Firefox Send: Free encrypted file transfer service • Hacker News Board

Re: Firefox Send: Free encrypted file transfer service

#381

Post by GordonS » Tue, Mar 12, 2019, 6:02 PM UTC

alias_neo wrote: post #336

lbeltrame wrote: post #304

Earlier quoted context omitted.

As far as I can see, this requires S3 or a S3 compatible service. Kind of defeats the purpose of self hosting unless you can set one yourself (it may be, I didn't look). EDIT: Apparently there's a way to use filesystem instead of S3, it's just not well documented.

Minio is your friend. (S3 compatible self-hosted, open-source object store). I recently implemented a text/snippet sharing tool that uses Minio instead of S3, because I like to self-host everything. https://minio.io/

I use this with Seafile to store data in Azure Blob storage - it was incredibly simple to setup and has been rock solid since. Highly recommended!

Re: Firefox Send: Free encrypted file transfer service

#382

Post by _bxg1 » Tue, Mar 12, 2019, 6:07 PM UTC

_bxg1 wrote: post #100

Ah man, I literally came up with (and prototyped) this exact thing in 2013. Minus the end to end encryption. I dropped it mostly because I wasn't sure how to prevent illegal use and didn't want to be liable. Edit: mine was actually (partially) better because it assigned a short PIN instead of a full link, which meant you could just look at it and remember it for typing-in, instead of requiring a separate channel to "…

Hah, found a record of the project (we did it at HackTX): http://techzette.com/2013-hacktx-winners-and-finalists/

It was called "Catch"

Re: Firefox Send: Free encrypted file transfer service

#383

Post by thinkloop » Tue, Mar 12, 2019, 6:09 PM UTC

skrebbel wrote: post #368

In the not so recent past, HN'ers loved to quote tptacek's legendary rant about how in-browser JavaScript crypto is fundamentally broken[0]. What changed? Is that rant finally outdated? Couldn't Mozilla at any time serve a corrupted JS bundle (with or without their knowledge) which would leak the key somewhere, silently replace the encryption by a noop, etc? I ask out of interest, not skepticism. I much prefer an int…

That article primarily comes down to this:

> WHY CAN'T I USE TLS/SSL TO DELIVER THE JAVASCRIPT CRYPTO CODE? You can. It's harder than it sounds, but you can safely transmit Javascript crypto to a browser using SSL. The problem is, having established a secure channel with SSL, you no longer need Javascript cryptography; you have "real" cryptography.

In our case we aren't doing crypto inception where the cryptography is meant to secure itself. The crypto is being served securely (by ssl) and then used to solve the separate unrelated crypto problem of encrypting random files.

Re: Firefox Send: Free encrypted file transfer service

#384

Post by johnchristopher » Tue, Mar 12, 2019, 6:09 PM UTC

lbeltrame wrote: post #304

jgruen wrote: post #53

Earlier quoted context omitted.

boop: https://github.com/mozilla/send

As far as I can see, this requires S3 or a S3 compatible service. Kind of defeats the purpose of self hosting unless you can set one yourself (it may be, I didn't look). EDIT: Apparently there's a way to use filesystem instead of S3, it's just not well documented.

The default npm install; npm start will give you a self-hosted app. The docker one is a different beast.

Re: Firefox Send: Free encrypted file transfer service

#385

Post by thinkloop » Tue, Mar 12, 2019, 6:13 PM UTC

fouadmatin wrote: post #374

skrebbel wrote: post #368

In the not so recent past, HN'ers loved to quote tptacek's legendary rant about how in-browser JavaScript crypto is fundamentally broken[0]. What changed? Is that rant finally outdated? Couldn't Mozilla at any time serve a corrupted JS bundle (with or without their knowledge) which would leak the key somewhere, silently replace the encryption by a noop, etc? I ask out of interest, not skepticism. I much prefer an int…

SubtleCrypto is a new browser-adopted spec for performing crypto operations natively. For example, instead of using Math.random() for random number generation, you can use https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getR... in combination with the SubtleCrypto functions to work with keys securely Your points around a compromised JS bundle are still possible but that has more to do with a company’s deploym…

Didn't realize it had full support by every browser, even ie: https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getR...

Re: Firefox Send: Free encrypted file transfer service

#386

Post by Rebelgecko » Tue, Mar 12, 2019, 6:19 PM UTC

skrebbel wrote: post #368

In the not so recent past, HN'ers loved to quote tptacek's legendary rant about how in-browser JavaScript crypto is fundamentally broken[0]. What changed? Is that rant finally outdated? Couldn't Mozilla at any time serve a corrupted JS bundle (with or without their knowledge) which would leak the key somewhere, silently replace the encryption by a noop, etc? I ask out of interest, not skepticism. I much prefer an int…

Some of those points are relevant and some aren't. For logging in to a website, "just use SSL/TLS instead" makes sense, but not for this use case. There's better options nowadays for doing crypto in the browser, but I wouldn't be surprised if they were at least theoretically vulnerable to side channel attacks from JS running in another tab.

The main thing is that unless you're paying really really close attention to the JS that you're executing, you can't trust this any more than you can trust Mozilla and the security of whatever computer is serving their pages. I wouldn't use this for sending data that you're trying to hide from a nation-state, but it looks like a great option if you want to send a video to your grandma without posting it publicly on the internet or teaching her how to use GPG.

Re: Firefox Send: Free encrypted file transfer service

#387

Post by Causality1 » Tue, Mar 12, 2019, 6:23 PM UTC

Why does it have upload limits at all? Your client encrypts it, the data is sent over your internet connection to someone else's, their client decrypts it. Why would the data pass through Mozilla's servers?

Re: Firefox Send: Free encrypted file transfer service

#388

Post by coderunner » Tue, Mar 12, 2019, 6:28 PM UTC

toomuchtodo wrote: post #171

patrickxb wrote: post #129

Earlier quoted context omitted.

I don't understand how they can afford the bandwidth... If this were on AWS it would be around $0.09 per GB for downloads.

Which is why you don’t host it on AWS. Wrong tool for the job.

Is there a cheaper S3 alternative that you recommend or that Mozilla's likely using instead?

Re: Firefox Send: Free encrypted file transfer service

#389

Post by skrebbel » Tue, Mar 12, 2019, 6:32 PM UTC

fouadmatin wrote: post #374

skrebbel wrote: post #368

In the not so recent past, HN'ers loved to quote tptacek's legendary rant about how in-browser JavaScript crypto is fundamentally broken[0]. What changed? Is that rant finally outdated? Couldn't Mozilla at any time serve a corrupted JS bundle (with or without their knowledge) which would leak the key somewhere, silently replace the encryption by a noop, etc? I ask out of interest, not skepticism. I much prefer an int…

SubtleCrypto is a new browser-adopted spec for performing crypto operations natively. For example, instead of using Math.random() for random number generation, you can use https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getR... in combination with the SubtleCrypto functions to work with keys securely Your points around a compromised JS bundle are still possible but that has more to do with a company’s deploym…

> Your points around a compromised JS bundle are still possible but that has more to do with a company’s deployment/change management setup than JS itself imo

But that's the only point I intend to address here. If Pascal had been the language of the web then my question would have been about Pascal.

Therefore I don't see how SubtleCrypto changes matters much.

In short, if I get it right, the argument would be that in eg a mobile app, all the e2e logic (the core crypto plus the code around it) go through peer-review, then some release management process, then some review by Apple or Google, before it lands in my hands via their app stores' well secured delivery mechanism. In a web app, a single compromised server will compromise all security instantly. Generally I'm fine with trusting Mozilla's servers, but if I have to trust their servers then what's the point of end to end encryption?

Re: Firefox Send: Free encrypted file transfer service

#390

Post by TheArcane » Tue, Mar 12, 2019, 6:40 PM UTC

hotgeart wrote: post #377

lmedinas wrote: post #263

a bit off topic but here it goes... This is how i think Mozilla can capture more users back to Firefox. By providing "extra" services attached to the Mozilla and Firefox brand will make them a superior product to the end user. Sure it's hard to compete with Chrome but if you offer useful features and services integrated in your Browser i see that Mozilla actually has a chance to compete with Google for the browser sp…

> If Mozilla comes with Send, Notes, Password Manager all integrated in Firefox i see a good way to bring back some of the previous users that switched to Chrome As a Chrome user I can confirm. But for me the main raison I use Chrome is for the dev tools a found them better than FF

For me, it's the seamless translation suite