3 ms·

So if I follow all this advice, how am I supposed to receive or send sensitive documents? > If you deal with sensitive documents like legal artifacts in immigr

So if I follow all this advice, how am I supposed to receive or send sensitive documents? > If you deal with sensitive documents like legal artifacts in immigration cases, you want to have control over which of your documents wind up in the cloud and which you retain custody over. This is incredibly easy with Dropbox or Google Drive. Everyone I know who uses these services has an intuitive knowledge for 'stuff in this folder goes in the cloud', and if they wanted to keep sensitive data off it they would know exactly how. I am on an iPad, so no mature options for encrypting it myself with pgp or something really exist. I shouldn't upload it to a cloud service (although chances are that it already is, because pretty much every iOS app uses a cloud of some sort). I shouldn't email it. I can't plug in a physical usb device because iOS doesn't have File reading access to. I guess I convince everyone to use Signal? That is pretty impractical for 'normal' people to convert everyone over to their own messaging app. Also, on your phone, what browser do you use? Chrome? Well, not really because it is all webkit under the hood, so you are going to be using Safari no matter what.

tptacek 8y ago
That's correct, we're not suggesting people use Chrome on their iOS device (but is a good question and a super common bit of feedback we got doing training for this stuff with end-users, who assumed that's what we meant). The subtext for the Chrome recommendation is "that's the browser you use on your general-purpose computer". WebKit on iOS benefits (imperfectly, but vs. a general-purpose machine it's probably a wash) from iOS's built-in application sandboxing and security controls. Regarding sharing of sensitive documents: if you have to do it over the Internet, use a secure messenger to do it. Email attachments are probably the second most dangerous attack vector facing end-users (after phishing). That's why we tell people to use Google Mail; attachments open in their browser viewer and are rendered Google-serverside. You don't need to convince everyone to use Signal; it's adequate to use WhatsApp, which, again, is already one of the most popular messaging applications in the world (this is one of the reasons getting Signal Protocol baked into WhatsApp was such a monumental achievement).

tptacek 8y ago

That's correct, we're not suggesting people use Chrome on their iOS device (but is a good question and a super common bit of feedback we got doing training for this stuff with end-users, who assumed that's what we meant). The subtext for the Chrome recommendation is "that's the browser you use on your general-purpose computer". WebKit on iOS benefits (imperfectly, but vs. a general-purpose machine it's probably a wash) from iOS's built-in application sandboxing and security controls. Regarding sharing of sensitive documents: if you have to do it over the Internet, use a secure messenger to do it. Email attachments are probably the second most dangerous attack vector facing end-users (after phishing). That's why we tell people to use Google Mail; attachments open in their browser viewer and are rendered Google-serverside. You don't need to convince everyone to use Signal; it's adequate to use WhatsApp, which, again, is already one of the most popular messaging applications in the world (this is one of the reasons getting Signal Protocol baked into WhatsApp was such a monumental achievement).