnGA4JjWSCEJFVUfRN2gOnigU
 LP6mp7Qrqc/wK24t9sDtNCsZb1n7Jpm9adt7D+mn7Ct7fzpSRD3RCMgRZdoqc4uz7b5L
 yauqEAeSQOea5JefBYB0A5hgQGaNG4hDx5QU/p6HXnqtfvrnZgf5k7PsB+/D1wfsp3/Z
 yHvQ==
X-Received: by 10.194.133.1 with SMTP id oy1mr28704494wjb.87.1406360854590;
 Sat, 26 Jul 2014 00:47:34 -0700 (PDT)
Received: from localhost (masterchief1.tor.leo-unglaub.net. [79.134.235.5])
 by mx.google.com with ESMTPSA id w9sm4698021wif.12.2014.07.26.00.47.32
 for <tor-talk@lists.torproject.org>
 (version=TLSv1 cipher=RC4-SHA bits=128/128);
 Sat, 26 Jul 2014 00:47:33 -0700 (PDT)
From: Matthew Finkel <matthew.finkel@gmail.com>
X-Google-Original-From: Matthew Finkel <Matthew.Finkel@gmail.com>
Date: Sat, 26 Jul 2014 07:47:24 +0000
To: tor-talk@lists.torproject.org
Message-ID: <20140726074722.GA16694@localhost>
References: <53D16B7A.6000100@cpunk.us> <20140724203626.GS7408@moria.seul.org>
 <20140725154421.GB14229@badger>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <20140725154421.GB14229@badger>
User-Agent: Mutt/1.5.20 (2009-06-14)
Subject: Re: [tor-talk] Why does requesting for bridges by email require a
 Yahoo or Gmail address?
X-BeenThere: tor-talk@lists.torproject.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: tor-talk@lists.torproject.org
List-Id: "all discussion about theory, design,
 and development of Onion Routing" <tor-talk.lists.torproject.org>
List-Unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-talk>, 
 <mailto:tor-talk-request@lists.torproject.org?subject=unsubscribe>
List-Archive: <http://lists.torproject.org/pipermail/tor-talk/>
List-Post: <mailto:tor-talk@lists.torproject.org>
List-Help: <mailto:tor-talk-request@lists.torproject.org?subject=help>
List-Subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk>, 
 <mailto:tor-talk-request@lists.torproject.org?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: tor-talk-bounces@lists.torproject.org
Sender: "tor-talk" <tor-talk-bounces@lists.torproject.org>

On Fri, Jul 25, 2014 at 03:44:21PM +0000, obx wrote:
> > Because we need an adequately popular provider that makes it hard to
> > generate lots of addresses. Otherwise an attacker could make millions
> > of addresses and "be" millions of different people asking for bridges.
> 
> I know this is the reason, but there are still captchas, right?
> 

Yes, they do rely on captchas and phone numbers. But luckily, in the
case for gmail, the capture-difficulty is variable. This in no way
solves the problem, but it's certainly better than most alternatives.

> Also, I think this list needs to be expanded.
> 
> > (Also, it recently became clear that it would be useful for people to
> > access this provider via https, rather than http, so a network adversary
> > can't just sniff the bridge addresses off the Internet when the user
> > reads her mail.
> 
> I'm not sure if gmail is safe against this recent adversary, regardless
> of the protocol.
> 

Excluding the NSA/US Gov, I think gmail is the best
corporate-controlled service available, right now. This
opinion may change if contradictory information is released, but at
this time, for our purposes, I am happy requiring gmail.

Services like riseup are excellent, but we are abusing their systems
(a little), as well as potentially putting more work/stress/pressure on
the staff. I wish there was a way to necessitate the requirements and
rigor of riseup with the scalability of gmail. Alas, this isn't
available, as far as I know. Riseup is also special due to existing
person relationships, it's possible we can expand the whitelist to other
provides such as autistici, but it will be a more involved process.

Suggestions and help always appreciated
-- 
tor-talk mailing list - tor-talk@lists.torproject.org
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

