[tor-talk] General remarks when using mail clients over Tor (i.e. TorBirdy)

[tagnaq <tagnaq@xxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hi,

I'd like to give some general information on what you might run into
when using mail clients over Tor, in fact this is not specific to
email but probably applies to other authenticated services that deploy
some kind of anti-account hijacking prevention systems. Whether this
stuff actually applies to you depends on your email provider.

- - Fetching mail via Tor might triggers automated intrusion prevention
systems because you come from 'unusual locations'.
These automated systems might temporarily block your account till you
login via webmail and confirm your password/secret question.
If this is the case on a gmail account you will get an email with the
subject: 'Suspicious sign in prevented'
This might happens when trying to fetch mails over Tor for the first
few times, at least the detection mechanism at gmail seems to be
adaptive and won't bother you continuously if you use constantly use
Tor to access you mail account.
Thunderbird might shows you a clear warning indicating that a login
was denied for that specific reason. I can't remember the exact
sentence anymore, but that was the case with a gmail account. (The
warning is not generated by Thunderbird itself but rather a displayed
message received from the mailserver.)

Make sure you know the answer to your secret question (or alternative
password recovery method). Unfortunately changing gmail's password
recovery options doesn't seem to work with TBB [1].

- - Another issue that I haven't seen often with gmail but you might run
into it with other freemail providers occurs when submitting emails to
the mailserver (sending). Depending on your mail provider and exit
node the mailserver might simply deny access or resets the connection.
This usually happens when using big exit relays (torservers seems to
work fine compared to CCC exit nodes). Hitting 'Use a New Identity'
might be a workaround [2]. Or you exclude exit nodes for which email
submission doesn't work, but in that case you should have a specific
tor instance just for mail because excluding the popular exit nodes
will affect your usability (speed) and privacy.

So when having troubles using Thunderbird with Tor keep in mind that
this might be the case because one of these issues arose.

Maybe we should start a wiki page to collect experience with different
freemailers.

[1] https://trac.torproject.org/projects/tor/ticket/6191
[2] https://trac.torproject.org/projects/tor/ticket/6371
-----BEGIN PGP SIGNATURE-----

iF4EAREKAAYFAlALNXQACgkQyM26BSNOM7YXVgD+IeDd8Wr1aY0y3ISpWdTNTl32
MqL8LYMLmrqYox56yPoA/1arhuxfODfZJacqb9v4mBgI4cpL40mDd+OlTu8iUxfP
=0pSL
-----END PGP SIGNATURE-----
_______________________________________________
tor-talk mailing list
tor-talk@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk