search

freedomofpress / securedrop

GitHub repository for the SecureDrop whistleblower platform. Do not submit tips here!
https://securedrop.org/
Other
3.62k stars 687 forks source link

Hide codename on submission page, reveal with hover #380

Closed Hainish closed 8 years ago

Hainish commented 10 years ago

On the submission page, we have the following text:

Remember! Your code name is: vivo icky dyne 13th tung dyne nil amuse

We probably want to hide this code name and only reveal it if the source wants it shown. I would see this as desirable if the source is in a public place while submitting documents, a likely scenario. Perhaps we should hide the code name unless the source hovers over it?

micahflee commented 10 years ago

Wait for me to finish #329 before working on this btw, as I'm totally changing all that html first.

Taipo commented 10 years ago

That might work. However even if for a brief second that the source reveals it to commit it to memory, it could be captured on public surveillance cameras / Google glass. Cyber cafes can also have stealth remote desktop type monitoring apps on them similar to the way lanschool works which could be catastrophic for a source. Along with using some form of CSS to hide/unhide, its probably best to discourage source from using SD in public spaces unless they really have to.

Hainish commented 10 years ago

@taipo we specifically recommend sources using SD in public spaces to mitigate the risks of traffic analysis - see https://securedrop.hackpad.com/Source-Best-Practice-Guide-qYBIyuLtQYU We also note in this document that a souce should position themselves in a public space so as to avoid being recorded. This issue will be resolved once https://github.com/freedomofpress/securedrop/pull/526 is merged

garrettr commented 9 years ago

This wasn't merged for 0.3, but I think we should merge it for 0.4 and let it bake on develop for a while to get feedback.

redshiftzero commented 8 years ago

It looks like this was implemented in #1215. Closing.