I've used this before to send sensitive documents to my attorney, who would have otherwise just wanted email attachments. It worked great.
Based on what I've read, the security model seems to be almost the same as email attachments?
Firefox Send: Free encrypted file transfer service
421–430 of 542 posts
Re: Firefox Send: Free encrypted file transfer service
#422Earlier quoted context omitted.
Some of those points are relevant and some aren't. For logging in to a website, "just use SSL/TLS instead" makes sense, but not for this use case. There's better options nowadays for doing crypto in the browser, but I wouldn't be surprised if they were at least theoretically vulnerable to side channel attacks from JS running in another tab. The main thing is that unless you're paying really really close attention to…
This is really the point here. But the danger is always that someone who needs strong nation state secure crypto is used to this and doesnt realize the implications of using this when trying to keep state level secrets.
Indeed, you can rest assured that this will be used to share passwords that should not be shared this way. I would be surprised if it hasn't been already.
Re: Firefox Send: Free encrypted file transfer service
#423What is the use case of such a tool? Real a question.
Re: Firefox Send: Free encrypted file transfer service
#424Earlier quoted context omitted.
SubtleCrypto is a new browser-adopted spec for performing crypto operations natively. For example, instead of using Math.random() for random number generation, you can use https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getR... in combination with the SubtleCrypto functions to work with keys securely Your points around a compromised JS bundle are still possible but that has more to do with a company’s deploym…
> Your points around a compromised JS bundle are still possible but that has more to do with a company’s deployment/change management setup than JS itself imo But that's the only point I intend to address here. If Pascal had been the language of the web then my question would have been about Pascal. Therefore I don't see how SubtleCrypto changes matters much. In short, if I get it right, the argument would be that in…
> In a web app, a single compromised server will compromise all security instantly.
This is only true if the server has access to the keys of your data. E2EE typically means that it doesn't, only you do.
Re: Firefox Send: Free encrypted file transfer service
#425What is the use case of such a tool? Real a question.
I don't understand what you're asking. The use case is literally in the title ("file transfer").
Re: Firefox Send: Free encrypted file transfer service
#426Very clean and nice, but how is this financed? That is, who's paying for the server storage and the bandwidth?
Read here for the why: https://github.com/mozilla/send/blob/master/docs/metrics.md
Re: Firefox Send: Free encrypted file transfer service
#427Earlier quoted context omitted.
Didn't realize it had full support by every browser, even ie: https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getR...
The problem with that table is that this only lists the entry methods, which are supported in all browsers. However, the actual work is hidden behind parameters, not all of which are supported by all browsers, and some have to be in weird combinations. One example is that Edge does not support PBKDF2 in any form, which makes many of their further support a bit weird to use. Here's a site where you can test your brows…
I think it uses a cryptofill shim for browsers that don't support all of the crypto api
Re: Firefox Send: Free encrypted file transfer service
#428Earlier quoted context omitted.
I think what the previous poster meant was 'why' are Mozilla paying for it?
The open web is more than just a browser. The cost is minimal when you have your own infra instead of AWS’ bandwidth gouging.
Another user pointed out that Firefox Send is written to use an Amazon S3 compatible API to run. That could mean that Mozilla is using AWS for the service.
Re: Firefox Send: Free encrypted file transfer service
#429I really don't understand why they didn't share a link to the repository in the article. For anyone who's interested - here it is: https://github.com/mozilla/send
It's because this blog is for mainstream audiences who don't know what GitHub is and might be scared of all that code-y stuff if they accidentally clicked on it.
I'm not so sure about that. I have a difficult time believing that anyone in the "mainstream audience" would take the time to read Mozilla's blog posts, or more generally the blog posts of any tech company.
Re: Firefox Send: Free encrypted file transfer service
#430Very clean and nice, but how is this financed? That is, who's paying for the server storage and the bandwidth?
Read here for the why: https://github.com/mozilla/send/blob/master/docs/metrics.md
One of their KPIs is: "Percent of users who have or create an FxAccount via Send, Why: representation of % of any service users who might be amenable to an upsell"
From this it seems that their moneymaker is the new Firefox account creations that will be driven by this service, to whom they can then upsell. But it doesn't state what they are trying to upsell. Anyone got any idea what that might be?