securedrop

Strongbox was developed by Aaron Swartz, Kevin Poulsen and the New Yorker and then later open-sourced as SecureDrop.

The linked page describes their use of SecureDrop[0], which is only accessable via tor, for folks submitting tips, leaks, and another sensitive information.

After all, the same software that powers pinkmeth.com also powers SecureDrop; the technology can't tell your intentions.

So my current idea would be to randomly generate the actual /securedrop path in a non-predictable matter per client.

Does anyone know whethe SecureDrop has ever been successfully used by journalists, and if there are any feedback about it?

Hell, feature it as part of a story announcing SecureDrop the first time you print it.

Which might work if you force them to click a link on the main-page to get to the SecureDrop page.

But if they go directly to /securedrop it will fail again because the GET /securedrop will show up as the first request from that IP, giving away that the visit was intentional.

The point in SecureDrop is that they could not deanonymize the source even if they tried.

If all Post correspondents used SecureDrop to submit their stories that would be a start.

But for this to be useful you'd still need to instruct sources to randomly browse the page before going to SecureDrop.

For legal and security reasons, we require every organization to deploy their own SecureDrop instance on dedicated hardware.

We do not offer SecureDrop "as a service".

(Securedrop dev here) We often suggest ideas like this to deployment operators, and others as well.

(Securedrop dev) That's not an implicit encouragement, despite it being your interpretation.

(Securedrop dev here) This is a really good point.