5 ms·
(Securedrop dev here) This is a really good point. Unfortunately, we're "as safe as SSL" no matter what, unless the source has a separate way to verify the .oni
by handsomeransoms 12y ago
(Securedrop dev here) This is a really good point. Unfortunately, we're "as safe as SSL" no matter what, unless the source has a separate way to verify the .onion address on the SSL-protected page. They can use the SecureDrop directory for that (and we're working on other schemes as well), but it's not automated so only a handful of very cautious sources would likely do this.
I'm not sure how we could explain to avoid it - where would the explanation go? Visiting that page would be just as much of a correlation, no? It's kind of a chicken and egg problem, unless the source is already using Tor.
Avoiding the "trail of the SSL connection" also suggests we should be doing something to combat website fingerprinting, which we have discussed but do not have a clear solution for yet.
Our current thinking is that just visiting the landing page is not enough to prosecute a source. We can do better, and are working on it, but it's difficult.
- hackuser 12y ago> I'm not sure how we could explain to avoid it - where would the explanation go? You could put the instructions on pages that many people visit regularly, true security through obscurity. For example, put the instructions in abbreviated form in a box in the footer of your front page (or in the footer of every page).
- qb 12y ago> Unfortunately, we're "as safe as SSL" no matter what, unless the source has a separate way to verify the .onion address on the SSL-protected page. Print it in the physical newspaper. The German computer magazine c't prints their PGP key fingerprints in the masthead.
- alex_duf 12y agoClever
- handsomeransoms 12y agoWe've been working on this with some of our deployment partners for a while now :D Great idea! I didn't know anybody else did it, it's cool to hear about c't.
- sandstrom 12y agoA few things that may be helpful: 1. Make the entire site available under `ssl.washingtonpost.com` (ideally without the `.ssl` prefix). That way, the domain won't be as suspicious as it is right now. I suspect that this is more or less the only content hosted on the domain. 2. Include an iframe for all (or a random subset of) visitors, loading this particular url (hidden). By artificially generating traffic to the endpoint it will be harder to distinguish these from other, 'real' requests. Use a random delay for adding the iframe (otherwise the 'pairing' with the initial http request may distinguish this traffic). 3. Print the link, url and info block on the dead trees (the paper), as other has suggested. 4. Add HSTS headers (http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security)
- vhost- 12y agoAlso, if you can swing https://washingtonpost.com?page=securedrop https://washingtonpost.com?page=securedrop, the request will just look like it's to https://washingtonpost.com https://washingtonpost.com since query parameters are encrypted with ssl.
- handsomeransoms 12y agoDefinitely! The challenge is getting the news orgs to change their entire site, which often involves a lot of complex, entrenched infrastructure and sometimes involves reluctant third parties such as ad networks. We're working on a best practices guide for deployments [0]. I'll make sure these suggestions go in there. Feel free to take a look and comment if you're interested! [0] https://securedrop.hackpad.com/SecureDrop-Deployment-Best-Practices-joWSoODiV5O https://securedrop.hackpad.com/SecureDrop-Deployment-Best-Pr...
- chrisstanchak 12y agoGlad you are doing this. You should just stick this link/info in the footer of all Washington Post pages.
- handsomeransoms 12y agoGood idea, but, like many of these ideas, easier said than done.
- wmj 12y agoPrint a QR Code for SecureDrop in every issue of the newspaper. Hell, feature it as part of a story announcing SecureDrop the first time you print it. Then just print it in a consistent position with minimal explanation from then on. This may be one of the rare cases where the use of a QR Code is justified.