Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox Send: Free encrypted file transfer service

blog.mozilla.org

Post reply on HN
Print view View original

211–220 of 542 posts

Re: Firefox Send: Free encrypted file transfer service

#211

Post by timvisee »

bjt2n3904 wrote: post #206

I don't understand the end-to-end encryption claim. 1. Bob uploads a file, but specifies no password. 2. ??? 3. Sue downloads the file. Best case, Bob's browser encrypts it (with javascript?) before uploading. Either Mozilla provides a key, or Bob sends the key he used. When Sue's browser downloads it, Mozilla sends the key and her browser decrypts it client side. In either case, Mozilla has the password for decrypti…

The client encrypts the file that is uploaded, along with some metadata. The key is appended to the share URL provided by the URL, in the fragment/hash, and is never sent to the remote server. Only people having the URL including the secret will be able to download and decrypt your shared file. See https://github.com/mozilla/send/blob/master/docs/encryption....

Re: Firefox Send: Free encrypted file transfer service

#212

Post by aaaaaaaaaaab »

chongli wrote: post #66
mFixman wrote: post #12

I can't believe that there isn't a simple service to transfer data between my cellphone and my computer without going through the internet. iTunes is terribly bloated, MTP is a mess, and Bluetooth is slow and frustrating. Back in my hacker day I used to have an SSH server open on my cellphone and use it to transfer files back and forth with my computer. Why isn't there a mainstream service like that?

I just use iCloud Drive. Files on my desktop and in my documents folder get automatically synced to my phone and vice versa. It's extremely easy and painless. I often find myself on my phone, saving a file to my iCloud desktop, and finding the file on my desktop the next time I open the lid of my laptop.

>without going through the internet

Re: Firefox Send: Free encrypted file transfer service

#213

Post by supermatt »

laumars wrote: post #110
supermatt wrote: post #52

Earlier quoted context omitted.

this is an artificial apple restriction. other vendors allow you to do exactly this

Other vendors used to allow you to do this back when internal storage was vfat formatted but it's not been an option these days because Windows and Macs wouldn't have the file system drivers to read the storage. This is why MTP was created. However MTP is - in my experience - complete garbage and creates as many problems as it solves.

Mounting MTP is transparent to the user on non-apple OSes as well. You can drag and drop files as you could when it was when mounting the VFAT block device. Its only on MacOS that this isn't handled gracefully.

So yeah, apple is only mobile you cant do this on at all, and apple is only desktop OS you cant access other phones that permit it on (without installing some 3rd party tool).

As an aside, I write this as an apple user (iphone, ipad, watch, macbook pro), and Im feeling quite infuriated thinking back on this.

Re: Firefox Send: Free encrypted file transfer service

#216

Post by [deleted] »

bjt2n3904 wrote: post #206

I don't understand the end-to-end encryption claim. 1. Bob uploads a file, but specifies no password. 2. ??? 3. Sue downloads the file. Best case, Bob's browser encrypts it (with javascript?) before uploading. Either Mozilla provides a key, or Bob sends the key he used. When Sue's browser downloads it, Mozilla sends the key and her browser decrypts it client side. In either case, Mozilla has the password for decrypti…

[deleted]

Re: Firefox Send: Free encrypted file transfer service

#217

Post by lol768 »

bjt2n3904 wrote: post #206

I don't understand the end-to-end encryption claim. 1. Bob uploads a file, but specifies no password. 2. ??? 3. Sue downloads the file. Best case, Bob's browser encrypts it (with javascript?) before uploading. Either Mozilla provides a key, or Bob sends the key he used. When Sue's browser downloads it, Mozilla sends the key and her browser decrypts it client side. In either case, Mozilla has the password for decrypti…

It seems vulnerable to an active MitM - if the attacker is in a position to serve malicious JS that exfiltrates the data from window.location.hash.

I think the scheme is fairly robust against passive interception though.

Re: Firefox Send: Free encrypted file transfer service

#218

Post by TheShrug »

_bxg1 wrote: post #100

Ah man, I literally came up with (and prototyped) this exact thing in 2013. Minus the end to end encryption. I dropped it mostly because I wasn't sure how to prevent illegal use and didn't want to be liable. Edit: mine was actually (partially) better because it assigned a short PIN instead of a full link, which meant you could just look at it and remember it for typing-in, instead of requiring a separate channel to "…

A short PIN seems nice for personal use (maybe on a self-hosted service) but wouldn't a short PIN allow people to potentially guess random PINs and download files that they shouldn't have access to?

Re: Firefox Send: Free encrypted file transfer service

#219

Post by omouse »

mFixman wrote: post #12

I can't believe that there isn't a simple service to transfer data between my cellphone and my computer without going through the internet. iTunes is terribly bloated, MTP is a mess, and Bluetooth is slow and frustrating. Back in my hacker day I used to have an SSH server open on my cellphone and use it to transfer files back and forth with my computer. Why isn't there a mainstream service like that?

It's because the whole app ecosystem is proprietary and the open source packages aren't as polished. I remember when it was a huge pain to use Bonjour.

It seems like this should be a solved problem but maybe it takes a Mozilla or some other larger entity to push the marketing and the customer support and development to really solve the problem of transferring large files securely.

Re: Firefox Send: Free encrypted file transfer service

#220

Post by woah »

lol768 wrote: post #217
bjt2n3904 wrote: post #206

I don't understand the end-to-end encryption claim. 1. Bob uploads a file, but specifies no password. 2. ??? 3. Sue downloads the file. Best case, Bob's browser encrypts it (with javascript?) before uploading. Either Mozilla provides a key, or Bob sends the key he used. When Sue's browser downloads it, Mozilla sends the key and her browser decrypts it client side. In either case, Mozilla has the password for decrypti…

It seems vulnerable to an active MitM - if the attacker is in a position to serve malicious JS that exfiltrates the data from window.location.hash. I think the scheme is fairly robust against passive interception though.

Client side encryption keeps honest companies honest but no more than that
Post reply on HN