[tor-talk] Are webmail providers biased against Tor?

[blobby at openmailbox.org]

On 2015-03-16 23:01, Richard Leckinger wrote:
> On 2015-03-16 11:33, Sukhbir Singh wrote:
>>> 
>>> Mike Hearn from Google addressed this issue on the tor-talk mailing 
>>> list
>>> in October 2012, where he said this:
>>> 
>>> "Access to Google accounts via Tor (or any anonymizing proxy service) 
>>> is
>>> not allowed unless you have established a track record of using those
>>> services beforehand."
>>> 
>>> (https://lists.torproject.org/pipermail/tor-talk/2012-October/025923.html)
>> 
>> The impression seems to be that Tor is ipso facto suspicious to Gmail 
>> irrespective of the exit node's location, whereas "abnormal" IPs (e.g. 
>> those from Nepal) are only suspicious if they originate from outside 
>> the usual geographical location of the user.
> 
> I can verify Hearn's (Google's) statement from my own experience at
> least. I am a long time user of the privateinternetaccess VPN. If I
> log into gmail from Germany, London, US East or US West or from home
> in New Zealand, I no longer get asked for validation when using an
> anonymous proxy. However, when I logged in via the new riseup.net VPN
> (Seattle) recently, or whenever I use an unfamiliar PIA proxy, I have
> been asked for validation.
> 
> So google is keeping track of which regions (IP ranges?) I'm coming
> from, and adjusting my profile. It took google several months to stop
> asking me if I wanted to change my default search engine country, but
> their algorithm did eventually back off.
> 
> I think 'track record' is the relevant point. Everywhere is suspicious
> until you have a track record of accessing google from there. Tor by
> design is meant to prevent any track record from developing.


Thank you for this information. The other issue is whether the 
fingerprint of the TBB raises suspicions. The website 
http://whatsmyuseragent.com shows:

Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0

I don't know if this is a common (non-TBB) string. Could this also cause 
Gmail's algorithms to request validation?

In terms of IP addresses, I would expect Gmail to object if a New 
Zealand user started to login from Nepal. My issue is whether Gmail 
should object if a New Zealand user (based in Auckland) logged in with a 
VPN or tor exit node based in Auckland.