How can we make OpenStreetMap more secure for users everywhere? And could we make a secure reporting tool for mappers? Ignite talk at SOTMUS 2014 DC

1. CartoDrop
mapping and reporting over Tor
!
Nick Doiron - @mapmeld

2. My background: maps

3. Carto and Crypto
At first glance, very different
fields
Six months in, still different
¯_(ツ)_/¯

4. Who needs crypto?

5. Not just NSA and USA
NSA gets capabilities through contractors
Software is resold to many countries
Government-run ISPs

6. With maps like these…
Human rights violations
Poaching and pollution
Systemic bribery
Political uncertainty
Voter suppression
Disease outbreaks

7. HTTPS?
HTTPS reveals
you and your domain
size of downloaded tiles
can’t read messages…
… unless someone gives up the key (ever)

8. build on Uncensorable Twitter
only protects distributor
Decentralize?

9. What does work?

11. Sounds tricky…?
Looks like Firefox
Orbot for Android

12. Disclaimer
Do use public WiFi
Don’t sign into your account
Don’t do illegal stuff
Don’t allow JavaScript

13. -> SecureDropDemo.org <-
!
Designed for journalists, already on
FirstLook and WildLeaks

14. Good and bad news
JavaScript? NO
APIs NO
Secure passwords YES
PGP encryption YES
Air gap docs YES

15. Maps break SecureDrop!
Journalist needs to look up each coordinate:
without a visual
without software (can’t install on Tails)
without the web

16. Can we build crypto?

17. Building CartoDrop
OSM + NaturalEarth
Mapnik Python
Messages stay encrypted
Source’s identity stays protected

19. The <way/> forward

20. Speak
Freely
@mapmeld
on Twitter & Keybase