Hi everyone,
I’m looking for recommendations for a secure file submission system with the following requirements:
- Users can upload files via a browser
- Client-side encryption (e.g., PGP, age, or similar) occurs before upload
- Only the intended recipient (with their private key) can decrypt the files
- Ideally, no additional software installation is required for the user
I really like the approach used by Send (Firefox/Community/ffsend), but I’m considering the following use case:
You have a grassroots activist group operating under a dictatorship. One day, they might be targeted, and there’s not much trust in ISPs. However, let’s assume there are no malicious root certificates in the browser, so TLS is reliable.
The group wants to accept files from various people, such as whistleblowers, and they can share their public key so that users can encrypt files with it.
Why public key? Because in this scenario, there’s no safe channel to share a decryption link with the group. Firefox/Community Send links that include the key don’t really solve this problem. Ideally, there should be no additional communication beyond the act of sharing these files.
Of course, this is all possible if you manually encrypt files using pre-installed software and then send them through any channel. But are there any web solutions that already implement this? I’m asking because this needs to be accessible to a broad audience, including people unfamiliar with programming, system administration, or specialized encryption tools. And while when you have few whistleblowers that can encrypt themselves because docs are high risk and you can work with them individually, this one applies to broader audience sharing files that are not considered generally risky, the problem is that the government rather wants to prevent any communication with grass root activist groups per se regardless of content, so content becomes risky only if it’s intercepted.
Hoping for your clever thoughts!