3

I am helping a journalist team to communicate securely with their sources.

My recommendation has been to start with Tails.

One of the things they need is Dropbox functionality over Tor: They need to share a directory with their team and another directory (possibly a subdir) with each of their sources.

It has to be safe: If an attacker gets hold of the USB drive he should not be able to access any decrypted data.

It has to be usable for journalists with limited IT-knowledge:

  • Preferably a single passphrase to open the USB drive and then everything just works.
  • A simple way of adding a team member (with full access to the dir) and a source (with full access to the subdir).

It is acceptable if one of the team members needs to stay online all the time, as long as this machine can stay in a mode that has no access to decrypted data (similar to an untrusted server).

Has any such functionality been tested to work with Tails?

Improve this question
2

4 Answers 4

Reset to default
3

A service which was designed with Tails users in mind, is OnionShare. The software allows you to select a folder or file within your local harddrive. It generates a .onion URL which you can share. When the other person enters the URL into the Tor Browser the download starts and after finishing the download OnionShare closes the service. It thus reduces the attack surface. Github has a README document which describes the service a bit more in detail. There is also an instruction of how to run it within Tails.

Improve this answer
1
  • 2
    Absolutely interesting for different situations, but does not solve the problem here.
    – Ole Tange
    Oct 12, 2015 at 15:42
1

Syncthing.net may just fit the bill:

  • No central file server
  • Multiple clients

It is uses central servers to set up the connection and the sharing. It would be even better if you could share using a hidden service with a .onion address. This way the central servers would not be needed.

Improve this answer
0

if you assume a untrusted server (and you should always do so to be on the save side) you can't use Dropbox... with it you neither know what the software does, nor have physical access to the server!

if you are asking for a general encrypted cloud-based storage you have to look for services with "client side" or "end-to-end" encryption and ideally open source (for server & client).

F(L)OSS-systems you can also setup yourself; either at a hoster (nobody needs to stay online and it's more reliable & performant) or at your own hardware (maybe accessible via Tor hidden service).

for this case i would recommend Seafile or arXshare... but they also have paid services!
or if you are storing hardly anything other than text-files also SparkleShare will be an option.

i personally use ownCloud, so i can tell you the user management can do everything (and more) you want to, BUT you have to thrust your server as the files are not stored encrypted!

there are also some commercial services with end-to-end encryption, but as they are not open source you have to thrust their software (and so i won't recommend them!): SpiderOak and Tresorit or maybe also Wuala or MEGA

Improve this answer
6
  • 1
    Tahoe LAFS is a open source alternative that you can use for this with tails. tahoe-lafs.org/pipermail/tahoe-dev/2013-August/008643.html Not as easy as dropbox, but very secure, and once it's set up it works very well. Client side encryption before upload also.
    – IAmNoone
    Jun 9, 2015 at 4:36
  • @StigAtleSteffensen tahoe-lafs.org/trac/tahoe-lafs/wiki/UseCases looks very promising. Do you know if there is a GUI to grant permissions?
    – Ole Tange
    Jun 9, 2015 at 19:40
  • there is a web gui and commandline access to it. can you elaborate on what you mean by setting permission?
    – IAmNoone
    Jun 9, 2015 at 20:38
  • @StigAtleSteffensen The journalist team lead wants to add the persons Jour1 and Jour2 to have full permission on the dir. Jour1 wants to add the person Source1 to have full permission on dir/source1, and Jour2 wants to add person Source2 to have full permission on dir/source2. The dir should work as a normal file system for all programs, but only the journalists should be able to see everything.
    – Ole Tange
    Jun 10, 2015 at 7:12
  • 1
    you also have this: securedrop.org
    – IAmNoone
    Jun 10, 2015 at 7:47
-1

I would use mega.co.nz as it has client side encryption and 50gb free. Also, it does not require any setup, just register download and install.

Ps: you will be trusting a propietary source, but its kim dotcom :)

Improve this answer
1
  • 2
    1. Kim Dotcom has disavowed Mega. 2. How do you suggest this work with Tails? We're looking for long answers that provide some explanation and context. Don't just give a one-line answer; explain why your answer is right, ideally with citations. Answers that don't include explanations may be removed.
    – Andrew Lott
    Oct 12, 2015 at 9:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .