Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox Send: Free encrypted file transfer service

blog.mozilla.org

Post reply on HN
Print view View original

231–240 of 542 posts

Re: Firefox Send: Free encrypted file transfer service

#231

Post by laumars »

supermatt wrote: post #213
laumars wrote: post #110

Earlier quoted context omitted.

Other vendors used to allow you to do this back when internal storage was vfat formatted but it's not been an option these days because Windows and Macs wouldn't have the file system drivers to read the storage. This is why MTP was created. However MTP is - in my experience - complete garbage and creates as many problems as it solves.

Mounting MTP is transparent to the user on non-apple OSes as well. You can drag and drop files as you could when it was when mounting the VFAT block device. Its only on MacOS that this isn't handled gracefully. So yeah, apple is only mobile you cant do this on at all, and apple is only desktop OS you cant access other phones that permit it on (without installing some 3rd party tool). As an aside, I write this as an a…

I've used MTP and my experience is it that it leaves a lot to be desired regardless of the platform. My wife's Samsung phone never worked right with her Windows 7 laptop. Neither my Huawei nor the HTC handset I had before worked properly with any of my Linux machines either.

I get the point of MTP is that is't supposed to be a transparent (to the user) interface but my experience is it falls short by a long way of achieving this in practice.

Re: Firefox Send: Free encrypted file transfer service

#232

Post by frosted-flakes »

Retric wrote: post #91
samcday wrote: post #27

Earlier quoted context omitted.

Tangentially related - I've always thought it's dumb that I can't just plug my iPhone in to any PC and have it show up as a removable storage device. I'm sure people who know more than me will give me a list of great reasons why it's not straightforward to implement... But it doesn't change the fact that I have this incredible device (iPhone X) with 256gb of blindingly fast NAND flash storage, of which I am only util…

I regularly do this to offload pictures and movies. I have even used my iPhone as a large USB drive. But, they don’t let you access to full file system for some reason.

Access to images and videos is read-only. So it can't be used like a USB drive.

Re: Firefox Send: Free encrypted file transfer service

#233

Post by air7 »

timvisee wrote: post #211
bjt2n3904 wrote: post #206

I don't understand the end-to-end encryption claim. 1. Bob uploads a file, but specifies no password. 2. ??? 3. Sue downloads the file. Best case, Bob's browser encrypts it (with javascript?) before uploading. Either Mozilla provides a key, or Bob sends the key he used. When Sue's browser downloads it, Mozilla sends the key and her browser decrypts it client side. In either case, Mozilla has the password for decrypti…

The client encrypts the file that is uploaded, along with some metadata. The key is appended to the share URL provided by the URL, in the fragment/hash, and is never sent to the remote server. Only people having the URL including the secret will be able to download and decrypt your shared file. See https://github.com/mozilla/send/blob/master/docs/encryption....

That's cool, but it's still the same party providing both the storage mechanism, and the JS that encrypts the content on the client-side. You have to trust them that they are not "peeking" at the keys you are generating using their code in your browser.

Re: Firefox Send: Free encrypted file transfer service

#234

Post by NedIsakoff »

mac01021 wrote: post #150
NedIsakoff wrote: post #134

How are they going to deal with bad content? Child porn? Pirated content? Illegal stuff?

Since it's encrypted end to end, presumably they will be oblivious to all that stuff?

Sure, but doesn't help with the PR does it. If people start using it to send/dist the stuff, the news will mention it.

Re: Firefox Send: Free encrypted file transfer service

#236

Post by timvisee »

bjt2n3904 wrote: post #225
timvisee wrote: post #211

Earlier quoted context omitted.

The client encrypts the file that is uploaded, along with some metadata. The key is appended to the share URL provided by the URL, in the fragment/hash, and is never sent to the remote server. Only people having the URL including the secret will be able to download and decrypt your shared file. See https://github.com/mozilla/send/blob/master/docs/encryption....

Thanks for the info. Let me see if I understand this correctly. Browsers don't send the anchor tag (ie: with GET requests). FF Send takes advantage of this by using the anchor tag to store the key for decryption. That is kinda novel. You still need to trust the upload client to not leak the key, but I see that you've written a CLI version. Interesting! Thanks for the response.

You got it! The only thing you'd have to worry about is malicious JavaScript on the Firefox Send website which I believe would be highly unlikely. And of course, you must keep your link secret.

Yes, such a CLI tool would help protect you against a MITM with malicious JavaScript.

Re: Firefox Send: Free encrypted file transfer service

#237

Post by jszymborski »

timvisee wrote: post #211
bjt2n3904 wrote: post #206

I don't understand the end-to-end encryption claim. 1. Bob uploads a file, but specifies no password. 2. ??? 3. Sue downloads the file. Best case, Bob's browser encrypts it (with javascript?) before uploading. Either Mozilla provides a key, or Bob sends the key he used. When Sue's browser downloads it, Mozilla sends the key and her browser decrypts it client side. In either case, Mozilla has the password for decrypti…

The client encrypts the file that is uploaded, along with some metadata. The key is appended to the share URL provided by the URL, in the fragment/hash, and is never sent to the remote server. Only people having the URL including the secret will be able to download and decrypt your shared file. See https://github.com/mozilla/send/blob/master/docs/encryption....

I use a similar mechanism on my website https://expiring.link

I'm working on documenting the code now before I release on GitHub, but it works on the same premise :)

WebCrypto is mana from the gods...

Re: Firefox Send: Free encrypted file transfer service

#238

Post by TulliusCicero »

dTal wrote: post #230
TulliusCicero wrote: post #201

Earlier quoted context omitted.

> MTP is a horrible protocol which renders the abstraction very leaky in my experience Nevertheless, it's still removable storage that can take the place of the most common use case of portable flash drives: moving files around from one computer to another. Which is explicitly what we were originally talking about. Pointing out that it doesn't work for some other use case that you yourself brought up doesn't make any…

I'm not going to debate you in three places at once, that's just obnoxious and clutters the thread. Ultimately this is an argument about the precise semantics of "removable storage". I don't regard an MTP device as "removable storage" - it's another computer that one speaks to using a special protocol, with severe limitations. So is an iPhone - with special, protocol-speaking software, you can certainly put arbitrary…

> Ultimately this is an argument about the precise semantics of "removable storage". I don't regard an MTP device as "removable storage"

This is absurd. You don't get to tell someone, "you're wrong", then later when it's pointed out that the original assertion was actually true, then say, "oh, I meant that you're wrong as long as we're using my version of the word, the one that's very different from the one everyone else was using."

Sorry, but that's blatantly disingenuous. The original context was very clear. If you really meant, "well it sort of works as removable storage in one sense, but not in this other sense" you should've just said that to begin with.

Re: Firefox Send: Free encrypted file transfer service

#239

Post by sumitgt »

It would be really amazing to build some sort of integration in commonly available WiFi connected scanners and printers.

Currently, my scanner conveniently sends me emails with scanned documents. But I have not insight into how they actually store and delete the document on the backend.

Would be great if the scanner had the option to upload to Firefox Send and show me a QR code to download it on other devices.

Re: Firefox Send: Free encrypted file transfer service

#240

Post by mercutio2 »

voidmain0001 wrote: post #133
Retric wrote: post #97

Earlier quoted context omitted.

Not having a cable is hardly the same issue, iPhones let you easily share images and videos but not all files.

Beyond AirDrop which only works between like devices, how else can files on an iPhone be transferred to another device without iTunes, and without using a 3rd party? I'm not being adversarial, I really want to know.

I’m a little confused, you don’t want to use 3rd party apps (like a Microsoft app to interact with nearby MS stuff) AND you don’t want to use Apple 1st party apps?

It sounds like the only thing that would’ve satisfied you would’ve been for iOS to natively understand whatever the Microsoft system is for broadcasting videos? I agree it would be delightful if Apple and Microsoft could agree on a “I’m a short term drop-point” “send to any nearby open drop-point” API, but the absence of this doesn’t seem likely to be either Microsoft’s or Apple’s fault.

The Apple way to do this would’ve been to send an iCloud email. Apple Mail would’ve uploaded the file to a server, and a short-lived link would’ve been created, to avoid SMTP size limits.

Pretty much exactly what you ended up doing but manually via Firefox Send.

Post reply on HN