Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox Send: Free encrypted file transfer service

blog.mozilla.org

Post reply on HN
Print view View original

531–540 of 542 posts

Re: Firefox Send: Free encrypted file transfer service

#531

Post by anon4242 »

skrebbel wrote: post #499
anon4242 wrote: post #424

Earlier quoted context omitted.

> In a web app, a single compromised server will compromise all security instantly. This is only true if the server has access to the keys of your data. E2EE typically means that it doesn't, only you do.

And how does that work with Firefox Send? Isn't the key somehow in the payload or the URL?

Without knowing almost anything about Firefox Send, it does seem that the key is embedded in the link you give to your friends. In that case E2E means that the key is not stored on the server. In order to guarantee that, the link is probably in two parts, one that identifies the file on the server and one is the key. The key part of the link is probably generated on your machine and thus never sent to the server (to prevent it being in any logs or what not). So if Mozilla's servers are compromised the attacker still would not be able to decrypt your files. Of course if the server is compromised the attacker could serve up malicious JS for future uploads.

Re: Firefox Send: Free encrypted file transfer service

#532

Post by dchest »

anon4242 wrote: post #530
dchest wrote: post #444

Earlier quoted context omitted.

In a browser, the server serving the JS has an opportunity to access the keys.

This is the case with all E2EE tools. You have to trust that they do their crypto correct and that they aren't evil. As Firefox Send is open source you can setup your own server if you don't trust Mozilla, but then again, if you don't trust Mozilla you might want to eyeball their code carefully first...

Your description is very simplistic, but yes, you have to trust the code that's delivered to you. For example, no Android/iOS user would check every single update to E2EE apps they install for backdoors. However with web, there's an opportunity for a backdoor in every single request and the server can ship different code to different users. In my opinion, using web cryptography is still worth it, but it's definitely more risky than native apps.

Re: Firefox Send: Free encrypted file transfer service

#533

Post by akelly »

sirsuki wrote: post #182
huhtenberg wrote: post #88

Very clean and nice, but how is this financed? That is, who's paying for the server storage and the bandwidth?

First off, Mozilla believes in the service. Mozilla itself gets funding from donations and corporate backing (I think). The cost of bandwidth is small compared to other file share sites in that the files stored are temporary. The transient nature of the files means that the max storage space needed is relative to the concurrent number of users. Bandwidth also. That means sans a very clever DDoS their expenses should…

I believe that most of Mozilla's revenue comes from Google profit-sharing, because they make it the default search engine.

Re: Firefox Send: Free encrypted file transfer service

#536

Post by srecio »

timvisee wrote: post #211
bjt2n3904 wrote: post #206

I don't understand the end-to-end encryption claim. 1. Bob uploads a file, but specifies no password. 2. ??? 3. Sue downloads the file. Best case, Bob's browser encrypts it (with javascript?) before uploading. Either Mozilla provides a key, or Bob sends the key he used. When Sue's browser downloads it, Mozilla sends the key and her browser decrypts it client side. In either case, Mozilla has the password for decrypti…

The client encrypts the file that is uploaded, along with some metadata. The key is appended to the share URL provided by the URL, in the fragment/hash, and is never sent to the remote server. Only people having the URL including the secret will be able to download and decrypt your shared file. See https://github.com/mozilla/send/blob/master/docs/encryption....

Won't most people just share the links over email? With the decryption key in the url I don't see very good security guarantees here

Re: Firefox Send: Free encrypted file transfer service

#539

Post by tvmalsv »

BrandonM wrote: post #421
emddudley wrote: post #15

I've used this before to send sensitive documents to my attorney, who would have otherwise just wanted email attachments. It worked great.

Based on what I've read, the security model seems to be almost the same as email attachments?

One really big advantage of Send over attachments is that you don't have seemingly immortal copies of the files hanging around in people's mail clients and/or IMAP servers.
Post reply on HN