Re: Tor & Email?

[grarpamp <grarpamp@xxxxxxxxx>]

> We've generally suggested gmail because their bulk account creation
> process was good. It seems this is not the case any more.

What is this bulk account creation you speak of?

The session leak occurs with the non-https intro/splash/welcome
screen that appears right after new account creation. It's a minor
risk though, just change the entry link they have on the splash
page to https, change your password/sec question and log out and
back in.

> This is false. I just created a gmail account via tor without
> needing a phone number or any other information.

Hmm, you mean "just", as in today? What exit were you using?
Want to sell the account for bitcoins? Kidding :-)

I'm interested in solving and documenting the technical part of
this issue...

> I heard that many times from differen people but I cannot creat
> any gmail account without asking sms-verification about 2 or 3
> years... And tried do it many times

... as I too have tried maybe once a month for the last year or so
and have never been able to create a new account. If it's possible,
it would certainly benefit Tor users to know how to do so reliably.

I also have access to various residential dynamic pools where I can
obtain a different IP/subnet at will. It has been equally long since
I've been able to reliably create a new account via them as well.

It would be cool to map *.google.com to an exit and when someone
here has success, post the exit to see if others can test it
sucessfully. I say map, because Tor often rotates exits during the
creation process time, which can only confuse things worse.

> anti-ddos/spam/too-many-creations-from-a-single-ip-address detector
> is tripped for tor exit nodes and requires other information.

Are you referring to google search? Yes, that service pops up a
message stating that with a captcha. However, I've never seen any
such message appear when attempting to sign up for gmail.

> I just tried, and was unsuccessful in the attempt. I had to answer
> a CAPCHA (which is not a big deal) but was then confronted with a
> request to receive either a text message or a phone call. Sorry -
> that is a deal breaker.

That is exactly what occurs for me. Fill out the one page form, I
select USA as the country in the drop box, hit submit, the next
page is the phone verification, at which point I select "don't want
to give my phone" or another appropriate/true choice, put a little
complaint/suggestion in the comment box, hit submit... and give up.
It is exactly the same whether or not I supply a 'recovery' email
address, which by the way is the only optional item on the form.

> I have a fully anonymous email from gmail (about 1 yr old)
> I have had several other accounts created at gmail previous to this
> Have they changed something very recently?

About a year ago it seems. This is about the ability to create new
accounts TODAY, without using invites or phone verification.

> Why are you using GMail, then?

It is a legacy application, undergoing research for migration :)
And simply having one is still useful to play with Google's other
services in an integrated fashion.

> The link above returns nothing.

Works for me since five minutes, try kicking your Tor.
***********************************************************************
To unsubscribe, send an e-mail to majordomo@xxxxxxxxxxxxxx with
unsubscribe or-talk    in the body. http://archives.seul.org/or/talk/