Directory
SecureDrop
Whistleblower Submission
Public Intelligence
Archive of government documents and public information regarding national security, finance, international relations, government surveillance, and continuity of government operations.
Introducing SecureDrop Protocol
This blog post is a part of a series about our research toward the next generation of the SecureDrop whistleblowing …
GlobaLeaks - Free and Open-Source Whistleblowing Software
Amnesty International used it in Pakistan and Saudi Arabia, in order to facilitate and secure dialogue with the organization’s lawyers and researchers residing within these countries.
The Prosecutor Office at the International Criminal Court (ICC) used it as a secure tool for witnesses to report on international crimes of genocide, of crimes against humanity and of war crimes, in the Libya and Central African Republic II.
Introducing WEBCAT: Web-based Code Assurance and Transparency
In this post, we introduce Web-based Code Assurance and Transparency, a project that supports verifiable in-browser code for single-page browser applications. Along with this post, we are publishing the WEBCAT project repository; follow-up posts will provide more detailed information.
WEBCAT is a multicomponent project; the easiest way to explain it is to start with the end-user experience. When a user visits a website that has enrolled in WEBCAT, before the site can load the content is checked against a signed manifest to ensure that it has not been tampered with
The users we’re trying to protect are engaged in an important, potentially high-stakes activity. Whether it’s using SecureDrop, GlobaLeaks, or another browser-based encryption tool
One use case that WEBCAT supports is that of site administrators self-hosting third-party applications — the backbone of the decentralized web. Self-hosted applications (like SecureDrop!)
WEBCAT is a project that lets application developers or service providers create and update signed artifacts attesting to the code that they are shipping; site owners enroll their domains that run these applications; and end users automatically verify that the code they are served is authentic
A signing script that allows application developers to generate a signed manifest to verify the content they intend to serve to users
An enrollment server to allow site owners to enroll their website
An updater service that builds a list of trusted signers per domain
A Firefox extension, to provide the end user an in-browser integrity checking mechanism, which blocks code that fails integrity checks for enrolled websites and warns the user.
We’ll have more to say in the weeks and months to come. In the meantime, we welcome your feedback: you can write to us at <securedrop@freedom.press> (PGP-encrypted), or find us on GitHub.