Sharing sensitive information

Sometimes it is necessary to share sensitive information with colleges. Be it a password, location information, or just something you wouldn't want to share with the public at large there are some simple ways to keep your secret a secure.

Sharing Securely

• In person - The best way to keep something between trusted parties is to speak directly to that trusted party. For extra security do it in a noisy public space.
• Over the internet - There are a number of ways to securely transmit information online.
  • One Time Secret dot com - create a link that can only be accessed once before it is destroyed forever.

Common Mistakes

Email is not private - If you use a hosted service like Gmail you can be sure that your messages are stored in a variety of places on the host's servers. Even if your mail server is secure, your recipient's might not be! Email can also be intercepted in transit.

List Servs are not secure - List serves such as Google Groups are not a place to share sensitive information. Many lists keep public archives, plus it only takes one member of the list to compromise security. Even if all members of a list can be trusted they might not follow proper security culture, such as not reusing passwords.

See Also

• An excellent security overview on riseup.net, split into sections on human, message, and network
• A concise security resource list on riseup.net.
• https://crypto.cat / https://github.com/kaepora/cryptocat ("Alpha software: Code review highly appreciated - DO NOT TRUST WITH YOUR LIFE - NOT PEER REVIEWED OR READY FOR PRODUCTION")