Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox Send: Free encrypted file transfer service

blog.mozilla.org

Post reply on HN
Print view View original

481–490 of 542 posts

Re: Firefox Send: Free encrypted file transfer service

#481

Post by timvisee »

philsnow wrote: post #297
timvisee wrote: post #211

Earlier quoted context omitted.

The client encrypts the file that is uploaded, along with some metadata. The key is appended to the share URL provided by the URL, in the fragment/hash, and is never sent to the remote server. Only people having the URL including the secret will be able to download and decrypt your shared file. See https://github.com/mozilla/send/blob/master/docs/encryption....

Anybody who can catch the link in transit can get the file. Emailing these links with the decryption key right in the fragment is going to allow any party in between the sender and the receiver to fetch the file. (If the file is set to only allow downloading once, the receiver can at least let the sender know that it got intercepted.) So you have to send the link through some previously-negotiated secure channel. At…

Yes. I would like to add though, that you can set an optional password as well. Without it the link would be useless. You can share it through a different channel.

Re: Firefox Send: Free encrypted file transfer service

#482

Post by gnud »

scriptkiddy wrote: post #338
lmedinas wrote: post #263

a bit off topic but here it goes... This is how i think Mozilla can capture more users back to Firefox. By providing "extra" services attached to the Mozilla and Firefox brand will make them a superior product to the end user. Sure it's hard to compete with Chrome but if you offer useful features and services integrated in your Browser i see that Mozilla actually has a chance to compete with Google for the browser sp…

Along the same lines, a Gmail-esque Thunderbird web service would be amazing. I could finally de-google myself completely if that were the case. Currently, I need to set up my own email hosting through a service like fastmail and then configure a desktop client(like Thuderbird) to use it. A Mozilla Gmail-esque service would remove a lot of the friction there and probably bring in a bunch of users who are tired of goo…

Fastmail has a nice (and snappy) web interface. So you don't _need_ to set up a desktop client, unless you want to.

Re: Firefox Send: Free encrypted file transfer service

#483

Post by the8472 »

skrebbel wrote: post #368

In the not so recent past, HN'ers loved to quote tptacek's legendary rant about how in-browser JavaScript crypto is fundamentally broken[0]. What changed? Is that rant finally outdated? Couldn't Mozilla at any time serve a corrupted JS bundle (with or without their knowledge) which would leak the key somewhere, silently replace the encryption by a noop, etc? I ask out of interest, not skepticism. I much prefer an int…

Fundamentally the situation has not changed much. You redownload the code every time and servers could deliver tailored compromised versions if ordered so by some TLA. Which means audits have limited values since they can't attest that what they have seen is actually what anyone gets.

Compare with native tools which you only download once, can check its signatures and which strive for reproducible builds so that multiple parties can verify them independently.

Re: Firefox Send: Free encrypted file transfer service

#484

Post by mehrdadn »

skrebbel wrote: post #368

In the not so recent past, HN'ers loved to quote tptacek's legendary rant about how in-browser JavaScript crypto is fundamentally broken[0]. What changed? Is that rant finally outdated? Couldn't Mozilla at any time serve a corrupted JS bundle (with or without their knowledge) which would leak the key somewhere, silently replace the encryption by a noop, etc? I ask out of interest, not skepticism. I much prefer an int…

There was also a time just a few years ago when evangelists claimed JS/CS/etc. were just as fast as native (some said faster) and blasted you for suggesting otherwise, even when it was clear as daylight this was blatantly false. This mantra also suddenly just faded away once native compilers for these gained popularity. I guess reality hits you after some time.

Now I see a similar issue with security experts preaching that merely possessing a single piece of software with a single thing they classify as a 'vulnerability' implies you will be murdered within the next 24 hours, and it seems they'll happily DoS your computer, get you fired from your job, take your second newborn, and blow up your computer in your face if that's what it will take to make you finally feel real danger. Not sure why it takes people so long to see that reality isn't black-and-white, but better late (hopefully) than never.

Re: Firefox Send: Free encrypted file transfer service

#485

Post by marcus_holmes »

I'm working on a file sharing product, for the niche use case of sharing documents between family and professional providers (lawyers, accountants, etc).

Documents are mostly emailed to recipients at the moment (unless they're too large, in which case... um....). The main problem we see is that you end up storing documents in email attachments on your email provider, and using email search tools to try and find documents.

Would this end up the same, only with all documents ending up in the Downloads folder?

Am I wasting my time working on creating a cloud storage sharing solution, and be better working on a method of organising files on the drive, that can also send them to other people?

Re: Firefox Send: Free encrypted file transfer service

#486

Post by mrdoops »

marcus_holmes wrote: post #485

I'm working on a file sharing product, for the niche use case of sharing documents between family and professional providers (lawyers, accountants, etc). Documents are mostly emailed to recipients at the moment (unless they're too large, in which case... um....). The main problem we see is that you end up storing documents in email attachments on your email provider, and using email search tools to try and find docum…

Generate a temporary link that, when clicked sends an event to your system to deprecate the link and redirect the user to a presigned S3 download. In my case the file attachment was the product and it was important the system know when someone had downloaded, but a backend system that keeps temporary urls and requests a temporary download link from the file provider is a useful pattern. Nice thing about signed links is your server doesn't have to handle the file - it's between the client and storage provider.

Re: Firefox Send: Free encrypted file transfer service

#487

Post by gnachman »

skrebbel wrote: post #389
fouadmatin wrote: post #374

Earlier quoted context omitted.

SubtleCrypto is a new browser-adopted spec for performing crypto operations natively. For example, instead of using Math.random() for random number generation, you can use https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getR... in combination with the SubtleCrypto functions to work with keys securely Your points around a compromised JS bundle are still possible but that has more to do with a company’s deploym…

> Your points around a compromised JS bundle are still possible but that has more to do with a company’s deployment/change management setup than JS itself imo But that's the only point I intend to address here. If Pascal had been the language of the web then my question would have been about Pascal. Therefore I don't see how SubtleCrypto changes matters much. In short, if I get it right, the argument would be that in…

If it works, it prevents mass surveillance and makes insider attacks much more difficult.

Re: Firefox Send: Free encrypted file transfer service

#488

Post by scriptkiddy »

gnud wrote: post #482
scriptkiddy wrote: post #338

Earlier quoted context omitted.

Along the same lines, a Gmail-esque Thunderbird web service would be amazing. I could finally de-google myself completely if that were the case. Currently, I need to set up my own email hosting through a service like fastmail and then configure a desktop client(like Thuderbird) to use it. A Mozilla Gmail-esque service would remove a lot of the friction there and probably bring in a bunch of users who are tired of goo…

Fastmail has a nice (and snappy) web interface. So you don't _need_ to set up a desktop client, unless you want to.

I've used for a contract project I worked on. It wasn't bad, but it was difficult to filter when there was a lot of messages.

Re: Firefox Send: Free encrypted file transfer service

#490

Post by JonathonW »

As I understand it, this "guarantees" privacy by embedding the key in the link-- if that's generated client-side, it never gets sent to Mozilla's servers (assuming they don't go out of their way to grab it via JavaScript) and you can have end-to-end encryption.

But, if I'm logged in, it looks like Mozilla's storing that fragment on their servers: if I upload a file from one browser, then sign in on a different browser, I can see the link I generated (including the fragment) from the first browser in my list of uploads, and I can download the file.

Doesn't that negate their end-to-end encryption if Mozilla servers have access to the keys?

Post reply on HN