Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox Send: Private, Encrypted File Sharing

send.firefox.com

Post reply on HN
Print view View original

201–210 of 285 posts

Re: Firefox Send: Private, Encrypted File Sharing

#201

Post by damnyou »

CaptSpify wrote: post #197
giaour wrote: post #191

Earlier quoted context omitted.

We trust applications like that all the time . Browsers update themselves, and we trust them to secure our communication with banks, governments, health providers, etc. Most browsers now also store passwords in an encrypted secret repository. If you're on Windows or OSX, your OS is also constantly updating itself with closed-source binary blobs. I mean, sure, you can never use an auto-updating application again and a…

> We trust applications like that all the time Sure, nobody ever said otherwise. But that doesn't mean it's a good idea. The software I use is open-source, so I can see what I'm running, and what updates I get. I also don't use any auto-updates. The web is inherently different in that I can't really guarantee that the code I get is going to be the same code that you are getting.

I hope you've thought very carefully about your threat model when you say you don't autoupdate.

For most people your advice is quite plainly wrong. Most people should have everything on autoupdate.

Re: Firefox Send: Private, Encrypted File Sharing

#202

Post by hypervis0r »

intherdfield wrote: post #183
zeveb wrote: post #74

Earlier quoted context omitted.

> one has to trust Mozilla not to do that. Exactly. One has to trust Mozilla every time one visits the page . They could easily configure it to be malicious one time out of a million (say); what are the odds that they would be caught? Web-page-based crypto is fundamentally insecure, and Mozilla is committing an extremely grave error in encouraging users to trust it (as they also do with their Firefox Accounts). Secur…

>> one has to trust Mozilla not to do that. > > Exactly. One has to trust Mozilla every time one visits > the page. They could easily configure it to be malicious > one time out of a million (say); what are the odds that > they would be caught? Bear in mind they also make the web browser.

Sure, but that's open source and you can disable automatic updates, meaning they can't change the code whenever they feel like doing so. And if they do, the code will be kept in the source code control history, and will eventually be caught.

It's wildly different from a JS file that's loaded every time you visit the website.

Re: Firefox Send: Private, Encrypted File Sharing

#203

Post by zeveb »

giaour wrote: post #192
zeveb wrote: post #171

Earlier quoted context omitted.

Using WebCrypto doesn't defend against the insecurity: their JavaScript code can send a copy of the file anywhere it likes. Mozilla can, if it wishes or if it is compelled to, deliver malicious JavaScript which does exactly that to a single targetted IP address, or just every once in awhile in order to find potentially interesting files. Using in-web-page crypto gives users a false sense of security. This is, I belie…

It's true; you're trusting Mozilla to deliver secure code. You'd be placing a similar amount of trust in Mozilla by using Firefox, since browsers automatically update themselves these days. What WebCrypto guarantees is that it is truly Mozilla's code that you're trusting, since the WebCrypto APIs are only available in a secure context (HTTPS or localhost).

> You'd be placing a similar amount of trust in Mozilla by using Firefox, since browsers automatically update themselves these days.

No, because I use the Debian Firefox, which means that I'm trusting the Debian Mozilla team. I feel much better about that than about directly trusting Mozilla themselves.

I don't trust auto-updates.

Re: Firefox Send: Private, Encrypted File Sharing

#204

Post by damnyou »

zeveb wrote: post #171
giaour wrote: post #88

Earlier quoted context omitted.

I don’t think the second paragraph is a logical extrapolation of the first. If this is using the WebCrypto API (which it appears to be doing), then trusting this browser-based solution isn’t fundamentally different from trusting an installed application that can update itself.

Using WebCrypto doesn't defend against the insecurity: their JavaScript code can send a copy of the file anywhere it likes. Mozilla can, if it wishes or if it is compelled to, deliver malicious JavaScript which does exactly that to a single targetted IP address, or just every once in awhile in order to find potentially interesting files. Using in-web-page crypto gives users a false sense of security. This is, I belie…

Using any sort of application downloaded from the internet gives users a false sense of security.

Re: Firefox Send: Private, Encrypted File Sharing

#205

Post by superkuh »

soapdog wrote: post #172
superkuh wrote: post #147

Earlier quoted context omitted.

Don't forget their switch to a walled garden for extensions in order to protect users from themselves.

That is FUD and also a lie. You can still distribute your extensions on whatever site you want, you just need to sign them on AMO. The workflow is: 1 - Build webextension 2 - Upload to AMO 3 - Choose "distribute on AMO" or "sign and distribute on your site"

If I need to get Mozilla's approval before I can run code in the browser running on my machine then I see a wall. That they've automated it so much as to mitigate the protection a walled garden normally gives almost makes it worse.

Re: Firefox Send: Private, Encrypted File Sharing

#207

Post by wtetzner »

fefe23 wrote: post #193

Why do the Mozilla people keep doing this sort of thing? Aren't they supposed to be making a good browser? I remember them telling me they are now going back to their core competences. I think it was after Firefox OS failed. Not trying to piss on anyone's parade here, just wondering how this kind of thing keeps happening. I was wondering the same thing when Mozilla added Pocket and now Cliqz to Firefox. What is the r…

Software development doesn't always (usually doesn't, in fact) work that way. After a point, throwing more money and engineers at Firefox is unlikely to speed up its pace of development, or improve its quality.

Re: Firefox Send: Private, Encrypted File Sharing

#208

Post by SquareWheel »

claudius wrote: post #156
snvzz wrote: post #59

Earlier quoted context omitted.

#yyyyy would be the encryption key. The webserver end never sees it. It can, however, easily be read via javascript, so mozilla needs to be trusted in any case.

If one were to build a marketing spyware add-on to analyse user traffic from within the browser and send all visited URLs to some remote server, would those sent URLs then possibly contain the anchor?

If it's running on the client, then yes it could read the anchor text.

Re: Firefox Send: Private, Encrypted File Sharing

#209

Post by TylerH »

fefe23 wrote: post #193

Why do the Mozilla people keep doing this sort of thing? Aren't they supposed to be making a good browser? I remember them telling me they are now going back to their core competences. I think it was after Firefox OS failed. Not trying to piss on anyone's parade here, just wondering how this kind of thing keeps happening. I was wondering the same thing when Mozilla added Pocket and now Cliqz to Firefox. What is the r…

Because browsers have evolved beyond applications to serve up static web pages, and convenient features like this are a selling point. Google has created an entire "OS" ecosystem built on a port of their web browser, and they've been pushing people to use it for years. I think I'll give Firefox a pass at adding some super neat and useful features from time to time.

Re: Firefox Send: Private, Encrypted File Sharing

#210

Post by JetSpiegel »

mtgx wrote: post #165
ReAzem wrote: post #136

Earlier quoted context omitted.

Instead of Resilio Sync, I would suggest that people take a look at Syncthing. They have similar features but Syncthing is open source.

I haven't tried Synthing in about a year, but to me Resilio and Syncthing look like they are from completely different classes of apps/they target different markets. Syncthing is simply not designed for the mainstream . Resilio is. If Syncthing devs can fix that, I'll gladly start using it over Resilio with my non-technical friends.

How do you fix "not being mainstream"? What exactly is your issue with Syncthing?
Post reply on HN