Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox Send: Free encrypted file transfer service

blog.mozilla.org

Post reply on HN
Print view View original

501–510 of 542 posts

Re: Firefox Send: Free encrypted file transfer service

#501

Post by skrebbel »

tptacek wrote: post #493
skrebbel wrote: post #368

In the not so recent past, HN'ers loved to quote tptacek's legendary rant about how in-browser JavaScript crypto is fundamentally broken[0]. What changed? Is that rant finally outdated? Couldn't Mozilla at any time serve a corrupted JS bundle (with or without their knowledge) which would leak the key somewhere, silently replace the encryption by a noop, etc? I ask out of interest, not skepticism. I much prefer an int…

It's not outdated; it remains fundamentally true. But I'm uncomfortable with people calling it a "legendary rant" because it was dashed off and I never promoted it as any kind of last word on the subject. There are better arguments against browser cryptography than mine. In particular: you'd hope that WebCrypto would have changed things a bit, but, of course, it doesn't: it leaves all the cryptographic joinery up to…

I don't think it's you who made it legendary. I think it's the HN commenters who keep linking to it who did that (myself included, since yesterday).

And, well, you may disagree but to me it definitely reads like a proper rant :-)

Please note that I chose the words "legendary rant" with all the love imaginable and I had hoped you'd interpret it as nothing other than a compliment. I much appreciate your contributions to HN and the internet as a whole.

Re: Firefox Send: Free encrypted file transfer service

#502

Post by ibotty »

Rebelgecko wrote: post #401
coderunner wrote: post #388

Earlier quoted context omitted.

Is there a cheaper S3 alternative that you recommend or that Mozilla's likely using instead?

I think Backblaze's cloud storage is the cheapest I've seen. Microsoft and Google would also be a bit cheaper than S3

But it's not s3 compatible.

Re: Firefox Send: Free encrypted file transfer service

#503

Post by lmedinas »

asdgiobiobiuo wrote: post #457
lmedinas wrote: post #263

a bit off topic but here it goes... This is how i think Mozilla can capture more users back to Firefox. By providing "extra" services attached to the Mozilla and Firefox brand will make them a superior product to the end user. Sure it's hard to compete with Chrome but if you offer useful features and services integrated in your Browser i see that Mozilla actually has a chance to compete with Google for the browser sp…

You may be right, but I hate it. There is no reason I can think of to have all these tools integrated into a web browser, and the idea of having the Internet broken into silos based on your choice of browsers scares me. We don't need another AOL Chrome.

the problem with "AOL Chrome" is that it's based on advertising and internet company services where Mozilla has a chance to provide a service, even if it could be paid, without advertising and privacy friendly like their latest experiments.

Re: Firefox Send: Free encrypted file transfer service

#504

Post by Vinnl »

asdgiobiobiuo wrote: post #457
lmedinas wrote: post #263

a bit off topic but here it goes... This is how i think Mozilla can capture more users back to Firefox. By providing "extra" services attached to the Mozilla and Firefox brand will make them a superior product to the end user. Sure it's hard to compete with Chrome but if you offer useful features and services integrated in your Browser i see that Mozilla actually has a chance to compete with Google for the browser sp…

You may be right, but I hate it. There is no reason I can think of to have all these tools integrated into a web browser, and the idea of having the Internet broken into silos based on your choice of browsers scares me. We don't need another AOL Chrome.

Good to know is that Send is not a silo: you can use it with any browser.

Re: Firefox Send: Free encrypted file transfer service

#505

Post by wereHamster »

dchest wrote: post #444
anon4242 wrote: post #424

Earlier quoted context omitted.

> In a web app, a single compromised server will compromise all security instantly. This is only true if the server has access to the keys of your data. E2EE typically means that it doesn't, only you do.

In a browser, the server serving the JS has an opportunity to access the keys.

subtlecrypto has API to generate a keypair that you can't extract and access from the JS side. You can only use it to encrypt/decrypt buffers, but not access the key itself.

Re: Firefox Send: Free encrypted file transfer service

#506

Post by marcus_holmes »

77ko wrote: post #496
marcus_holmes wrote: post #485

I'm working on a file sharing product, for the niche use case of sharing documents between family and professional providers (lawyers, accountants, etc). Documents are mostly emailed to recipients at the moment (unless they're too large, in which case... um....). The main problem we see is that you end up storing documents in email attachments on your email provider, and using email search tools to try and find docum…

Why have a file transfer for imp docs when you can have a single authoritative source of truth for those docs, along with version history and who changed what. So why not just use Google Drive (or dropbox)? I feel with features like secure file sharing (though only with other ppl with google accounts), reasonably good security[1] and Inactive Account Manager[2] it should work for legal docs. Especially considering Go…

There are file sharing use cases not covered by Google Drive or Dropbox. Briefly:

Google reads (and censors, not that that would be an issue) anything added to Drive (and uses that data to target ads at you). And Docs is primarily aimed at collaboration rather than secure file sharing. And revoking permissions isn't easy. And it's all tied up in to Google identities, which may or may not be a recipient's personal Google ID rather than their professional ID - everyone has a separate work email, not everyone has a separate work Google ID.

Dropbox is designed to synchronise a folder between two devices. You can use it to share documents, but that's not what it was designed to do. And if someone deletes it off the shared folder, it gets deleted for everyone... not ideal in this use case. It also creates a dropbox folder on the user's hard drive, and will automatically upload anything in that folder, and copy that to everyone else sharing that folder... it's democratic when this use case needs to be authoritarian.

Does that make sense?

Re: Firefox Send: Free encrypted file transfer service

#507

Post by Vinnl »

Peter-Jan wrote: post #430
casefields wrote: post #426

Earlier quoted context omitted.

Read here for the why: https://github.com/mozilla/send/blob/master/docs/metrics.md

One of their KPIs is: "Percent of users who have or create an FxAccount via Send, Why: representation of % of any service users who might be amenable to an upsell" From this it seems that their moneymaker is the new Firefox account creations that will be driven by this service, to whom they can then upsell. But it doesn't state what they are trying to upsell. Anyone got any idea what that might be?

I would imagine that to be Firefox itself and Firefox for Android/iOS. I've seen people easily set up syncing on Google Chrome because they already have a Google account to which they might even already be logged in, while they're completely unaware that Firefox has a similar feature.

If you already have a Firefox account, the barrier to using Firefox Sync is lower, and with that, the barrier to using Firefox for Android/iOS is lower.

Re: Firefox Send: Free encrypted file transfer service

#508

Post by marcus_holmes »

mrdoops wrote: post #486
marcus_holmes wrote: post #485

I'm working on a file sharing product, for the niche use case of sharing documents between family and professional providers (lawyers, accountants, etc). Documents are mostly emailed to recipients at the moment (unless they're too large, in which case... um....). The main problem we see is that you end up storing documents in email attachments on your email provider, and using email search tools to try and find docum…

Generate a temporary link that, when clicked sends an event to your system to deprecate the link and redirect the user to a presigned S3 download. In my case the file attachment was the product and it was important the system know when someone had downloaded, but a backend system that keeps temporary urls and requests a temporary download link from the file provider is a useful pattern. Nice thing about signed links…

yeah, I've implemented that temporary link system together with link expiry by date, by access count, and link passwords.

I'm encrypting the file on arrival, and storing it encrypted, so it has to route back through the decryption stream. But I could move that to a separate module and replace it with signed S3 if there was benefit.

Re: Firefox Send: Free encrypted file transfer service

#509

Post by Vinnl »

kgwxd wrote: post #226
Cyphase wrote: post #209

Earlier quoted context omitted.

The same reason it's Chromecast, not Googlecast.[1] Branding. [1] The protocol is named Google Cast, but all the consumer branding is Chromecast.

I was thinking the same thing but in Google's case, Chrome is the dominate browser and most people recognize it as something they already have. In the case of Firefox, it's more likely they'll recognize the name specifically as the browser they don't have and will think they can't use it.

I think what helps is that there's two (or more) parties to a file transfer: the sender and the recipient. Someone who uses Firefox might start using Send, and then the recipient(s) finds out that they can use it too. And if they're using Send, the might start to consider using Firefox, or to create a Firefox account first.

Re: Firefox Send: Free encrypted file transfer service

#510

Post by nukeop »

kvark wrote: post #107
nukeop wrote: post #44

I wish Mozilla focused on core Firefox functionalities instead of coming up with so many small side projects that don't target their typical audience. Since Chromium-based browsers are not an option, many of us are stuck with Firefox as the only remaining choice. But even Firefox has to be heavily customized before it's completely deGoogled and stops contacting various motherships. As a side note Nightly build for Ub…

Is there anything specific you are missing in Firefox today? Or is it purely the fact that it's broken since version 61? Did you submit a bugzilla issue, or know the existing number? I'd be happy to check it out.

A million things, like missing functionalities from the new extensions api (meaning no Pentadactyl), no good way to manage keyboard shortcuts, having to disable many google integrations after installation, no way to disable "do not track" if using built-in tracker blocking, no sidebars a la Vivaldi, buggy rendering (e.g. transitions animating elements using css transforms), unexplained slowdowns, lack of proper tab isolation (one slow/crashed tab takes the whole browser with it), etc. I could rant all day.
Post reply on HN