Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox Send: Private, Encrypted File Sharing

send.firefox.com

Post reply on HN
Print view View original

131–140 of 285 posts

Re: Firefox Send: Private, Encrypted File Sharing

#131

Post by api »

wodenokoto wrote: post #126
NikolaeVarius wrote: post #5

It really is a shame that there still isn't a easy way (A person whose computer knowledge extends to using facebook), that I know of, of sending arbitrarily large files that isn't tethered to a specific cloud service and is also reliable (can tolerate connection dropping). It seems that bitorrent protocols are pretty close, but I don't think there is a seamless client that allows for "magical" point to point transact…

File.pizza is very seamless point to point transfer of arbitrary file sizes. Doesn't work in safari though (haven't tested ie) so maybe it is not general enough for your use case.

Does it work in Safari in High Sierra? I thought they had WebRTC now.

Re: Firefox Send: Private, Encrypted File Sharing

#132

Post by jhasse »

Yoric wrote: post #80
zeveb wrote: post #74

Earlier quoted context omitted.

> one has to trust Mozilla not to do that. Exactly. One has to trust Mozilla every time one visits the page . They could easily configure it to be malicious one time out of a million (say); what are the odds that they would be caught? Web-page-based crypto is fundamentally insecure, and Mozilla is committing an extremely grave error in encouraging users to trust it (as they also do with their Firefox Accounts). Secur…

Send is meant to be an improvement on Dropbox & co for a specific use case. Is it perfect? No, it isn't. But it is still a considerable improvement. If you have a better solution in mind for the average user crowd, feel free to suggest it, of course.

Sending the file over an end to end encrypted chat app.

Re: Firefox Send: Private, Encrypted File Sharing

#133

Post by wpietri »

AndrewDucker wrote: post #15
NikolaeVarius wrote: post #5

It really is a shame that there still isn't a easy way (A person whose computer knowledge extends to using facebook), that I know of, of sending arbitrarily large files that isn't tethered to a specific cloud service and is also reliable (can tolerate connection dropping). It seems that bitorrent protocols are pretty close, but I don't think there is a seamless client that allows for "magical" point to point transact…

You're at a computer. You need to connect to another computer. First you need to know a route to that computer. If it has an externally reachable IP address and you know that, then great. If it has an externally reachable IP address and a DNS entry and you know _that_, then also great. If you don't know the IP address or domain name of the other computer then you'll have to do some kind of lookup/exchange to find it.…

Regarding this bit:

> I'm not aware of any entirely decentralised system [...]

What's the user value of having something entirely decentralized? I see the value in making sure the actual file transfer doesn't go through the central rendezvous. But I don't understand what's gained by eliminating the use of a little help setting up the connection.

Re: Firefox Send: Private, Encrypted File Sharing

#134

Post by [deleted] »

manveru wrote: post #34
HalfwayToDice wrote: post #12

Earlier quoted context omitted.

They share it with RiseUp, the radical-left organisation they fund. Don't worry my friend, your files are safe with them.

What you're referring to is this: https://blog.mozilla.org/blog/2017/10/03/mozilla-awards-half... RiseUp seems to be an organization providing VPNs, Email-service, Jabber, and general security advice. Citing from https://riseup.net/en/about-us (at least what you seem to be worried about): > The Riseup Collective is an autonomous body based in Seattle with collective members world wide. Our purpose is to aid in the cr…

[deleted]

Re: Firefox Send: Private, Encrypted File Sharing

#135

Post by yscik »

SgtSauceBoss wrote: post #130

I've learned not to trust companies when they tout "completely encrypted" and "totally private". Show me the open source code, otherwise they're likely collecting data in some way to pay for hosting this web application.

Here you go: https://github.com/mozilla/send

Re: Firefox Send: Private, Encrypted File Sharing

#136

Post by ReAzem »

microtonal wrote: post #67
NikolaeVarius wrote: post #5

It really is a shame that there still isn't a easy way (A person whose computer knowledge extends to using facebook), that I know of, of sending arbitrarily large files that isn't tethered to a specific cloud service and is also reliable (can tolerate connection dropping). It seems that bitorrent protocols are pretty close, but I don't think there is a seamless client that allows for "magical" point to point transact…

Resilio Sync (formerly Bittorrent Sync) pretty much offers that. They use relays in case both peers cannot pierce NAT, but the relays only see ciphertext. They also have apps for Android and iOS, making transfers to mobile devices also possible. Since it is closed-source software, it's up to you to decide whether you trust the software. SyncThing is a free software alternative, but I wouldn't say that it is usable (y…

Instead of Resilio Sync, I would suggest that people take a look at Syncthing. They have similar features but Syncthing is open source.

Re: Firefox Send: Private, Encrypted File Sharing

#138

Post by Vinnl »

KwanEsq wrote: post #33
sarabande wrote: post #28

I'm curious -- Mozilla says it can't decrypt the file on their side: Mozilla does not have the ability to access the content of your encrypted file [...] https://testpilot.firefox.com/experiments/send How is the receiver able to decrypt the file -- i.e. what is the decryption key if not the URL slug, which presumably Mozilla has as well?

The key is the hash, which isn't sent over the wire when loading a page. Now granted it's accessible via location.hash in the client, but one has to trust Mozilla not to do that.

> one has to trust Mozilla not to do that

Well, the advantage of the client is that you can inspect the source, so you can verify that it doesn't actually access location.hash.

Re: Firefox Send: Private, Encrypted File Sharing

#139

Post by seedie »

wpietri wrote: post #133
AndrewDucker wrote: post #15

Earlier quoted context omitted.

You're at a computer. You need to connect to another computer. First you need to know a route to that computer. If it has an externally reachable IP address and you know that, then great. If it has an externally reachable IP address and a DNS entry and you know _that_, then also great. If you don't know the IP address or domain name of the other computer then you'll have to do some kind of lookup/exchange to find it.…

Regarding this bit: > I'm not aware of any entirely decentralised system [...] What's the user value of having something entirely decentralized? I see the value in making sure the actual file transfer doesn't go through the central rendezvous. But I don't understand what's gained by eliminating the use of a little help setting up the connection.

The lack of a centralized entity collecting metadata. Who is sending files, when and how often.

Re: Firefox Send: Private, Encrypted File Sharing

#140

Post by takeda »

Yoric wrote: post #80
zeveb wrote: post #74

Earlier quoted context omitted.

> one has to trust Mozilla not to do that. Exactly. One has to trust Mozilla every time one visits the page . They could easily configure it to be malicious one time out of a million (say); what are the odds that they would be caught? Web-page-based crypto is fundamentally insecure, and Mozilla is committing an extremely grave error in encouraging users to trust it (as they also do with their Firefox Accounts). Secur…

Send is meant to be an improvement on Dropbox & co for a specific use case. Is it perfect? No, it isn't. But it is still a considerable improvement. If you have a better solution in mind for the average user crowd, feel free to suggest it, of course.

Well there's reasoning which states that bad security is worse than no security.

The reason for it, is that if you trust the site to be secure it might be devastating once security is compromised, but with no security you're typically more careful.

Post reply on HN