Now before we discuss the methods that we can use to send files let's talk about metadata.
So each file whether it's an image a PD f or a document any digital file has metadata what we mean by
that is it's information that is attached to the file that can reveal more information about the file
itself such as the creator the program used to create this application the time it was created and more.
Let me show you an example so right here I have an old picture of my car taken with an old phone.
And if I right click this picture and view its properties and go to the image tab as you can see we
get a lot of information about this picture.
Now the first few things might not look very interesting such as the type of the image the width and
the height but then if you go down you can see the camera type which was Apple.
You can see the camera model it was an iPhone 6.
As you can see the date this picture was taken the exact date with the date with the time.
You can even see if the flash was used or not.
Now this is an example of a picture.
If you do the same for a document you will see the creator of the operating system the program used
to create it and so on.
Therefore all of this information can be pieced together to understand what platforms you use and work
from there to the anonymize you.
Therefore if you want to share files anonymously it's a really good idea to remove all of this information
to minimize the amount of information that can be used to identify you.
Now luckily doing this is very very simple and tells all you have to do is right click the file that
you want to remove it's metadata and click on clean metadata one click on this.
It will first create a backup of the image as you can see in here just in case the process could break
something.
And then right here we have the image itself after clearing the metadata from it.
So right click it and go to properties now.
And if you go to the image tab as you can see we won't see any information related to me to the person
that created the image.
So we don't see the phone type the camera type and the time it was created.
And so one now once you have the image cleared you're ready to share it so you can go ahead and use
one of the file sharing services that we already know on the clear net such as Google Drive Dropbox
and so on.
The only problem is with these services similar to many clear net services they are not private.
They're going to log data they're going to track you and they're not secure.
Not only that but the way these services work is not very private because they upload your files to
an online server or to the cloud.
So you might think okay I'm not going to use this.
I'm going to use the e-mail services that I showed you before because all of them allow you to send
attachments but they suffer from the same problem.
Your file will be uploaded to a server to the cloud.
So let me show you what I mean.
Let's say David wants to send a file to John here on the right.
And what they want to do is they want to use Google Dropbox or even one of the e-mail services that
I showed you earlier.
So to do that the file is gonna be uploaded to the cloud to a server owned by one of these companies.
And then John is going to download this file from the cloud.
So the end result is both David and John will have copies of the file which is fine but at the same
time the server used to host the file is going to have a copy of this file which raises a number of
problems.
Anybody who has access to this server will have access to the file.
So the employees that work at that server hackers that manage to gain access to the server and government
agencies that have some sort of an agreement with the owners of the servers.
Therefore this method is not very private and is not good if you're sharing sensitive files.
Now the creators of Firefox have attempted to solve this problem by offering a file sharing service
that uses end to end encryption.
So the way this will work is the file will get encrypted using code that runs on the client side.
So this is code that runs on the computer on your own local computer.
It will encrypted file that you want to share first and only then your file is uploaded to their server
and then you share a special link that contains a decryption key with John.
John will use this link to download the file and because the link contains the decryption key John will
be able to decrypt the file and read its content.
Now let me show you how this works.
So you have a better understanding of it and then we'll discuss the cons of this method.
So let's go back to my tells computer and I'm going to try to share the same image that I cleaned.
That has no metadata at the moment.
And keep in mind this image is stored in my third browser directory because remember when we spoke about
how Tor browser is configured on tables it can only upload and download files stored in the third browser
directory.
So the image is in the right place and it contains no information that can be used to identify me.
The only thing that's left to do is upload this image.
I'm going to go to my Tor Browser and I'm already at the file sharing service offered by Firefox.
You can access it by going to send dot Firefox dot com.
I will include that link in the resources of this lecture.
And as you can see it's very simple very easy to use.
All you have to do is click on the file that you want to upload.
You'll be at the Tor Browser directory by default.
You want to pick the file that you want to share.
This is my image and we're going to click on open to start uploading it.
Now you can actually select multiple files by clicking on the plus here.
You can actually configure this file to expire after a certain amount of downloads for example after
one download or you can set up an expiry date.
So it expires after five minutes an hour a day or seven days.
You can also protect the file with a password by tick in this box.
So I'm going to keep everything to the default and I'm just going to click on upload and perfect as
you can see we have the download link right here so you can copy this and share it with the person that
you want them to download.
So I'm going to click on copy to copy it and then I'm going to go on a new tab and paste the link.
Now as you can see in the link right here this is the decryption key and this is the key needed in order
to decrypt the file so that the person that downloads it will be able to see its content unencrypted.
Without this without this part right here the file contains no useful information.
Therefore even the owners of Firefox or anybody who has access to their servers will not be able to
see the contents of your file without this key.
And keep in mind this key gets generated by code that runs on the client side by code that runs on your
browser.
So it's not code that is running on their servers.
Therefore they should not be able to see this key.
Now if we hit enter as you can see you will get a download page and click on Download it will first
decrypt the file again using code that runs on the client side on your own local computer and then you'll
be able to download the image.
Let's just call it 22 save and that should be downloaded.
So if we go here you can see we have the image which is identical to the image that we uploaded.
So that's perfect.
Now this method might seem secure and it is more private than uploading your files using Google Drive
or Dropbox and all of them.
But there are still a number of things to keep in mind.
First of all the link contains the decryption key.
Therefore anybody that has access to the link will be able to download your file and see its content.
Then we have the other problem.
Do we trust that server.
Now I know I said that the file will be encrypted before uploading it to the server and the encryption
will be done using code that runs locally so the server does not know the decryption key.
But do you really trust that this code will never change.
What if a hacker gains access to Firefox servers and modifies the way this code works.
So it actually sense the key to their server or to his own server.
What if an employee that is pissed off and don't like Firefox does something like that.
What about government agencies.
So again even though encryption is used in this case it still suffers from the same problems as normal
file sharing services because we still have to trust that server.
So the main problem that we're facing here is the way these file sharing services are implemented.
Not a problem with encryption.
We will actually talk about how you can manually encrypt your files without relying on code pulled from
another server.
The main problem that we have here is our file is being stored somewhere that we do not control regardless
of how this file is stored whether it's using encryption or not does not really matter.
Ideally we want to keep our files locally and only share it in places where we have full control on
and this is what I'm going to show you in the next lecture.
Now one more thing to add for the service to work like I said it uses client site code to encrypt and
decrypt the files.
Therefore you need to have your security settings on low or medium to work because the client's site
code that will do all of this work is javascript code and the high security level as we know disables
javascript therefore you might not want to use a medium or standard security setting because it doesn't
fit your threat model.
So again this will be another problem with using this service but in general if you have something that
is not very sensitive then this could be a nice and quick way to share files.