The Freedom of the Press Foundation has released a new tool for macOS and Linux called “Sunder” that whistleblowers, activists, journalists, and even filmmakers can use to disclose secret information to the public when certain conditions are met.
Divide And Conquer
The idea behind Sunder is that a whistleblower can share secret information with multiple parties (such as media entities), but that information would only be revealed when his or her conditions are met and when most of the parties involved agree to share the information.
Sunder makes use of an old algorithm called Shamir’s Secret Sharing, which allows someone to divide a secret into multiple parts. Therefore, the risk of divulging the secret too early or having someone steal it is virtually zero, unless the attacker can steal all the secret’s parts from everyone else, too. Those who hold the secret parts still need to secure them as best as they can to minimize that risk.
Merging the parts together and reconstructing the secret also doesn’t require everyone in the group to agree to it, but only a majority. For instance, 5 out of 8 could agree to recreate the secret and then disclose it to others. This avoids the issue where if the original secret holder is no longer alive, for instance, one or more media entities can’t agree to no longer share his or her secret, thus putting the whole information disclosure process in danger.
The Freedom of the Press Foundation also said that Sunder can be used not just by whistleblowers, activists, and journalists, but also filmmakers who need to keep terabytes of footage secure against leaking or accidental disclosure.
Keeping Secrets Safe
The secret itself could be the password to an encrypted thumb drive, social media credentials, an encrypted archive’s passphrase, the private key used to log into a server, and so on.
Sunder is still “alpha” quality right now, and it hasn’t been audited, which means you shouldn’t be using it other than to test it right now. Sunder uses the open source “RustySecrets” library, which is an implementation of Shamir’s Secret Sharing algorithm in the memory-safe Rust programming language. That means there is also much lower risk of being hacked due to bugs in the code.
The team behind Sunder wants to hear your feedback on the tool, and has prepared a survey for users who download and use it.
