12 ms·

If the leaker visits this page before opening the Tor Browser from a regular browser to copy the onion url, the whole thing is as safe as SSL as there will be a

If the leaker visits this page before opening the Tor Browser from a regular browser to copy the onion url, the whole thing is as safe as SSL as there will be a trail of the SSL connection just before the visit to SecureDrop. And they don't even explain to avoid it. OPSEC is hard.

cik 12y ago
There's this hard tradeoff that most people are willing to make, between making things more 'secure' and making things useable by the general public. I just wish that attention would be paid to the security side of things. Ultimately, we can write descriptive documentation - but getting it read and understood is hard. Cryptoparties, are again a great idea, but getting the non-technical user involved is damned hard. IMHO these things always come down to "how do we make it easy for the public, whilst keeping it REALLY secure". How does security become a general piece of education, much akin to math, or at least history?
- icebraining 12y ago
  I don't think SecureDrop is designed to be usable by the general public.
  - cik 12y ago
    I'm happy to agree with you. Equally I feel that with a (small) amount of love, it could be used by whistleblowers! To me it's almost ready for that.
glomph 12y ago
Only if they visit the page just before. Seems plausible they would read about it, set it up and then drop their documents at a later date as a default behavior. I agree it would probably be a good idea to put a warning about such a problem though.
giarc 12y ago
That's like saying John Smith went to a bank withdrew money at 1pm on Jan 1. Then the bank was robbed at 1:10 Jan 1 therefore John Smith robbed the bank. I don't think you can connect visiting the info page and the very next SecureDrop file upload.
- FiloSottile 12y ago
  It all depends on traffic. And "a group of 100 IPs including a coffee shop near NSA employee John Smith's home" is enough.
- aqme28 12y ago
  It's not about proving that John Smith robbed the bank, but raising suspicion so that he will be investigated.
  - polarix 12y ago
    The difference between a court of law and a court of force.
- hackuser 12y ago
  The threat here isn't only proof that is acceptable in court: * Your actions could put you on a shortlist of people to be more thoroughly investigated. * Your actions could tip off the people whom your information threatens; maybe they stop communicating with you (or worse) to shut off the leak. * Per the Snowden release, the NSA tracked the communications of people within something like 3 degrees of their targets. With standards that low, it's not a stretch to think someone would track everyone visiting the Washington Post's secure drop box.
- mpyne 12y ago
  A Tor user at Harvard was successfully tracked when he sent a bomb threat, since he was the only user on the Harvard LAN using Tor at the time the threat was issued. That wasn't proof, of course, but it didn't need to be proof, just a good lead for law enforcement to kick-start their investigation.
lawl 12y ago
Embed the page as iframe and scrub the referrer on every page a viewer visits. That should make it hard enough to correlate any data, I guess they have enough visitors.
- FiloSottile 12y ago
  I don't see how that would help. The threat model here, the reason to use Tor is that they could be compromised and forced to log, and through Tor they would not know the leaker's IP. You only need the two "leak at time X, IP Y loaded this page at time X-5" datapoints to break this. An embedded page is not fetched by someone else.
  - lawl 12y ago
    Either you misunderstood me, or I don't quite understand how that would not help. My suggestion is to embed an iframe to the posted URL on every page on www.washingtonpost.com. Every article, everything. I'd assume this would blast the logs enough that if you look at "time X-5" you'll have too many data points to actually make something out of it. Because everyone who reads an article on wapo will have also visited that page. So yes, that embedded page would be loaded by every single viewer of any page on washingtonpost.com. Edit: I just realized that there is a huge unfixable flaw in this approach. The request for an article in the logs will always show up shortly before the request for the SecureDrop page. Even if you would iframe a random article on the SecureDrop page too you could see from the logs that is was loaded before the actual article. Essentially rendering this thing useless :/ So... Nervermind... I guess.
    - FiloSottile 12y ago
      Ah ok, I didn't get the "on all pages" bit, sorry. I still believe it would not be enough, since such a thing could be silently disabled by WaPo if ordered to do so. The point in SecureDrop is that they could not deanonymize the source even if they tried.
      - deleted 12y ago
dheera 12y ago
Or if the submitter accidentally leaves their cell phone on en route to or while at said public location ...
xxchan 12y ago
The leaker can always visit the SSL site via Tor, which would solve the problem.
handsomeransoms 12y ago
(Securedrop dev here) This is a really good point. Unfortunately, we're "as safe as SSL" no matter what, unless the source has a separate way to verify the .onion address on the SSL-protected page. They can use the SecureDrop directory for that (and we're working on other schemes as well), but it's not automated so only a handful of very cautious sources would likely do this. I'm not sure how we could explain to avoid it - where would the explanation go? Visiting that page would be just as much of a correlation, no? It's kind of a chicken and egg problem, unless the source is already using Tor. Avoiding the "trail of the SSL connection" also suggests we should be doing something to combat website fingerprinting, which we have discussed but do not have a clear solution for yet. Our current thinking is that just visiting the landing page is not enough to prosecute a source. We can do better, and are working on it, but it's difficult.
- hackuser 12y ago
  > I'm not sure how we could explain to avoid it - where would the explanation go? You could put the instructions on pages that many people visit regularly, true security through obscurity. For example, put the instructions in abbreviated form in a box in the footer of your front page (or in the footer of every page).
- qb 12y ago
  > Unfortunately, we're "as safe as SSL" no matter what, unless the source has a separate way to verify the .onion address on the SSL-protected page. Print it in the physical newspaper. The German computer magazine c't prints their PGP key fingerprints in the masthead.
  - alex_duf 12y ago
    Clever
  - handsomeransoms 12y ago
    We've been working on this with some of our deployment partners for a while now :D Great idea! I didn't know anybody else did it, it's cool to hear about c't.
stevengg 12y ago
https://www.youtube.com/watch?v=9XaYdCdwiWU https://www.youtube.com/watch?v=9XaYdCdwiWU grugq talking about opsec
tripzilch 12y ago
Please correct me if I'm wrong but, right now, at home, I visited that site. Hardly suspicious at all, since it's on HN front page. I could write down the .onion url on a piece of paper (or just print the page, as reference) and then later follow the instructions posted there, at a semi-anonymous Internet cafe, without having to visit that page, right?
- egeozcan 12y ago
  I accidentally clicked the down arrow for your comment. Up-voted another to (somewhat) make up for this. Sorry.

cik 12y ago

There's this hard tradeoff that most people are willing to make, between making things more 'secure' and making things useable by the general public. I just wish that attention would be paid to the security side of things. Ultimately, we can write descriptive documentation - but getting it read and understood is hard. Cryptoparties, are again a great idea, but getting the non-technical user involved is damned hard. IMHO these things always come down to "how do we make it easy for the public, whilst keeping it REALLY secure". How does security become a general piece of education, much akin to math, or at least history?

icebraining 12y ago
I don't think SecureDrop is designed to be usable by the general public.
- cik 12y ago
  I'm happy to agree with you. Equally I feel that with a (small) amount of love, it could be used by whistleblowers! To me it's almost ready for that.

glomph 12y ago

Only if they visit the page just before. Seems plausible they would read about it, set it up and then drop their documents at a later date as a default behavior. I agree it would probably be a good idea to put a warning about such a problem though.

giarc 12y ago

That's like saying John Smith went to a bank withdrew money at 1pm on Jan 1. Then the bank was robbed at 1:10 Jan 1 therefore John Smith robbed the bank. I don't think you can connect visiting the info page and the very next SecureDrop file upload.

FiloSottile 12y ago
It all depends on traffic. And "a group of 100 IPs including a coffee shop near NSA employee John Smith's home" is enough.
aqme28 12y ago
It's not about proving that John Smith robbed the bank, but raising suspicion so that he will be investigated.
- polarix 12y ago
  The difference between a court of law and a court of force.
hackuser 12y ago
The threat here isn't only proof that is acceptable in court: * Your actions could put you on a shortlist of people to be more thoroughly investigated. * Your actions could tip off the people whom your information threatens; maybe they stop communicating with you (or worse) to shut off the leak. * Per the Snowden release, the NSA tracked the communications of people within something like 3 degrees of their targets. With standards that low, it's not a stretch to think someone would track everyone visiting the Washington Post's secure drop box.
mpyne 12y ago
A Tor user at Harvard was successfully tracked when he sent a bomb threat, since he was the only user on the Harvard LAN using Tor at the time the threat was issued. That wasn't proof, of course, but it didn't need to be proof, just a good lead for law enforcement to kick-start their investigation.

lawl 12y ago

Embed the page as iframe and scrub the referrer on every page a viewer visits. That should make it hard enough to correlate any data, I guess they have enough visitors.

FiloSottile 12y ago
I don't see how that would help. The threat model here, the reason to use Tor is that they could be compromised and forced to log, and through Tor they would not know the leaker's IP. You only need the two "leak at time X, IP Y loaded this page at time X-5" datapoints to break this. An embedded page is not fetched by someone else.
- lawl 12y ago
  Either you misunderstood me, or I don't quite understand how that would not help. My suggestion is to embed an iframe to the posted URL on every page on www.washingtonpost.com. Every article, everything. I'd assume this would blast the logs enough that if you look at "time X-5" you'll have too many data points to actually make something out of it. Because everyone who reads an article on wapo will have also visited that page. So yes, that embedded page would be loaded by every single viewer of any page on washingtonpost.com. Edit: I just realized that there is a huge unfixable flaw in this approach. The request for an article in the logs will always show up shortly before the request for the SecureDrop page. Even if you would iframe a random article on the SecureDrop page too you could see from the logs that is was loaded before the actual article. Essentially rendering this thing useless :/ So... Nervermind... I guess.
  - FiloSottile 12y ago
    Ah ok, I didn't get the "on all pages" bit, sorry. I still believe it would not be enough, since such a thing could be silently disabled by WaPo if ordered to do so. The point in SecureDrop is that they could not deanonymize the source even if they tried.
    - deleted 12y ago

dheera 12y ago

Or if the submitter accidentally leaves their cell phone on en route to or while at said public location ...

xxchan 12y ago

The leaker can always visit the SSL site via Tor, which would solve the problem.

handsomeransoms 12y ago

(Securedrop dev here) This is a really good point. Unfortunately, we're "as safe as SSL" no matter what, unless the source has a separate way to verify the .onion address on the SSL-protected page. They can use the SecureDrop directory for that (and we're working on other schemes as well), but it's not automated so only a handful of very cautious sources would likely do this. I'm not sure how we could explain to avoid it - where would the explanation go? Visiting that page would be just as much of a correlation, no? It's kind of a chicken and egg problem, unless the source is already using Tor. Avoiding the "trail of the SSL connection" also suggests we should be doing something to combat website fingerprinting, which we have discussed but do not have a clear solution for yet. Our current thinking is that just visiting the landing page is not enough to prosecute a source. We can do better, and are working on it, but it's difficult.

hackuser 12y ago
> I'm not sure how we could explain to avoid it - where would the explanation go? You could put the instructions on pages that many people visit regularly, true security through obscurity. For example, put the instructions in abbreviated form in a box in the footer of your front page (or in the footer of every page).
qb 12y ago
> Unfortunately, we're "as safe as SSL" no matter what, unless the source has a separate way to verify the .onion address on the SSL-protected page. Print it in the physical newspaper. The German computer magazine c't prints their PGP key fingerprints in the masthead.
- alex_duf 12y ago
  Clever
- handsomeransoms 12y ago
  We've been working on this with some of our deployment partners for a while now :D Great idea! I didn't know anybody else did it, it's cool to hear about c't.

stevengg 12y ago

https://www.youtube.com/watch?v=9XaYdCdwiWU https://www.youtube.com/watch?v=9XaYdCdwiWU grugq talking about opsec

tripzilch 12y ago

Please correct me if I'm wrong but, right now, at home, I visited that site. Hardly suspicious at all, since it's on HN front page. I could write down the .onion url on a piece of paper (or just print the page, as reference) and then later follow the instructions posted there, at a semi-anonymous Internet cafe, without having to visit that page, right?

egeozcan 12y ago
I accidentally clicked the down arrow for your comment. Up-voted another to (somewhat) make up for this. Sorry.