WEBVTT 00:00.750 --> 00:06.720 Now, before we discuss the methods that we can use to send files, let's talk about metadata. 00:07.320 --> 00:14.400 So each file, whether it's an image, a PDF or a document, any digital file has metadata. 00:14.430 --> 00:21.360 What we mean by that is it's information that is attached to the file that can reveal more information 00:21.360 --> 00:24.610 about the file itself, such as the creator. 00:24.630 --> 00:30.450 The program used to create this application, the time it was created, and more. 00:30.990 --> 00:32.580 Let me show you an example. 00:33.490 --> 00:40.240 So right here I have an old picture of my car taken with an old phone, and if I right click this picture 00:40.240 --> 00:41.860 and view its properties. 00:42.780 --> 00:44.730 And go to the image tab. 00:45.270 --> 00:48.850 As you can see, we get a lot of information about this picture. 00:48.870 --> 00:55.770 Now, the first few things might not look very interesting, such as the type of the image, the width 00:55.770 --> 00:56.640 and the height. 00:56.760 --> 01:00.690 But then if you go down, you can see the camera type, which was Apple. 01:00.720 --> 01:02.220 You can see the camera model. 01:02.250 --> 01:03.960 It was an iPhone six SE. 01:03.990 --> 01:09.090 You can see the date this picture was taken, the exact date with the date with the time. 01:09.510 --> 01:12.540 You can even see if the flash was used or not. 01:13.230 --> 01:15.320 Now, this is an example of a picture. 01:15.330 --> 01:20.670 If you do the same for a document, you will see the creator, the operating system, the program used 01:20.670 --> 01:22.290 to create it and so on. 01:22.680 --> 01:29.190 Therefore, all of this information can be pieced together to understand what platforms you use and 01:29.190 --> 01:31.560 work from there to anonymize you. 01:31.980 --> 01:38.790 Therefore, if you want to share files anonymously, it's a really good idea to remove all of this information, 01:38.790 --> 01:43.710 to minimize the amount of information that can be used to identify you. 01:44.010 --> 01:50.190 Now, luckily, doing this is very, very simple and tells all you have to do is right click the file 01:50.190 --> 01:52.470 that you want to remove its metadata. 01:53.440 --> 01:56.290 And click on clean metadata. 01:56.740 --> 01:58.330 One Click on this. 01:58.360 --> 02:03.670 It will first create a backup of the image, as you can see in here, just in case the process could 02:03.670 --> 02:04.620 break something. 02:04.630 --> 02:08.200 And then right here we have the image itself. 02:08.230 --> 02:11.200 After clearing the metadata from it. 02:11.200 --> 02:14.260 So right click it and go to properties now. 02:14.470 --> 02:20.830 And if you go to the image tab, as you can see, we won't see any information related to me, to the 02:20.830 --> 02:22.540 person that created the image. 02:22.540 --> 02:27.940 So we don't see the font type, the camera type and the time it was created and so on. 02:29.780 --> 02:33.060 Now, once you have the image cleared, you're ready to share it. 02:33.080 --> 02:38.900 So you can go ahead and use one of the file sharing services that we already know on the clear net, 02:38.900 --> 02:41.900 such as Google, Drive, Dropbox and so on. 02:42.110 --> 02:49.050 The only problem is with these services similar to many clear net services, they are not private. 02:49.070 --> 02:50.510 They're going to log data. 02:50.540 --> 02:51.830 They're going to track you. 02:51.830 --> 02:53.300 And they're not secure. 02:53.960 --> 03:00.800 Not only that, but the way these services work is not very private because they upload your files to 03:00.800 --> 03:03.020 an online server or to the cloud. 03:03.830 --> 03:06.740 So you might think, okay, I am not going to use this. 03:06.740 --> 03:12.440 I'm going to use the email services that I showed you before because all of them allow you to send attachments, 03:12.440 --> 03:14.710 but they suffer from the same problem. 03:14.720 --> 03:18.770 Your file will be uploaded to a server to the cloud. 03:18.890 --> 03:20.600 So let me show you what I mean. 03:21.230 --> 03:25.700 Let's say David wants to send a file to John here on the right. 03:25.760 --> 03:31.580 And what they want to do is they want to use Google, Dropbox, or even one of the email services that 03:31.580 --> 03:32.870 I showed you earlier. 03:33.110 --> 03:40.310 So to do that, the file is going to be uploaded to the cloud to a server owned by one of these companies. 03:40.580 --> 03:44.930 And then John is going to download this file from the cloud. 03:45.500 --> 03:52.640 So the end result is both David and John will have copies of the file, which is fine, but at the same 03:52.640 --> 04:00.230 time the server used to host the file is going to have a copy of this file, which raises a number of 04:00.230 --> 04:00.980 problems. 04:01.280 --> 04:05.450 Anybody who has access to this server will have access to the file. 04:05.450 --> 04:11.900 So the employees that work at that server, hackers that manage to gain access to the server, and government 04:11.900 --> 04:17.960 agencies that have some sort of an agreement with the owners of the servers. 04:18.440 --> 04:25.100 Therefore, this method is not very private and is not good if you're sharing sensitive files. 04:25.960 --> 04:33.160 Now the creators of Firefox have attempted to solve this problem by offering a file sharing service 04:33.160 --> 04:35.530 that uses end to end encryption. 04:36.100 --> 04:43.310 So the way this will work is the file will get encrypted using code that runs on the client side. 04:43.330 --> 04:48.770 So this is code that runs on the computer on your own local computer. 04:48.790 --> 04:55.720 It will encrypt the file that you want to share first, and only then your file is uploaded to their 04:55.720 --> 05:02.920 server and then you share a special link that contains a decryption key with John. 05:03.100 --> 05:09.940 John will use this link to download the file and because the link contains the decryption key, John 05:09.940 --> 05:13.330 will be able to decrypt the file and read its content. 05:13.810 --> 05:19.570 Now let me show you how this works so you have a better understanding of it, and then we'll discuss 05:19.570 --> 05:21.370 the cons of this method. 05:22.000 --> 05:28.360 So let's go back to my Thales computer, and I'm going to try to share the same image that I cleaned 05:28.360 --> 05:30.670 that has no metadata at the moment. 05:30.760 --> 05:36.730 And keep in mind, this image is stored in my Tor browser directory, because remember when we spoke 05:36.730 --> 05:44.050 about how Tor browser is configured on tails, it can only upload and download files stored in the Tor 05:44.050 --> 05:45.310 browser directory. 05:45.790 --> 05:52.210 So the image is in the right place and it contains no information that can be used to identify me. 05:52.240 --> 05:55.720 The only thing that's left to do is upload this image. 05:56.110 --> 06:02.750 I'm going to go to my Tor browser and I'm already at the file sharing service offered by Firefox. 06:02.770 --> 06:07.100 You can access it by going to send dot firefox dot com. 06:07.120 --> 06:10.300 I will include that link in the resources of this lecture. 06:10.450 --> 06:13.580 And as you can see, it's very simple, very easy to use. 06:13.600 --> 06:17.230 All you have to do is click on the file that you want to upload. 06:17.620 --> 06:21.110 You'll be at the Tor browser directory by default. 06:21.130 --> 06:23.730 You want to pick the file that you want to share. 06:23.740 --> 06:28.270 This is my image and we're going to click on Open to start uploading it. 06:29.120 --> 06:33.200 Now you can actually select multiple files by clicking on the plus here. 06:33.350 --> 06:39.680 You can actually configure this file to expire after certain amount of downloads, for example, after 06:39.680 --> 06:40.570 one download. 06:40.580 --> 06:42.620 Or you can set up an expiry date. 06:42.620 --> 06:47.060 So it expires after 5 minutes, an hour, a day or seven days. 06:47.750 --> 06:51.710 You can also protect the file with a password by ticking this box. 06:52.040 --> 06:55.670 So I'm going to keep everything to the default and I'm just going to click on upload. 06:56.970 --> 06:57.750 And perfect. 06:57.750 --> 07:04.020 As you can see, we have the download link right here so you can copy this and share it with the person 07:04.020 --> 07:05.490 that you want them to download. 07:05.490 --> 07:12.030 So I'm going to click on copy to copy it, and then I'm going to go on a new tab and paste the link. 07:12.750 --> 07:19.710 Now, as you can see in the link right here, this is the decryption key and this is the key needed 07:19.710 --> 07:27.240 in order to decrypt the file so that the person that downloads it will be able to see its content unencrypted 07:27.510 --> 07:33.480 without this without this part right here, the file contains no useful information. 07:33.480 --> 07:40.440 Therefore, even the owners of Firefox or anybody who has access to their servers will not be able to 07:40.440 --> 07:43.590 see the contents of your file without this key. 07:43.710 --> 07:50.100 And keep in mind, this key gets generated by code that runs on the client side, by code that runs 07:50.100 --> 07:51.120 on your browser. 07:51.120 --> 07:57.240 So it's not code that is running on their servers, therefore they should not be able to see this key. 07:57.660 --> 07:59.490 Now if we hit Enter. 08:00.360 --> 08:07.050 As you can see, we'll get a download page and if we click on download it will first decrypt the file 08:07.050 --> 08:13.290 again using code that runs on the client side on your own local computer, and then you'll be able to 08:13.290 --> 08:14.700 download the image. 08:14.910 --> 08:20.700 Let's just call it 22 save and that should be downloaded. 08:20.700 --> 08:22.470 So if we go here. 08:23.580 --> 08:28.830 You can see we have the image which is identical to the image that we uploaded. 08:29.010 --> 08:30.510 So that's perfect. 08:31.340 --> 08:39.110 Now this method might seem secure and it is more private than uploading your files using Google Drive 08:39.110 --> 08:40.970 or Dropbox and all of them. 08:40.970 --> 08:44.960 But there are still a number of things to keep in mind. 08:45.440 --> 08:48.700 First of all, the link contains the decryption key. 08:48.710 --> 08:56.360 Therefore, anybody that has access to the link will be able to download your file and see its content. 08:56.390 --> 08:58.140 Then we have the other problem. 08:58.160 --> 08:59.900 Do we trust that server? 08:59.930 --> 09:05.810 Now I know I said that the file will be encrypted before uploading it to the server and the encryption 09:05.810 --> 09:11.610 will be done using code that runs locally so the server does not know the decryption key. 09:11.630 --> 09:15.410 But do you really trust that this code will never change? 09:15.440 --> 09:21.470 What if a hacker gains access to Firefox servers and modifies the way this code works so it actually 09:21.470 --> 09:24.380 sends the key to their server or to his own server? 09:24.890 --> 09:30.110 What if an employee that is -- off and don't like Firefox does something like that? 09:30.140 --> 09:32.090 What about government agencies? 09:32.360 --> 09:39.590 So again, even though encryption is used in this case, it still suffers from the same problems as 09:39.590 --> 09:44.750 normal file sharing services because we still have to trust that server. 09:45.350 --> 09:52.240 So the main problem that we're facing here is the way these file sharing services are implemented, 09:52.250 --> 09:54.140 not a problem with encryption. 09:54.140 --> 10:00.560 We will actually talk about how you can manually encrypt your files without relying on code pulled from 10:00.560 --> 10:01.520 another server. 10:02.000 --> 10:08.470 The main problem that we have here is our file is being stored somewhere that we do not control. 10:08.480 --> 10:13.910 Regardless of how this file is stored, whether it's using encryption or not does not really matter. 10:14.060 --> 10:21.380 Ideally, we want to keep our files locally and only share it in places where we have full control on. 10:21.500 --> 10:24.770 And this is what I'm going to show you in the next lecture. 10:25.640 --> 10:27.510 Now, one more thing to add. 10:27.530 --> 10:34.430 For this service to work, like I said, it uses client side code to encrypt and decrypt the files. 10:34.430 --> 10:41.090 Therefore, you need to have your security settings on low or medium to work because the client side 10:41.090 --> 10:48.140 code that will do all of this work is JavaScript code, and the high security level, as we know, disables 10:48.140 --> 10:49.010 JavaScript. 10:49.040 --> 10:55.400 Therefore, you might not want to use a medium or standard security setting because it doesn't fit your 10:55.400 --> 10:56.250 threat model. 10:56.270 --> 11:00.770 So again, this will be another problem with using this service. 11:01.640 --> 11:07.820 But in general, if you have something that is not very sensitive, then this could be a nice and quick 11:07.820 --> 11:09.230 way to share files.