Tinfoil: A user-centered community for journalists and security nerds

A message from the future: Two years after its launch, Tinfoil is sunsetting on April 21, 2018.

Tinfoil.press has been an amazing project. Having places to speak about digital security for journalists and media activists is important to me, and I met friends in the journalism world on the forum. Yet I also believe deeply that sensitive user data (e.g., plaintext email and IP addresses, as well as hashed passwords) demands extraordinary protection.

I’ve had a question on my mind for a long time: Do I actually have the capacity to make sure everything is “up to code”? Early into the project, I did. But more recently I have not had the time to give this project the attention it requires.

Usually, this means regular tinkering with the server to ensure it’s receiving the newest operating system and forum patches, as well as rolling back to server snapshots when (inevitably) the server doesn’t want to play nice with Discourse or nginx. These aren’t major technical hurdles, but they require time.

While a server is an attention-hungry thing, the activity on the forum has decreased over time, to a trickle. The work necessary to keep our user data safe eclipses the level of traffic we see on the site.

The site started with an explosion of fascinating conversations. Things are quieter now.

I think these conversations are important. I also think they continue in less public spaces, such as face-to-face conversations and private messages, where we can be even more specific and candid about our most pressing security challenges.

Tinfoil was always an open forum, and how we sunset the site should reflect that. In the spirit of openness, and to preserve useful conversations, I’ve archived the site: https://mshelt.onl/tinfoil.press/

You can also download a compressed version of the archive here.

I intend to keep @tinfoilpress active on Twitter, posting links on the intersection between journalism, media activism, and information security.

I appreciate you all spending this time, however brief, reading and sharing your thoughts and questions. ❤

The original announcement post from two years ago is preserved below.


Over the past few years, I’ve been spending a lot of time researching how journalists manage their digital security. I talk to journalists, press freedom advocates, and security educators about how they do their work. Nearly all of the journalists who I interview in this research have only occasional access to security specialists (e.g., through conferences, security trainings). Now I’m a Knight-Mozilla OpenNews fellow at the Coral Project, housed at the New York Times. My newsroom is lucky to have excellent security staff, but that’s not the norm. In my research, I’ve found that security specialists (notably trainers) and journalists are often overbooked. It can be challenging to find convenient times to speak, much less a meeting in the same room.

This is a problem because it’s important to build relationships between security specialists and the groups with whom they work. This is a problem because relationships help us understand each others’ needs, and how those needs relate to real security hygiene. People make security compromises because they have interests that may compete with a strong security posture. To build mutual understanding, and to provide helpful resources, we need better ways to build relationships between security educators and people who need assistance outside of conferences, trainings, and workshops.

I’m starting an online community forum to help connect journalists and security specialists — it’s called Tinfoil. Tinfoil is an open forum. Anyone can participate, and the posts are visible to anyone. This helps users to learn from previous questions and ongoing discussions, but this also means users should be mindful about what information they post.

Right now, it’s very experimental, and growing slowly. We support two-factor authentication, Tor hidden services for users who prefer to post anonymously, and will continue to roll out new features to respond to users’ needs.

My hope is that Tinfoil will help journalists and security specialists connect, develop useful relationships, and to learn more from one another. My hope is that it can be a helpful forum for security specialists, journalists of all backgrounds, and those who simply care about the intersection of these privacy and security issues. Check it out here: https://tinfoil.press

Feel free to reach out here, or on Twitter at @tinfoilpress or tinfoilhelp [at] gmail. You can also contact me at @mshelton. Encryption is always welcome.