Wall Street Journal Leak Site Works on Security Fixes

[steve2470]

http://bits.blogs.nytimes.com/2011/05/06/wall-street-journal-leak-site-works-on-security-fixes/?ref=technology

The Wall Street Journal on Thursday introduced SafeHouse, a Web site that takes a page from WikiLeaks by inviting whistleblowers to submit tips and documents. But within hours, security researchers were challenging the notion that the site was safe for leakers. And on Friday, The Journal said it was rushing through technical changes to address the problems.

According to the researchers, the way SafeHouse uses Web encryption technology known as HTTPS opens the site up for attacks, and is not rigorous enough for a site that handles highly sensitive communications. They also said they were troubled that SafeHouse used Adobe Flash for uploading documents, a technology that can help strip leakers of anonymity.

The problems were the subject of a barrage of messages on Twitter on Thursday afternoon by Jacob Appelbaum, a developer for the Tor Project, which provides tools for anonymous online communication used by dissidents, whistleblowers, journalists and others. Mr. Appelbaum was formerly associated with Wikileaks. “Pro-tip: if you’re going to create a document leaking website – have a clue!” he wrote.

The Journal said in an e-mailed statement that it was taking the issues raised “very seriously” and that it would end its use of Flash within 48 hours. “In addition, our system has been updated to limit the types of less secure connections it will accept,” it said.

*end of excerpt. You are redirected at the link above to the more secure https link*