Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox Send: Private, Encrypted File Sharing

send.firefox.com

Post reply on HN
Print view View original

151–160 of 285 posts

Re: Firefox Send: Private, Encrypted File Sharing

#151

Post by carussell »

TuringTest wrote: post #92
snvzz wrote: post #59

Earlier quoted context omitted.

#yyyyy would be the encryption key. The webserver end never sees it. It can, however, easily be read via javascript, so mozilla needs to be trusted in any case.

> It can, however, easily be read via javascript, so mozilla needs to be trusted in any case. Or you (and some friends from organizations like the EFF and FSF) can read the source code to see what it does, and even compile it yourself. If you do that, you only need to trust the compiler.

No, you still need to trust that Mozilla's deployment corresponds to the publicly available release—that they aren't using a version with changes nor have they been breached by an attacker who can change it to sample 1/n transactions.

Re: Firefox Send: Private, Encrypted File Sharing

#152

Post by icebraining »

seedie wrote: post #139
wpietri wrote: post #133

Earlier quoted context omitted.

Regarding this bit: > I'm not aware of any entirely decentralised system [...] What's the user value of having something entirely decentralized? I see the value in making sure the actual file transfer doesn't go through the central rendezvous. But I don't understand what's gained by eliminating the use of a little help setting up the connection.

The lack of a centralized entity collecting metadata. Who is sending files, when and how often.

The ISPs can do that, and they're pretty centralized.

Re: Firefox Send: Private, Encrypted File Sharing

#153

Post by icebraining »

xj9 wrote: post #101
AndrewDucker wrote: post #56

Earlier quoted context omitted.

Odd. I looked at the description on the main page, and it lists eDonkey, BitTorrent, and Gnutella, but not any kind of direct file transfer. Am I missing something?

yes. 1. click bit torrent 2. click create torrent 3. type the path to your file 4. share magnet link magnet:?xt=urn:btih:d0da0a2cac2bb3fd7ba6548edef12a24122ef481&tr= http://diftracker.i2p/announce.php

Does the magnet link work without DifTracker? Because that's still a centralized system.

Re: Firefox Send: Private, Encrypted File Sharing

#154

Post by icebraining »

TuringTest wrote: post #95
zeveb wrote: post #74

Earlier quoted context omitted.

> one has to trust Mozilla not to do that. Exactly. One has to trust Mozilla every time one visits the page . They could easily configure it to be malicious one time out of a million (say); what are the odds that they would be caught? Web-page-based crypto is fundamentally insecure, and Mozilla is committing an extremely grave error in encouraging users to trust it (as they also do with their Firefox Accounts). Secur…

> They could easily configure it to be malicious one time out of a million (say); what are the odds that they would be caught? How could they do that easily ? Their source code is public, and many third parties work on it and produce their own compiled versions - plus every security people tracking unexpected connections would catch it.

Compiled versions of the JavaScript served by the site?

Re: Firefox Send: Private, Encrypted File Sharing

#155

Post by icebraining »

ohitsdom wrote: post #87
thinkMOAR wrote: post #68

Earlier quoted context omitted.

You must be great at parties. Software is irrelevant imo. Indicating same protocol as FF send is imho more relevant.

The whole point of this discussion is that sending files to another computer is still cumbersome. Software is entirely relevant. So if you're complaining about speed of FF Send, you should specify what you're comparing it to.

The whole point of this discussion is that sending files to another computer is still cumbersome.

No, the discussion is about Firefox Send generally. The cumbersomeness discussion is a specific subthread.

Re: Firefox Send: Private, Encrypted File Sharing

#156

Post by claudius »

snvzz wrote: post #59
sarabande wrote: post #36

Earlier quoted context omitted.

Thanks. I was just looking at the screenshots and didn't seen any hashes, but when I tried it out and copied to the clipboard I saw the form " https://send.firefox.com/download/xxxxx/#yyyyy" .

#yyyyy would be the encryption key. The webserver end never sees it. It can, however, easily be read via javascript, so mozilla needs to be trusted in any case.

If one were to build a marketing spyware add-on to analyse user traffic from within the browser and send all visited URLs to some remote server, would those sent URLs then possibly contain the anchor?

Re: Firefox Send: Private, Encrypted File Sharing

#157

Post by [deleted] »

soapdog wrote: post #45
HalfwayToDice wrote: post #12

Earlier quoted context omitted.

They share it with RiseUp, the radical-left organisation they fund. Don't worry my friend, your files are safe with them.

This type of comment without any reference or source is the kind of stuff that is destroying the internet and good journalism. It is users like you that spread FUD and fake information that makes it really hard for people to discern noise from signal online. First, you can read all about MOSS[1] which is a program inside Mozilla that gives grants to open source projects. Part of Mozilla current efforts alongside with…

[deleted]

Re: Firefox Send: Private, Encrypted File Sharing

#158

Post by the8472 »

padenot wrote: post #39
AndrewDucker wrote: post #25

Earlier quoted context omitted.

So, three systems which all require a central service?

Those services are for the initial peer discovery and SDP exchange, which can be done by other means (using any other side-channel). Ongoing work is happening, for example by the webtorrent folks, to remove this constraint.

Which is a step backwards compared to bittorrent, since that can also provide decentralized hole punching, bootstrapping and peer discovery and not just the bulk data transfer. Plus being implemented at the TCP/UDP level allows more fine-grained control over the data flow, making it more friendly towards the network.
Post reply on HN