Re: About WLAN and monitoring..

["F. Fox" <kitsune.or@xxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Michael Holstein wrote:
(snip)
| So could your web-based email if you've EVER used it from an
| identifiable location.
(snip)

I think he's looking at an observer from the local network as a threat
model. If so, such an adversary wouldn't have the benefit of knowing
what accounts are being accessed via the Web, if they go over Tor (only
an agent of the company who runs the mail service, or law enforcement
would have that benefit).

Of course, this opens up a whole new can of worms; AFAIK, Gmail is the
only major Webmail provider that can be used via SSL on the Web
interface (by starting the session with an HTTPS URL, i.e.,
https://mail.google.com ; if you don't, it'll switch to SSL only for the
~ login, but actually transmit the subsequent pages [and the email they
contain] in cleartext).

(If you've used the account outside of Tor before, Gmail would - of
course - know your identity; however, an observer on the local WLAN
would not.

Also, since actions over the lifetime of a circuit [~10min] can be
potentially linked [from what I've read], you'd want to get a new nym
after you're done with Gmail. On *nix, this can be done with a SIGHUP;
on Windows, one way is to stop and start Tor via Vidalia.)

So unless you're using that one - or using something else to protect
your content - my hypothesis in the first paragraph is not a good one to
use in practice.

- --
F. Fox: A+, Network+, Security+
Owner of Tor node "kitsune"
http://fenrisfox.livejournal.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHonnWbgkxCAzYBCMRCNOuAKCEZ6+x1axYmgjoojuU6TnxpmbxdwCdFqnc
DBHLYxGG6sCHmnUbieI0OL4=
=klPc
-----END PGP SIGNATURE-----