FPF maintains a SecureDrop directory at https://securedrop.org/directory
SecureDrops are listed if they meet certain requirements, most of which apply to their accompanying landing/tips page, as outline in the documentation. Many of these requirements are strict, and some are just preferred.
In brief, the externally auditable requirements for a SecureDrop landing page are:
We do regular audits of all the SecureDrops in the directory to confirm they are still meeting these requirements. Currently this process is done manually. The directory website itself does some automated scans, and includes a warning on a directory listing if certain requirements are not met. See https://github.com/freedomofpress/securedrop.org/blob/develop/scanner/scanner.py
The securedrop.org website scans work, but are limited. In practice they often produce false-positives e.g. due to a landing page being protected by Cloudflare. They also do not perform a full audit of all the requirements.
The proposal is to investigate developing a full automated regular directory audit. In relation to the current scanner built into the website, this could be independent, supplementary, or a replacement.
Some advantages:
- Immediately surface changes in a landing page that violate a requirement, allowing for quicker and more effect remediation
- Reduce human-time spent doing manual directory audit
FPF maintains a SecureDrop directory at https://securedrop.org/directory
SecureDrops are listed if they meet certain requirements, most of which apply to their accompanying landing/tips page, as outline in the documentation. Many of these requirements are strict, and some are just preferred.
In brief, the externally auditable requirements for a SecureDrop landing page are:
We do regular audits of all the SecureDrops in the directory to confirm they are still meeting these requirements. Currently this process is done manually. The directory website itself does some automated scans, and includes a warning on a directory listing if certain requirements are not met. See https://github.com/freedomofpress/securedrop.org/blob/develop/scanner/scanner.py
The securedrop.org website scans work, but are limited. In practice they often produce false-positives e.g. due to a landing page being protected by Cloudflare. They also do not perform a full audit of all the requirements.
The proposal is to investigate developing a full automated regular directory audit. In relation to the current scanner built into the website, this could be independent, supplementary, or a replacement.
Some advantages: