Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox Send: Private, Encrypted File Sharing

send.firefox.com

Post reply on HN
Print view View original

211–220 of 285 posts

Re: Firefox Send: Private, Encrypted File Sharing

#211

Post by Jach »

the8472 wrote: post #162
Vinnl wrote: post #138

Earlier quoted context omitted.

> one has to trust Mozilla not to do that Well, the advantage of the client is that you can inspect the source, so you can verify that it doesn't actually access location.hash.

But software loaded from webpages are not immutable. They could be manipulated at any given time. So even if someone audits the code you still cannot trust it because all the audit would show is that the specific downloaded version which the auditor saw was non-malicious. As long as websites have no fingerprints that encompasses all loaded resources and can't be pinned to that fingerpint crypto in the webbrowser is n…

https://developer.mozilla.org/en-US/docs/Web/Security/Subres... can help verify everything loaded is what it's supposed to be. However you'd still need to verify that the set of things loaded is the set of things you expect, not just that the things are the things, and that requires having an out-of-band checklist or extension...

Re: Firefox Send: Private, Encrypted File Sharing

#212

Post by potch »

fefe23 wrote: post #193

Why do the Mozilla people keep doing this sort of thing? Aren't they supposed to be making a good browser? I remember them telling me they are now going back to their core competences. I think it was after Firefox OS failed. Not trying to piss on anyone's parade here, just wondering how this kind of thing keeps happening. I was wondering the same thing when Mozilla added Pocket and now Cliqz to Firefox. What is the r…

Perhaps peruse this: https://www.mozilla.org/en-US/mission/

Firefox is Mozilla's flagship, and the largest by far way in which we achieve our mission, but our goal is a healthy and open internet.

Additionally, this is a great way to determine whether something like this would work well as an in-browser feature, and we've built it in such a way that it works in more browsers than just Firefox on day one.

Re: Firefox Send: Private, Encrypted File Sharing

#213

Post by daveFNbuck »

fefe23 wrote: post #193

Why do the Mozilla people keep doing this sort of thing? Aren't they supposed to be making a good browser? I remember them telling me they are now going back to their core competences. I think it was after Firefox OS failed. Not trying to piss on anyone's parade here, just wondering how this kind of thing keeps happening. I was wondering the same thing when Mozilla added Pocket and now Cliqz to Firefox. What is the r…

It's possible this is a test for a feature they're considering adding to the browser.

Re: Firefox Send: Private, Encrypted File Sharing

#214

Post by srathi »

hollander wrote: post #175
lucb1e wrote: post #173

Let me guess, with free Pocket® integration? Mozilla blew it for me recently in so many ways, I am taking them about as seriously as I would Facebook right now.

How can you compare the Pocket thing with Facebook? The good kid messed up this time. And you can simply ignore it, don't have to use it. Yes like you can decide not to use Facebook, but then all your friends and family use it, or use Instagram of Whatsapp and force you to use it. That includes uploading your complete contact list two or three times. Do you have to use Firefox because your family uses it? I don't thi…

They are repeating it with the Cliqz integration now. I love Firefox, but these decisions are baffling!

Re: Firefox Send: Private, Encrypted File Sharing

#215

Post by daveFNbuck »

zeveb wrote: post #74
KwanEsq wrote: post #33

Earlier quoted context omitted.

The key is the hash, which isn't sent over the wire when loading a page. Now granted it's accessible via location.hash in the client, but one has to trust Mozilla not to do that.

> one has to trust Mozilla not to do that. Exactly. One has to trust Mozilla every time one visits the page . They could easily configure it to be malicious one time out of a million (say); what are the odds that they would be caught? Web-page-based crypto is fundamentally insecure, and Mozilla is committing an extremely grave error in encouraging users to trust it (as they also do with their Firefox Accounts). Secur…

If you're using Firefox, you're already trusting Mozilla every time you visit any page.

Re: Firefox Send: Private, Encrypted File Sharing

#216

Post by the8472 »

Jach wrote: post #211
the8472 wrote: post #162

Earlier quoted context omitted.

But software loaded from webpages are not immutable. They could be manipulated at any given time. So even if someone audits the code you still cannot trust it because all the audit would show is that the specific downloaded version which the auditor saw was non-malicious. As long as websites have no fingerprints that encompasses all loaded resources and can't be pinned to that fingerpint crypto in the webbrowser is n…

https://developer.mozilla.org/en-US/docs/Web/Security/Subres... can help verify everything loaded is what it's supposed to be. However you'd still need to verify that the set of things loaded is the set of things you expect, not just that the things are the things, and that requires having an out-of-band checklist or extension...

SRI alone is insufficient. Maybe a strict CSP policy that exclusively allows hash sources and forbids eval could serve as an indicator that the scripts executed on a page are immutable. Probably needs some further conditions to make it airtight.

Re: Firefox Send: Private, Encrypted File Sharing

#217

Post by actionscripted »

potch wrote: post #212
fefe23 wrote: post #193

Why do the Mozilla people keep doing this sort of thing? Aren't they supposed to be making a good browser? I remember them telling me they are now going back to their core competences. I think it was after Firefox OS failed. Not trying to piss on anyone's parade here, just wondering how this kind of thing keeps happening. I was wondering the same thing when Mozilla added Pocket and now Cliqz to Firefox. What is the r…

Perhaps peruse this: https://www.mozilla.org/en-US/mission/ Firefox is Mozilla's flagship, and the largest by far way in which we achieve our mission, but our goal is a healthy and open internet. Additionally, this is a great way to determine whether something like this would work well as an in-browser feature, and we've built it in such a way that it works in more browsers than just Firefox on day one.

> ...and we've built it in such a way that it works in more browsers than just Firefox on day one.

Sure wish other browser vendors would consider other browsers when releasing their products.

Re: Firefox Send: Private, Encrypted File Sharing

#218

Post by xj9 »

icebraining wrote: post #153
xj9 wrote: post #101

Earlier quoted context omitted.

yes. 1. click bit torrent 2. click create torrent 3. type the path to your file 4. share magnet link magnet:?xt=urn:btih:d0da0a2cac2bb3fd7ba6548edef12a24122ef481&tr= http://diftracker.i2p/announce.php

Does the magnet link work without DifTracker? Because that's still a centralized system.

yes, the tracker is optional. the built in torrent client supports BEP 5.

http://www.bittorrent.org/beps/bep_0005.html

Re: Firefox Send: Private, Encrypted File Sharing

#219

Post by Dylan16807 »

the8472 wrote: post #200
Dylan16807 wrote: post #186

Earlier quoted context omitted.

How many pins would you expect a browser instance to have? I feel like most of the time the pinned content could fit in the browser cache and make this variety of proxy-side caching pointless.

Immutable content is a prerequisite for pins. The caching benefits mostly fall out of the immutability, not the pinning. So as long as the hypothetical standard would allow one to be used without the other additional uses could fall out of that stack.

My point is, those particular benefits only exist in a narrow circumstance where the browser is half-caching.
Post reply on HN