511–520 of 542 posts
I'm quickly running out of excuses for still using Chrome...
Here, I'll type the download link for you: https://firefox.com
Earlier quoted context omitted.
Yes and no, depending on your threat scenario. I would assume Signal to have a proper signing infrastructure in place, so that the keys used to sign new releases are not available to the server hosting/deploying the actual update files (or providing them to Google/Apple for that matter). So simply taking over that server would not be enough, as malicious updates could not be installed. Assuming Moxie goes over to the…
Signing infrastructure does seem like a significant improvement over Javascript delivery, but does that also carry over to platforms like Windows? Again, please correct me if I'm wrong, but Windows doesn't do anything with signing app updates, does it? Come to think of it, I'm not 100% sure my Linux version has this either, since Signal isn't being distributed as part of the official repos. If Signal is being updated…
You can always implement signing yourself, though, without relying on somebody else's infrastructure. Just include the public key in the app itself and use it to verify your updates are properly signed by your private key before accepting them. I haven't checked but assume/hope Signal is doing this with their updated JS packages.
If none of this were to happen, however, then the answer to your last question is "yes", though with a caveat: If Signal's servers are compromised and push out a malicious update, then all bets are off, as the app running on your system has access to all your unencrypted messages. If the compromised server is only one of the messaging/relay servers, however, things are not as bad, as they don't have access to your keys and thus can't decrypt your messages. They can still forward them somewhere else for later decryption, but thanks to perfect forward secrecy this is currently rather unrewarding.
Hope Firefox Send solves this ever present problem ;)
Swisstransfer.com is more or less the same, but with 25Gb and no sign up
Earlier quoted context omitted.
I love it as well, but my one gripe with the Android app is that it does not support read/write sync on external storage (SD cards). This means, in my case, that I have to share photos from my phone in a read-only fashion. It's not a deal-breaker by any means, but it's annoying, because if I want to add photos to my collection that were obtained elsewhere (e.g. my underwater camera), I have to transfer those files to…
I would suspect that if you reconfigure your SDCard to be internal storage then it will work again. This is a limit of Android permissions that happened a couple of major versions ago (I use a different tool for file transfer and I remember when it stopped being able to transfer files to external storage).
a bit off topic but here it goes... This is how i think Mozilla can capture more users back to Firefox. By providing "extra" services attached to the Mozilla and Firefox brand will make them a superior product to the end user. Sure it's hard to compete with Chrome but if you offer useful features and services integrated in your Browser i see that Mozilla actually has a chance to compete with Google for the browser sp…
How is that different from the complaints people make about Chrome tightly integrating with Google?
Earlier quoted context omitted.
Literally all they need to do is advertise tree style tabs. It's the reason half my office stopped using Chrome.
That's an add-on right? I don't think they can advertise something that's not in Firefox's core
Earlier quoted context omitted.
The client encrypts the file that is uploaded, along with some metadata. The key is appended to the share URL provided by the URL, in the fragment/hash, and is never sent to the remote server. Only people having the URL including the secret will be able to download and decrypt your shared file. See https://github.com/mozilla/send/blob/master/docs/encryption....
Thanks for the info. Let me see if I understand this correctly. Browsers don't send the anchor tag (ie: with GET requests). FF Send takes advantage of this by using the anchor tag to store the key for decryption. That is kinda novel. You still need to trust the upload client to not leak the key, but I see that you've written a CLI version. Interesting! Thanks for the response.