Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox Send: Private, Encrypted File Sharing

send.firefox.com

Post reply on HN
Print view View original

271–280 of 285 posts

Re: Firefox Send: Private, Encrypted File Sharing

#271

Post by ihale »

solnyshok wrote: post #256
nneonneo wrote: post #225

The last time this was posted I hacked up a quick and dirty Python client for Send: https://github.com/nneonneo/ffsend . I just updated it for recent Send changes, which streamlined the crypto and removed some redundancy. Firefox’s JS client requires the whole file be in memory in order to perform the encryption, and has to decrypt the whole file in memory in order to download it. My client doesn’t have that limitati…

have you bumped already into server upload limit?

Would that not simply be your specific allotted disk space, and bandwidth?

Re: Firefox Send: Private, Encrypted File Sharing

#272

Post by lwerdna »

n2j3 wrote: post #259
lwerdna wrote: post #81

If you only need to send text, https://cryptopaste.com does everything client side and shows the ciphertext in a "staging area" before you commit it to the cloud. You can instead save it as a self-decrypting document, attaching it to email, copy to thumbdrive, upload dropbox, etc.

Great implementation but doesn't work with Greek, spews out garbage. Here against original text in notepad.exe https://i.imgur.com/n1WCsnZ.png

Thanks for the report (especially the effort to take a screenshot!), I'll look into it!

Re: Firefox Send: Private, Encrypted File Sharing

#273

Post by the8472 »

kijin wrote: post #235
the8472 wrote: post #216

Earlier quoted context omitted.

SRI alone is insufficient. Maybe a strict CSP policy that exclusively allows hash sources and forbids eval could serve as an indicator that the scripts executed on a page are immutable. Probably needs some further conditions to make it airtight.

If you don't trust Mozilla, how do you trust them not to strip the CSP header whenever they want to serve malicious javascript?

you'd still have to implement a pinning feature. the hash-only-CSP part would just be the foundation which the pin checks.

Re: Firefox Send: Private, Encrypted File Sharing

#274

Post by superkuh »

chungy wrote: post #258
superkuh wrote: post #205

Earlier quoted context omitted.

If I need to get Mozilla's approval before I can run code in the browser running on my machine then I see a wall. That they've automated it so much as to mitigate the protection a walled garden normally gives almost makes it worse.

You can install Firefox Beta or Nightly and have unrestricted extension installation options (or use a Linux distro's packages: most of such firefox packages do not require signed extensions). It's a measure to prevent casual trojans, there are many ways around it for non-casuals and developers to employ.

>or use a Linux distro's packages: most of such firefox packages do not require signed extensions

That's actually pretty cool. Can you give me an example distro that does that with Firefox (w/FF brandings)?

Re: Firefox Send: Private, Encrypted File Sharing

#275

Post by chungy »

superkuh wrote: post #274
chungy wrote: post #258

Earlier quoted context omitted.

You can install Firefox Beta or Nightly and have unrestricted extension installation options (or use a Linux distro's packages: most of such firefox packages do not require signed extensions). It's a measure to prevent casual trojans, there are many ways around it for non-casuals and developers to employ.

>or use a Linux distro's packages: most of such firefox packages do not require signed extensions That's actually pretty cool. Can you give me an example distro that does that with Firefox (w/FF brandings)?

Both Debian and Arch do this.

Re: Firefox Send: Private, Encrypted File Sharing

#276

Post by lwerdna »

n2j3 wrote: post #259
lwerdna wrote: post #81

If you only need to send text, https://cryptopaste.com does everything client side and shows the ciphertext in a "staging area" before you commit it to the cloud. You can instead save it as a self-decrypting document, attaching it to email, copy to thumbdrive, upload dropbox, etc.

Great implementation but doesn't work with Greek, spews out garbage. Here against original text in notepad.exe https://i.imgur.com/n1WCsnZ.png

If you have a chance, please try again. UTF-8 support is added.

Re: Firefox Send: Private, Encrypted File Sharing

#277

Post by galaxyLogic »

codebolt wrote: post #182
jhasse wrote: post #132

Earlier quoted context omitted.

Sending the file over an end to end encrypted chat app.

Even then, you are trusting the app to do what it says it's going to do. The only way I feel 100% safe is encrypting the file manually before sending (through whatever platform), and sharing the key through some other medium (preferably word of mouth). As a Windows user I mostly use 7-zip for this purpose, or the encryption plugin in Notepad++ for text.

Why would you trust 7-zip or NotePad++ more than FireFox?

Re: Firefox Send: Private, Encrypted File Sharing

#278

Post by galaxyLogic »

zeveb wrote: post #203
giaour wrote: post #192

Earlier quoted context omitted.

It's true; you're trusting Mozilla to deliver secure code. You'd be placing a similar amount of trust in Mozilla by using Firefox, since browsers automatically update themselves these days. What WebCrypto guarantees is that it is truly Mozilla's code that you're trusting, since the WebCrypto APIs are only available in a secure context (HTTPS or localhost).

> You'd be placing a similar amount of trust in Mozilla by using Firefox, since browsers automatically update themselves these days. No, because I use the Debian Firefox, which means that I'm trusting the Debian Mozilla team. I feel much better about that than about directly trusting Mozilla themselves. I don't trust auto-updates.

Why would you trust Debian more than FireFox?

About the auto-updates. CCleaner recently had an incident where their version .33 something had a backdoor injected by some 3rd party. If you downloaded version 34 you were safe. If you loaded 32 and configured it auto-update you got the malicious update. But that didn't affect the auto-update setting as far as I know, so if you had it on you would in about 2 weeks time have gotten an automatically fixed clean version.

Point: The worst situation was if you did not have auto-updates on and downloaded v. 33. Then you were stuck with that until somebody told you you had malice on your machine.

You're damned if you do and damned if you don't.

https://www.piriform.com/news/blog/2017/9/18/security-notifi...

Re: Firefox Send: Private, Encrypted File Sharing

#279

Post by galaxyLogic »

damnyou wrote: post #201
CaptSpify wrote: post #197

Earlier quoted context omitted.

> We trust applications like that all the time Sure, nobody ever said otherwise. But that doesn't mean it's a good idea. The software I use is open-source, so I can see what I'm running, and what updates I get. I also don't use any auto-updates. The web is inherently different in that I can't really guarantee that the code I get is going to be the same code that you are getting.

I hope you've thought very carefully about your threat model when you say you don't autoupdate. For most people your advice is quite plainly wrong. Most people should have everything on autoupdate.

Right. Point is there are two types of bad downloads. You can download a version which is not malicious but is insecure. Then auto-updating it makes it more secure.

Or you can auto-update to a version which is malicious. Then you are screwed. But your previous version you downloaded to start with might have contained the threat to start with. So just saying don't auto-update does not really protect you from malicious versions. Auto-updating does mean that you get updated security fixes making you less vulnerable.

The original non-updated version can be malicious even with a vendor you think you should be able to trust because it is a popular product used by many others:

https://www.piriform.com/news/blog/2017/9/18/security-notifi...

Re: Firefox Send: Private, Encrypted File Sharing

#280

Post by vel0city »

NikolaeVarius wrote: post #5

It really is a shame that there still isn't a easy way (A person whose computer knowledge extends to using facebook), that I know of, of sending arbitrarily large files that isn't tethered to a specific cloud service and is also reliable (can tolerate connection dropping). It seems that bitorrent protocols are pretty close, but I don't think there is a seamless client that allows for "magical" point to point transact…

With the recent shuttering of AIM, I'm reminded of the old client's Direct IM feature which would allow you to transfer arbitrarily large files through the chat session. That tool could not have been simpler to the user, as they just had to click "Direct IM" and could then drag and drop files into the chat. However, that system still relied on the cloud service (AIM) being a broker of connecting a handle to an IP address, and that there was little guarantee of the identity of the person on the other end of the IM.
Post reply on HN