@securedrop@fosstodon.org
@securedrop@fosstodon.org avatar

securedrop

@securedrop@fosstodon.org

Official fediverse account for the SecureDrop project

This profile is from a federated server and may be incomplete. Browse more on the original instance.

QubesOS, to random
@QubesOS@mastodon.social avatar

Qubes OS 4.1 will receive extended security support until 2024-07-31. This security support extension is sponsored by @freedomofpress in support of the @securedrop project.

https://www.qubes-os.org/news/2024/05/10/qubes-os-4-1-to-receive-extended-support-until-2024-07-31/

securedrop,
@securedrop@fosstodon.org avatar

@QubesOS

Thanks much for making this possible. ❤️

securedrop, to opensource
@securedrop@fosstodon.org avatar

SecureDrop Workstation 0.11.0 has been released for Qubes 4.1, updating system templates to use Fedora 39:

https://securedrop.org/news/securedrop_workstation_0_11_0_released/

This update will be applied for SecureDrop Workstation users automatically when they next start SecureDrop Client.



sarahjamielewis, to random
@sarahjamielewis@mastodon.social avatar

I'm somewhat perplexed by the new SecureDrop protocol - https://securedrop.org/news/introducing-securedrop-protocol/

Specifically: "The server is “untrusted” in the sense [it] learn[s] nothing about users & messages besides what is inherently observable from its pattern of requests, and it should not have access to sensitive metadata, or sender or receiver information"

Seems like a very weak definition of "untrusted", especially when two comparison techniques explicitly attempt to restrict knowledge derived from access patterns.

securedrop,
@securedrop@fosstodon.org avatar

@sarahjamielewis Thanks for your comments, this is exactly the kind of feedback we’re hoping for with this post.

The language of "untrusted" is perhaps clumsy- we’re trying to describe a server that could potentially be deployed in a cloud environment, but it’s true it’s still privileged compared to a given internet user. And the attack scenario you raise is valid: obfuscating access patterns and detecting active attacks and dishonest servers are open problems.

securedrop,
@securedrop@fosstodon.org avatar

@sarahjamielewis As far as we know, PIR and OMR don’t address our use-case (eg, whether the OMR detector can identify returning users based on their detection key), but we’re open to feedback.

Mind if we open a GitHub ticket summarizing these concerns, particularly the server attack scenarios, and if so would you like to be attributed? Also, if you’re open to being in touch, we’d be glad to do so on any platform you prefer.

securedrop, to opensource
@securedrop@fosstodon.org avatar

Today, we’re publishing a proposed end-to-end encrypted messaging protocol for a future version of SecureDrop. Seeking feedback from cryptographers and protocol designers!

https://securedrop.org/news/introducing-securedrop-protocol/



securedrop, to random
@securedrop@fosstodon.org avatar

Today we posted an advisory describing a misconfiguration we found affecting some FPF-hosted servers, including those used to provide SecureDrop updates. It could not have been used to publish malicious updates, and we have seen no evidence of compromise:

https://securedrop.org/news/security-advisory-misconfigured-package-repository-servers-and-developer-infrastructure/

securedrop,
@securedrop@fosstodon.org avatar

For the majority of SecureDrop operators, no action is required. If you are taking special steps to hide the physical or network location of your SecureDrop servers, you should review the advisory details and decide if you need to update your configuration.

securedrop, to opensource
@securedrop@fosstodon.org avatar

Our friends at GlobaLeaks are hiring - help improve open source whistleblower tools:
https://www.globaleaks.org/get-involved/work-with-us/

securedrop, to opensource
@securedrop@fosstodon.org avatar

We're working on a novel cryptographic protocol for use in whistleblowing systems like SecureDrop - here's how and why:

https://securedrop.org/news/how-to-research-your-own-cryptography-and-survive/

securedrop, to qubesos
@securedrop@fosstodon.org avatar

SecureDrop Client 0.10.0 is out, featuring improvements to the export process, including VeraCrypt support.

https://securedrop.org/news/securedrop-client-0_10_0-released/

Part of the SecureDrop Workstation project (currently in a closed-beta pilot phase), SecureDrop Client uses @QubesOS to help journalists safely communicate with sources. General availability is planned later this year!

securedrop, to random
@securedrop@fosstodon.org avatar

SecureDrop 2.8.0 has been released. This release is focused on Tails 6 (@tails) support for journalists and administrators:

https://securedrop.org/news/securedrop-2_8_0-released/

securedrop, to random
@securedrop@fosstodon.org avatar

SecureDrop 2.8.0 is scheduled to be released on March 12. This release is focused on Tails 6 (@tails) support for journalists and administrators.

https://securedrop.org/news/securedrop-2_8_0-pre-release-announcement/

securedrop, to opensource
@securedrop@fosstodon.org avatar

What are the key components of a secure whistleblowing system? We break them down in a new blog post: https://securedrop.org/news/anatomy-of-a-whistleblowing-system/

securedrop, to random
@securedrop@fosstodon.org avatar

Roses are red
Violets are blue
SecureDrop helps whistleblowers leak safely
Thanks to people like you

Happy !

securedrop, to random
@securedrop@fosstodon.org avatar

We've recently reorganized and consolidated SecureDrop Workstation's repos to make development easier and reduce maintenance overhead. Read more here: https://securedrop.org/news/consolidating-securedrop-workstations-git-repositories-to-make-development-easier/

securedrop, to random
@securedrop@fosstodon.org avatar

If you missed this year's "State of the Drop" update at , you can watch it here:

https://youtu.be/U1-VoCguHKU?t=11141

Slides:

https://media.securedrop.org/media/documents/State_of_the_Drop_2023.pdf

securedrop, to random
@securedrop@fosstodon.org avatar

Kevin now discussing potential next-gen cryptographic protocol for SecureDrop. Need to satisfy constraints specific to SecureDrop -- whistleblower side needs to be stateless; access via Tor Browser is preferred over dedicated app.

securedrop, to random
@securedrop@fosstodon.org avatar

Kevin O'Gorman now summarizing the architecture of the SecureDrop Workstation, which uses Qubes OS (@QubesOS) to enable journalists to safely decrypt and view submissions, without having to physically move files to an air-gapped machine.

This is accomplished through the VM-based compartmentalization provided by Qubes.

Pilot has been underway since 2020. Next year, we expect to move it from pilot to general availability.

securedrop, to rust
@securedrop@fosstodon.org avatar

Big changes shipped this year include the migration from GnuPG (@GnuPG) to Sequoia (@sequoiapgp) for encryption.

Sequoia is an OpenPGP library written in (@rust). We blogged about the motivations behind the migration here:

https://securedrop.org/news/migrating-securedrops-pgp-backend-from-gnupg-to-sequoia/

securedrop, (edited ) to random
@securedrop@fosstodon.org avatar

The more than 70 orgs using SecureDrop range in size from large media orgs like The Guardian, to specialized orgs like Whistleblower Aid or the Organized Crime and Corruption Reporting Project (@OCCRP).

securedrop,
@securedrop@fosstodon.org avatar

@Orca Thanks, edited.

securedrop, to random
@securedrop@fosstodon.org avatar

@LisaRein is taking a moment to honor Pentagon Papers whistleblower Daniel Ellsberg, who died earlier this year.

In the 1970s, Dan had to skillfully leak information about the Vietnam War to multiple newspapers. No system like SecureDrop existed, of course. He said to Lisa that if he were to leak the Pentagon Papers today, he would have done it through SecureDrop.

securedrop, to random
@securedrop@fosstodon.org avatar

This year's "State of the Drop" is now streaming live at , here:

https://www.youtube.com/watch?v=U1-VoCguHKU

securedrop, to random
@securedrop@fosstodon.org avatar

@pluralistic is now speaking at about antitrust and interoperability.

Streaming live here:
https://www.youtube.com/watch?v=U1-VoCguHKU

securedrop, to random
@securedrop@fosstodon.org avatar

This year's "State of the Drop" presentation about the year (and decade) in SecureDrop will be streamed live at today, starting at 1:30 PM pacific time (9:30 PM UTC).

The event itself is starting right now, here:

https://www.youtube.com/watch?v=U1-VoCguHKU

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • provamag3
  • kavyap
  • DreamBathrooms
  • InstantRegret
  • magazineikmin
  • thenastyranch
  • ngwrru68w68
  • Youngstown
  • everett
  • slotface
  • rosin
  • ethstaker
  • Durango
  • GTA5RPClips
  • megavids
  • cubers
  • modclub
  • mdbf
  • khanakhh
  • vwfavf
  • osvaldo12
  • cisconetworking
  • tester
  • Leos
  • tacticalgear
  • anitta
  • normalnudes
  • JUstTest
  • All magazines
    •