[metzelplix]

Hello All,

I have some "friends" that have reached out to me and have asked for recommendations for websites to use for whistler blower content.  They want to place their files on the site, hoping they won't be removed, before they retrieve them for their use.  They don't want the files on their local system(s) in case their company's get suspicious.

I have already recommended one site I know they can use, which is BiteBlob's public or private sharing modes, as long as they don't give away the URLs provided.  The private share has an additional protection mechanism which is a long key code to access a link, but private share is only good for 1 retrieval per link.  So, they could upload a couple times.

These "friends" don't want to store the data on any services, such as Box, or Google, or AWS, since they believe "big brother" is paying these services to look for questionable material and remove it.

So.... does anyone have any other recommended services they could use?  I recommended what I thought was best.  My testing has shown that BiteBlob will hold on to files for a very long time, unless they are reported or violate the terms of use.  I've had some files on BiteBlob for over a year with no issues.

Thank you for anyone that has recommendations.

-M

[OriginalCrazyOldFart]

I hate BiteBlob, it fucks with my antivirus & I never bypass my protection just to do anything. Its not worth the time or to take a chance of getting a virus or some other shit.
I don't see why they can't use GoogleDrive, password protect things & encrypt them. I use it all the time & have no problem & have my friends involved in a private setting.
Same thing with Amazon, just make sure you protect your files & use good encryption. Simple ! lol !
I don't like Dropbox, those fucks go out of their way to stick their nose in your shit.
MEGA works great if you keep it paid up & on there, PROTECT your files by encrypting them & renaming things by using a code. Those nosy fucks will delete your shit if they think something is illegal in a New York second, but, I have raised hell with them (because its PAID for) & they restored my shit. lol ! ALWAYS BITCH about things they do on there & they will stop doing them. Passwords keep MF'ers out & odd ball names keep them wondering what the hell is in them.
GoogleDrive does not give a fuck what you store there, as long as you don't have some jerk complaining to them, about you. Don't let people access your files, that you can not fully TRUST, as true friends & you'll be safe & good to go. Its that SIMPLE !!!

In other words: PROTECTION, PROTECTION, PROTECTION, ENCRYPTION too.

---

Here, READ this:
To fully protect your files on Amazon and Google Drive, implement strong security measures like enabling two-factor authentication, using encryption, and controlling access permissions, while also diversifying storage and considering additional encryption for sensitive data.
https://www.google.com/search?client=fir...oogleDrive

Google Drive Security:

Two-Factor Authentication (2FA):
Enable 2FA on your Google Account to add an extra layer of security beyond just your password.

Encryption:
Google Drive encrypts data in transit and at rest, but consider using additional encryption for sensitive data, especially if storing financial information.
Sharing Permissions:
Carefully control who has access to your files and folders by restricting sharing to specific individuals or groups.
Data Classification:
Consider classifying your data based on sensitivity levels to ensure appropriate access controls.
Endpoint Management:
Implement endpoint management solutions to secure devices accessing Google Drive.
Backup Processes:
Automate backup processes to ensure data recovery in case of data loss or corruption.
Third-Party Apps:
Be cautious when granting third-party apps access to your Google Drive, and review their permissions carefully.
Recovery:
Set up account recovery options to help regain access to your account if you lose access.
Lock Files:
You can lock files in Google Drive to prevent accidental or unauthorized edits.
******************************************************************************************************

Amazon Drive Security:

Two-Factor Authentication (2FA):
Enable 2FA on your Amazon account to add an extra layer of security.

Encryption:
Amazon Drive encrypts data in transit and at rest, but consider using additional encryption for sensitive data, especially if storing financial information.
Sharing Permissions:
Carefully control who has access to your files and folders by restricting sharing to specific individuals or groups.
Data Classification:
Consider classifying your data based on sensitivity levels to ensure appropriate access controls.
Endpoint Management:
Implement endpoint management solutions to secure devices accessing Amazon Drive.
Backup Processes:
Automate backup processes to ensure data recovery in case of data loss or corruption.
Third-Party Apps:
Be cautious when granting third-party apps access to your Amazon Drive, and review their permissions carefully.
Recovery:
Set up account recovery options to help regain access to your account if you lose access.
Lock Files:
You can lock files in Amazon Drive to prevent accidental or unauthorized edits.

Additional Tips:

Diversify Storage:
Don't rely solely on Google Drive or Amazon Drive for storing critical data. Consider using multiple cloud storage services or local backups.

Password Strength:
Use strong, unique passwords for all your accounts, including your Google and Amazon accounts.
Be Vigilant:
Regularly review your security settings and be cautious about suspicious emails or links.
Update Software:
Keep your operating system and applications up to date with the latest security patches.


Data Protection Guide: How To Secure Google Drive for Your Business
https://www.varonis.com/blog/how-to-secure-google-drive


To fully protect your files with Amazon AWS, consider using a combination of robust security measures, including encryption, access controls, and auditing, focusing on both data at rest and in transit
https://www.google.com/search?q=how+to+f...s-wiz-serp

Here's a breakdown of key security practices:

Encryption:
Data at Rest: Use server-side encryption (SSE-S3) or client-side encryption with AWS Key Management Service (KMS) for Amazon S3 buckets.

Data in Transit: Ensure secure communication using SSL/TLS, and consider using AWS CloudFront for content delivery with HTTPS.

Access Control:

IAM (Identity and Access Management): Implement IAM roles and policies to grant users only the necessary permissions, and use multi-factor authentication (MFA).

S3 Bucket Policies: Configure bucket policies to restrict access to specific users or groups, and use access control lists (ACLs) for fine-grained control.

Auditing and Logging:

AWS CloudTrail: Enable CloudTrail logging to track API calls and user activities, providing an audit trail for security incidents.

Amazon Macie: Use Amazon Macie to discover and protect sensitive data stored in S3.

Data Protection:

S3 Versioning: Enable S3 versioning to prevent accidental overwrites and deletions, allowing for data recovery from previous versions.

S3 Object Lock: Use S3 Object Lock to prevent objects from being deleted or modified for a set period, ensuring data immutability.
AWS Backup: Utilize AWS Backup to create and manage backups of your AWS resources, including S3 buckets and other services.

Secure File Transfer:

AWS Transfer Family: If using SFTP, consider scanning uploads for malware with Amazon GuardDuty Malware Protection for S3.

Secure Key Management:

AWS KMS: Use AWS KMS to create, manage, and control the use of encryption keys for various AWS services.

Storage Gateway:

AWS Storage Gateway: Use AWS Storage Gateway to connect on-premises storage to AWS services like S3 and Glacier.

CloudFront:

CloudFront Signed URLs/Cookies: Use CloudFront signed URLs or signed cookies to restrict access to content served through CloudFront.

Security Best Practices:

Principle of Least Privilege: Grant users only the minimum necessary permissions.

Regular Security Audits: Conduct regular security audits to identify and address potential vulnerabilities.
Stay Informed: Keep up-to-date with the latest security best practices and AWS security updates.

---

I also like Proton storage, they have strict laws in Switzerland about them sticking their noses in your shit. They do not allow it. You never get spam in the email either. I have both, email & storage & have NEVER had ANY trouble with them. NEVER !

[metzelplix]

Thanks for the feedback, but I think you misunderstood my point of the post. It has nothing to do with downloading random things from a site. My post was about what site to use for Whistleblower data.

Let's say I;m a whistleblower, I am looking for a site that I can trust to hold onto my data for a long period of time. From my experience, I think BiteBlob is a good site for that, when using the PrivateShare option. I can upload a file, not worry about the file being taken down, so when I go back to get it, I can access it.

This is what my post was all about. You bring up some good points, but I am no fan of services that require payment, or most likely have big brother paying them to look at files on their systems.

[OriginalCrazyOldFart]

Some of them are FREE, up to a point. Unless your storing the whole site on WiKi or Archives.org, how much room do you need?
Are you saying as a whistle blower, you want the whole world to be able to access them ? Or are they just staying there till you want to send them to someone ? I would think that if your a whistle blower, you could find a million sites to post your files on & do it under an assumed name. Are you sharing the files or just storing them for a rainy day ?
How much room do you need ? These are the things you need to tell people, exactly what your doing with the files. Storing, sharing, sending the links to someone ??
Sounds to me, you need something like this if you sharing things that people have a real need to know.
Your All-In-One Whistleblowing System
https://www.tendro.com/?utm_term=whistle...yHEALw_wcB

If your only storing them, what is the point ?

[metzelplix]

Thanks for the response. I will answer your questions one at a time.

1. Some of them are FREE, up to a point. Unless your storing the whole site on WiKi or Archives.org, how much room do you need?
Response: I believe some sites are free, period. Some whistleblower may have GigaBytes they need to offload. They can't have them on their work machine, or even home computer, if they are holding files that could get them in big trouble (by their company), so having them in a safe place (off premise, off local machines) would do them good. Even if they have a terabyte of data, my testing of sites shows you can use some of them if you are willing to slice up the data and make multiple uploads.

2. Are you saying as a whistle blower, you want the whole world to be able to access them ?
Response: No, I am not saying to share the files with the world. I would not recommend that unless that is what you need to do for your point to be made.

3. Or are they just staying there till you want to send them to someone ?
Response: Yes, I am saying to put the files on a trusted site, that allows anonymous uploads, seems trustworthy not to police the files, if evidence shows they don't do that, and keep a copy or two in place on that site or sites, until the time comes that you need to pull the files back to use them for your purpose (potentially in court).

4. I would think that if your a whistle blower, you could find a million sites to post your files on & do it under an assumed name. Are you sharing the files or just storing them for a rainy day ?
Response: Most likely you can find a lot of sites to do this, but most of the sites will require logon, limit storage to a small amount, and/or you will need to pay for a service. A true whistle blower is not storing the files for a rainy day, they are storing the files for the purpose of showing them eventually, as evidence to something going on that is either being covered up, or they have evidence of lies of some nature. The files may eventually be shared in a court setting to bring people to justice or hand over to police for prosecution, or simply to call the people out to their own employees/stock holders.

5. How much room do you need ? These are the things you need to tell people, exactly what your doing with the files.
Response: This all depends on the person. Most of the sites I have been testing require accounts, and/or eventually charge monthly for a certain amount of space. My comment about BiteBlob was the public and private services allow up to 55GB of uploads/downloads every hour (each), don't require accounts, and my testing has shown the files stay in place for a long time.

6. Storing, sharing, sending the links to someone ??
Response: This depends. I don't recommend placing the files on a site that provides links for the world, otherwise the files may be taken down. I would recommend (as I did in my original post) to place them on a private sharing capability, and with the added security you can share the files with limited people, as the capability only allows 1 download of the content. If that is the case, then store the content off more than once, so you receive multiple links and keys to gain access to them again. The main point of my post was to find a site a whistleblower can trust to hold their files for a long period of time (if needed) and the files will be there when they return for them. No need for an account, and no need for monthly payments.

7. Sounds to me, you need something like this if you sharing things that people have a real need to know.
Your All-In-One Whistleblowing System
https://www.tendro.com/?utm_term=whistle...yHEALw_wcB
Response: This service looks like companies pay them to keep whistle blower content inside the company. Not clear how they do that. They have monthly fees and this will require an account to logon. So, I don't think this is the site a whistleblower truly wants to use, but I will have to research the service, more, over time. Here is a post from the website:
"Tendro ensures full compliance with whistleblowing directives globally while keeping sensitive issues securely managed within your organization. Protect your company’s reputation, meet legal requirements, avoid costly fines."

8. If your only storing them, what is the point ?
Response: As a whistleblower, yes, the point is to have a place you can trust to hold the files, keep them off your own local systems, and go back and obtain the files when the time is right. Of course, if you only push them out to a website and never retrieve them, then there is no point for this whole exercise.

Thanks again for your response. Good questions!!