Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox Send: Private, Encrypted File Sharing

send.firefox.com

Post reply on HN
Print view View original

51–60 of 285 posts

Re: Firefox Send: Private, Encrypted File Sharing

#51

Post by peterwwillis »

NikolaeVarius wrote: post #5

It really is a shame that there still isn't a easy way (A person whose computer knowledge extends to using facebook), that I know of, of sending arbitrarily large files that isn't tethered to a specific cloud service and is also reliable (can tolerate connection dropping). It seems that bitorrent protocols are pretty close, but I don't think there is a seamless client that allows for "magical" point to point transact…

Well, you can with FTP and UPnP. You the client gets the external IP of the machine, then use UPnP to open ports on the router/firewall, then uses PASV and connects to the destination. The destination runs an FTP server, that uses UPnP to open up the incoming port, and gets its external IP and uses it for PORT mode. The end result is two individuals behind NAT sharing arbitrary files in bulk. You can even tie this into FXP to do syncing with the cloud.

Or run a local SFTP server with UPnP and avoid the extra complexity.

In terms of finding each other, the client could get its external IP, open up a UPnP port, and provide the user with a QR code or brief snippet to paste into a chat conversation, which the other user would feed to their client to initiate the file transfer.

You could do this commercially by providing an external website with which the clients could communicate out of band to set up their transfers (for free), and (for pay) optionally provide a cloud sync service (which would help person A "pre-send" a big file transfer until person B was available to receive it).

While some of this is available today, you're right, I don't think there are accessible clients. ICQ, AIM and IRC used to be the solution, as they all did P2P file transfer. But now everything is on the web, so everything sucks.

Re: Firefox Send: Private, Encrypted File Sharing

#52

Post by xj9 »

AndrewDucker wrote: post #48
xj9 wrote: post #41

Earlier quoted context omitted.

https://geti2p.net/en/about/intro endpoints are identified by their public key hash. each endpoint maintains a set of anonymized routes. this routing information is stored in a Distributed Hash Table (DHT). if you want to connect to another endpoint, you lookup the route for the public key hash, build an outbound route, and you're good. more concretely, an ipfs transfer would work by using public key hashes in place…

So all you need is the hash (sent to you by your friend over IM or email or postcard) and you're good to go? I like it. Now, is it available today in a form (as the OP put it) which "A person whose computer knowledge extends to using facebook" can use?

if they have the ability to install software, they can use i2p

https://geti2p.net/en/download

Re: Firefox Send: Private, Encrypted File Sharing

#53

Post by pingiun »

NikolaeVarius wrote: post #5

It really is a shame that there still isn't a easy way (A person whose computer knowledge extends to using facebook), that I know of, of sending arbitrarily large files that isn't tethered to a specific cloud service and is also reliable (can tolerate connection dropping). It seems that bitorrent protocols are pretty close, but I don't think there is a seamless client that allows for "magical" point to point transact…

> It seems that bitorrent protocols are pretty close, but I don't think there is a seamless client that allows for "magical" point to point transactions.

instant.io works pretty well for me, it works on the bittorrent protocol, but over webrtc

Re: Firefox Send: Private, Encrypted File Sharing

#54

Post by hiq »

NikolaeVarius wrote: post #5

It really is a shame that there still isn't a easy way (A person whose computer knowledge extends to using facebook), that I know of, of sending arbitrarily large files that isn't tethered to a specific cloud service and is also reliable (can tolerate connection dropping). It seems that bitorrent protocols are pretty close, but I don't think there is a seamless client that allows for "magical" point to point transact…

magic-wormhole ( https://github.com/warner/magic-wormhole ) is not so far from that, just add a simple GUI on top of it (or just use the terminal and convince the user that a terminal does not have to be complicated), and you're good to go. I don't know how reliable it is w.r.t. connection drops though.

Re: Firefox Send: Private, Encrypted File Sharing

#55

Post by sarabande »

sametmax wrote: post #49
sarabande wrote: post #28

I'm curious -- Mozilla says it can't decrypt the file on their side: Mozilla does not have the ability to access the content of your encrypted file [...] https://testpilot.firefox.com/experiments/send How is the receiver able to decrypt the file -- i.e. what is the decryption key if not the URL slug, which presumably Mozilla has as well?

Key is in the hash. Check 0bin.net. We use the same trick to encrypt the pastebin content. The sources are available so you can see the gist of it. It's a very simple code.

Curious why in your FAQ at 0bin.net you say:

    But JavaScript encryption is not secure!
Is there something inherently insecure about the JS crypto library you're using (https://github.com/bitwiseshiftleft/sjcl)?

Re: Firefox Send: Private, Encrypted File Sharing

#56

Post by AndrewDucker »

xj9 wrote: post #52
AndrewDucker wrote: post #48

Earlier quoted context omitted.

So all you need is the hash (sent to you by your friend over IM or email or postcard) and you're good to go? I like it. Now, is it available today in a form (as the OP put it) which "A person whose computer knowledge extends to using facebook" can use?

if they have the ability to install software, they can use i2p https://geti2p.net/en/download

Odd. I looked at the description on the main page, and it lists eDonkey, BitTorrent, and Gnutella, but not any kind of direct file transfer.

Am I missing something?

Re: Firefox Send: Private, Encrypted File Sharing

#58

Post by bluejekyll »

sametmax wrote: post #49
sarabande wrote: post #28

I'm curious -- Mozilla says it can't decrypt the file on their side: Mozilla does not have the ability to access the content of your encrypted file [...] https://testpilot.firefox.com/experiments/send How is the receiver able to decrypt the file -- i.e. what is the decryption key if not the URL slug, which presumably Mozilla has as well?

Key is in the hash. Check 0bin.net. We use the same trick to encrypt the pastebin content. The sources are available so you can see the gist of it. It's a very simple code.

Is this a common practice? It seems brilliantly simple and reproduceable.

Re: Firefox Send: Private, Encrypted File Sharing

#59

Post by snvzz »

sarabande wrote: post #36
KwanEsq wrote: post #33

Earlier quoted context omitted.

The key is the hash, which isn't sent over the wire when loading a page. Now granted it's accessible via location.hash in the client, but one has to trust Mozilla not to do that.

Thanks. I was just looking at the screenshots and didn't seen any hashes, but when I tried it out and copied to the clipboard I saw the form " https://send.firefox.com/download/xxxxx/#yyyyy" .

#yyyyy would be the encryption key. The webserver end never sees it.

It can, however, easily be read via javascript, so mozilla needs to be trusted in any case.

Re: Firefox Send: Private, Encrypted File Sharing

#60

Post by madeofpalk »

snvzz wrote: post #59
sarabande wrote: post #36

Earlier quoted context omitted.

Thanks. I was just looking at the screenshots and didn't seen any hashes, but when I tried it out and copied to the clipboard I saw the form " https://send.firefox.com/download/xxxxx/#yyyyy" .

#yyyyy would be the encryption key. The webserver end never sees it. It can, however, easily be read via javascript, so mozilla needs to be trusted in any case.

at least you can check that its not going back to the server.
Post reply on HN