[tor-talk] Why does requesting for bridges by email require a Yahoo or Gmail address?

[Roger Dingledine]

On Thu, Jul 24, 2014 at 03:24:26PM -0500, Cypher wrote:
> In light of the last year of disclosures by Edward Snowden, why is Tor
> requiring that I establish an account with an email provider that is
> completely out of my control and has a general history of complying with
> law enforcement data requests? Why those two providers specically?

Because we need an adequately popular provider that makes it hard to
generate lots of addresses. Otherwise an attacker could make millions
of addresses and "be" millions of different people asking for bridges.

https://svn.torproject.org/svn/projects/design-paper/blocking.html#tth_sEc7.4

(Also, it recently became clear that it would be useful for people to
access this provider via https, rather than http, so a network adversary
can't just sniff the bridge addresses off the Internet when the user
reads her mail. And it would also be nice to not use providers that turn
their entire email databases over to the adversary, even unwittingly.
Lots of adversaries and lots of goals to manage at once here.)

--Roger