Now, before we discuss the methods that we can use to send files, let's talk about metadata.
So each file, whether it's an image, a PDF or a document, any digital file has metadata.
What we mean by that is it's information that is attached to the file that can reveal more information
about the file itself, such as the creator.
The program used to create this application, the time it was created and more.
Let me show you an example.
So right here I have an old picture taken with an old phone, and if I right click this picture and
view its properties and go to the image tab, as you can see, we get a lot of information about this
picture.
Now, the first few things might not look very interesting, such as the type of the image, the width
and the height.
But then if you go down, you can see the camera type, which was apple.
You can see the camera model.
You can see the date this picture was taken, the exact date with the day.
With the time.
You can even see if the flash was used or not.
Now, this is an example of a picture.
If you do the same for a document, you will see the creator, the operating system, the program used
to create it and so on.
Therefore, all of this information can be pieced together to understand what platforms you use and
work from there to de-anonymize you.
Therefore, if you want to share files anonymously, it's a really good idea to remove all of this information
to minimize the amount of information that can be used to identify you.
Now, luckily, doing this is very, very simple entails.
All you have to do is right click the file that you want to remove its metadata and click on remove
metadata.
And then right here we have a backup of the image, as you can see in here, just in case the process
could break something.
And then right here we have the image itself after clearing the metadata from it.
So right click it and go to properties now.
And if you go to the image tab, as you can see, we won't see any information related to me, to the
person that created the image.
So we don't see the phone type, the camera type and the time it was created and so on.
Now, once you have the image cleared, you're ready to share it so you can go ahead and use one of
the file sharing services that we already know on the clear net, such as Google Drive, Dropbox and
so on.
The only problem is with these services similar to many clear net services, they are not private.
They're going to log data.
They're going to track you and they're not secure.
Not only that, but the way these services work is not very private because they upload your files to
an online server or to the cloud.
So you might think, okay, I am not going to use this.
I'm going to use the email services that I showed you before because all of them allow you to send attachments,
but they suffer from the same problem.
Your file will be uploaded to a server to the cloud.
So let me show you what I mean.
Let's say David wants to send a file to John here on the right, and what they want to do is they want
to use Google, Dropbox, or even one of the email services that I showed you earlier.
So to do that, the file is going to be uploaded to the cloud, to a server owned by one of these companies.
And then John is going to download this file from the cloud.
So the end result is both David and John will have copies of the file, which is fine, but at the same
time the server used to host the file is going to have a copy of this file, which raises a number of
problems.
Anybody who has access to this server will have access to the file.
So the employees that work at that server, hackers that manage to gain access to the server and government
agencies that have some sort of an agreement with the owners of these servers.
Therefore, this method is not very private and is not good if you're sharing sensitive files.
Now, the creators of Firefox have attempted to solve this problem by offering a file sharing service
that uses end to end encryption.
So the way this will work is the file will get encrypted using code that runs on the client side.
So this is code that runs on the computer on your own local computer.
It will encrypt the file that you want to share first and only.
Then your file is uploaded to their server.
And then you share a special link that contains a decryption key with John.
John will use this link to download the file and because the link contains the decryption key, John
will be able to decrypt the file and read its content.
Now let me show you how this works so you have a better understanding of it, and then we'll discuss
the cons of this method.
So let's go back to my Tails computer and I'm going to try to share the same image that I cleaned that
has no metadata at the moment.
And keep in mind, this image is stored in my Tor browser directory because remember when we spoke about
how Tor browser is configured on tails, it can only upload and download files stored in the Tor browser
directory.
So the image is in the right place and it contains no information that can be used to identify me.
The only thing that's left to do is upload this image.
I'm going to go to my Tor browser and I'm already at the file sharing service.
I will include that link in the resources of this lecture and as you can see, it's very simple, very
easy to use.
All you have to do is click on the file that you want to upload.
You'll be at the Tor browser directory by default.
You want to pick the file that you want to share.
This is my image and we're going to click on open to start uploading it.
Now you can actually select multiple files by clicking on the plus here.
You can actually configure this file to expire after certain amount of downloads.
For example, after one download, or you can set up an expiry date so it expires after five minutes,
an hour a day or seven days.
You can also protect the file with a password by ticking this box.
So I'm going to keep everything to the default and I'm just going to click on upload.
And perfect.
As you can see, we have the download link right here so you can copy this and share it with the person
that you want them to download.
So I'm going to click on copy to copy it, and then I'm going to go on a new tab and paste the link.
Now as you can see in the link right here, this is the decryption key and this is the key needed in
order to decrypt the file so that the person that downloads it will be able to see its content unencrypted.
Without this, without this part right here, the file contains no useful information.
Therefore, even the owners of Firefox or anybody who has access to their servers will not be able to
see the contents of your file without this key.
And keep in mind, this key gets generated by code that runs on the client side, by code that runs
on your browser.
So it's not code that is running on their servers.
Therefore, they should not be able to see this key.
Now if we hit enter.
As you can see, we'll get a download page and if we click on download, it will first decrypt the file
again using code that runs on the client side on your own local computer, and then you'll be able to
download the image.
Let's just call it 20 to save and that should be downloaded.
So if we go here.
You can see we have the image which is identical to the image that we uploaded.
So that's perfect.
Now this method might seem secure and it is more private than uploading your files using Google Drive
or Dropbox and all of them.
But there are still a number of things to keep in mind.
First of all, the link contains the decryption key.
Therefore, anybody that has access to the link will be able to download your file and see its content.
Then we have the other problem Do we trust that server?
Now I know I said that the file will be encrypted before uploading it to the server and the encryption
will be done using code that runs locally so the server does not know the decryption key.
But do you really trust that this code will never change?
What if a hacker gains access to Firefox servers and modifies the way this code works so it actually
sends the key to their server or to his own server?
What if an employee that is -- off and don't like Firefox does something like that?
What about government agencies?
So again, even though encryption is used in this case, it still suffers from the same problems as
normal file sharing services because we still have to trust that server.
So the main problem that we're facing here is the way these file sharing services are implemented,
not a problem with encryption.
We will actually talk about how you can manually encrypt your files without relying on code pulled from
another server.
The main problem that we have here is our file is being stored somewhere that we do not control.
Regardless of how this file is stored, whether it's using encryption or not does not really matter.
Ideally, we want to keep our files locally and only share it in places where we have full control on.
And this is what I'm going to show you in the next lecture.
Now, one more thing to add for this service to work.
Like I said, it uses client side code to encrypt and decrypt the files.
Therefore, you need to have your security settings on low or medium to work because the client side
code that will do all of this work is JavaScript code and the high security level as we know, disables
JavaScript.
Therefore, you might not want to use a medium or standard security setting because it doesn't fit your
threat model.
So again, this will be another problem with using this service.
But in general, if you have something that is not very sensitive, then this could be a nice and quick
way to share files.