-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Michael Holstein wrote: (snip) | So could your web-based email if you've EVER used it from an | identifiable location. (snip)
I think he's looking at an observer from the local network as a threat model. If so, such an adversary wouldn't have the benefit of knowing what accounts are being accessed via the Web, if they go over Tor (only an agent of the company who runs the mail service, or law enforcement would have that benefit). Of course, this opens up a whole new can of worms; AFAIK, Gmail is the only major Webmail provider that can be used via SSL on the Web interface (by starting the session with an HTTPS URL, i.e., https://mail.google.com ; if you don't, it'll switch to SSL only for the ~ login, but actually transmit the subsequent pages [and the email they contain] in cleartext). (If you've used the account outside of Tor before, Gmail would - of course - know your identity; however, an observer on the local WLAN would not. Also, since actions over the lifetime of a circuit [~10min] can be potentially linked [from what I've read], you'd want to get a new nym after you're done with Gmail. On *nix, this can be done with a SIGHUP; on Windows, one way is to stop and start Tor via Vidalia.) So unless you're using that one - or using something else to protect your content - my hypothesis in the first paragraph is not a good one to use in practice. - -- F. Fox: A+, Network+, Security+ Owner of Tor node "kitsune" http://fenrisfox.livejournal.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFHonnWbgkxCAzYBCMRCNOuAKCEZ6+x1axYmgjoojuU6TnxpmbxdwCdFqnc DBHLYxGG6sCHmnUbieI0OL4= =klPc -----END PGP SIGNATURE-----
