For anyone that is interested: https://github.com/timvisee/ffsend
At any rate, the tool works! Thanks so much.
I wasn't fully ready with this tool for the Firefox Send release to be honest, would have loved to be able to provide better binaries and packages for more platforms, which are a work in progress.
If you believe you can improve the README with your solution, be sure to submit a [PR](https://gitlab.com/timvisee/ffsend/).
Happy to see it's working! :)
disclaimer: I haven't used either cli version.
Mind if I port this to JS?
You are free to port the project to JS as long as you follow the applicable licenses: https://github.com/timvisee/ffsend/blob/master/LICENSE
Along with ffsend, you can use any browser to upload/download files through https://send.firefox.com/ as well.
What changed? Is that rant finally outdated? Couldn't Mozilla at any time serve a corrupted JS bundle (with or without their knowledge) which would leak the key somewhere, silently replace the encryption by a noop, etc?
I ask out of interest, not skepticism. I much prefer an internet where we can trust web apps to do proper crypto than one where we have to depend on some app store to somewhat adequately protect us.
[0] https://www.nccgroup.trust/us/about-us/newsroom-and-events/b...
The main thing is that unless you're paying really really close attention to the JS that you're executing, you can't trust this any more than you can trust Mozilla and the security of whatever computer is serving their pages. I wouldn't use this for sending data that you're trying to hide from a nation-state, but it looks like a great option if you want to send a video to your grandma without posting it publicly on the internet or teaching her how to use GPG.
I have Signal running on my Linux computer and on my Android phone. On the Linux computer it doesn't have root access, but it does have access to its own files, so in theory there's nothing to prevent it from making a network request and updating itself. Additionally, I don't ever check Signal before installing a new update, I just blindly do it.
On my Android device, I also have auto-update turned on, because my only option is to turn it on for every app or none of them. So there's nothing to prevent Signal from updating itself and changing the crypto. If I were on an iOS device, I wouldn't even have that option -- to the best of my knowledge you can not turn off app auto-updates on an iPhone, but maybe someone can correct me if I'm wrong. In any case, it doesn't matter that Signal is updated "rarely". An attacker only needs to install one back door, they don't need to update it a hundred times.
So for an extremely typical user like me, who has been taught for as long as I can remember that the most secure thing you can do on an OS is install updates as they come in when they come in, doesn't Signal have the exact same problems as Mozilla? If someone compromises Signal's servers, can't they add a side-channel just as easily?
In theory, I could disable auto-updates and only update Signal when I looked at the source code, just like in theory I could examine the JS that I'm executing every time I connect to a site. But in practice, I don't.
When I read tptacek's rant nowadays, the immediate thing I can think is, "The web is malleable? Literally every single computing environment and device I own is malleable." It feels like if I were to take tptacek's advice to its logical conclusion, I would just conclude that ETE encryption in general is dead.
In particular: you'd hope that WebCrypto would have changed things a bit, but, of course, it doesn't: it leaves all the cryptographic joinery up to content-controlled code. You're probably somewhat less likely to have side-channel flaws if you use it, but in reality timing side-channels are more talked about than seen. Who would bother, when they can just deliver a script that exfiltrates secrets directly?
Your points around a compromised JS bundle are still possible but that has more to do with a company’s deployment/change management setup than JS itself imo
But that's the only point I intend to address here. If Pascal had been the language of the web then my question would have been about Pascal.
Therefore I don't see how SubtleCrypto changes matters much.
In short, if I get it right, the argument would be that in eg a mobile app, all the e2e logic (the core crypto plus the code around it) go through peer-review, then some release management process, then some review by Apple or Google, before it lands in my hands via their app stores' well secured delivery mechanism. In a web app, a single compromised server will compromise all security instantly. Generally I'm fine with trusting Mozilla's servers, but if I have to trust their servers then what's the point of end to end encryption?
> WHY CAN'T I USE TLS/SSL TO DELIVER THE JAVASCRIPT CRYPTO CODE? You can. It's harder than it sounds, but you can safely transmit Javascript crypto to a browser using SSL. The problem is, having established a secure channel with SSL, you no longer need Javascript cryptography; you have "real" cryptography.
In our case we aren't doing crypto inception where the cryptography is meant to secure itself. The crypto is being served securely (by ssl) and then used to solve the separate unrelated crypto problem of encrypting random files.
> WHAT'S THE "CHICKEN-EGG PROBLEM" WITH DELIVERING JAVASCRIPT CRYPTOGRAPHY? If you don't trust the network to deliver a password, or, worse, don't trust the server not to keep user secrets, you can't trust them to deliver security code.
I haven't looked at the details of how Firefox Send works, but if you can download and decrypt the file with nothing more than an https:// URL, it seems like you'd have to trust the server, either to handle the cleartext or to provide trustworthy code to handle the cleartext.
I suppose an alternative would be to generate a data: URL, but if it has to include all the crypto code, I wouldn't expect it to be nice and compact.
Compare with native tools which you only download once, can check its signatures and which strive for reproducible builds so that multiple parties can verify them independently.
Now I see a similar issue with security experts preaching that merely possessing a single piece of software with a single thing they classify as a 'vulnerability' implies you will be murdered within the next 24 hours, and it seems they'll happily DoS your computer, get you fired from your job, take your second newborn, and blow up your computer in your face if that's what it will take to make you finally feel real danger. Not sure why it takes people so long to see that reality isn't black-and-white, but better late (hopefully) than never.
Humans are always the weakest link with the internet and someday, sometime, bad code (unknowingly) will be pushed and something will happen to someone.
(Update: Yep, just found it: https://github.com/mozilla/send, just before the comment below was posted :))
Data is encrypted at client and a url with a key is generated.
Can be used 'burn after reading or with some specific lifetime.
EDIT: Apparently there's a way to use filesystem instead of S3, it's just not well documented.
But to answer your question, I uploaded a 100mb+ file to FireFox Send, copied the link, RDPd into another computer, kicked off the download, and then cancelled it midway through download. The link did expire after that.
So I guess they don't have an easy way of telling whether the download is successful or not. Maybe Mozilla's engineers can figure something out if the issue is raised.
That checkbox is #1 reason I only use Firefox.
[1] Developer console log output: "Failed to register/update a ServiceWorker for scope ‘https://send.firefox.com/’: Storage access is restricted in this context due to user settings or private browsing mode. main.js:38:10 SecurityError: The operation is insecure."
I block _all_ cookies except for a small list of sites (like HN...).
This is how i think Mozilla can capture more users back to Firefox. By providing "extra" services attached to the Mozilla and Firefox brand will make them a superior product to the end user. Sure it's hard to compete with Chrome but if you offer useful features and services integrated in your Browser i see that Mozilla actually has a chance to compete with Google for the browser space.
This is one of the "advantages", if you are a heavy Google user, of Chrome over the competition is that everything is attached to your Google account. Passwords, history, spellers, dictionaries, shortcuts, etc...
If Mozilla comes with Send, Notes, Password Manager all integrated in Firefox i see a good way to bring back some of the previous users that switched to Chrome.
Currently, I need to set up my own email hosting through a service like fastmail and then configure a desktop client(like Thuderbird) to use it.
A Mozilla Gmail-esque service would remove a lot of the friction there and probably bring in a bunch of users who are tired of google running everything.
We don't need another AOL Chrome.
How is that different from the complaints people make about Chrome tightly integrating with Google?
As a Chrome user I can confirm. But for me the main raison I use Chrome is for the dev tools a found them better than FF
1. Bob uploads a file, but specifies no password.
2. ???
3. Sue downloads the file.
Best case, Bob's browser encrypts it (with javascript?) before uploading. Either Mozilla provides a key, or Bob sends the key he used. When Sue's browser downloads it, Mozilla sends the key and her browser decrypts it client side.
In either case, Mozilla has the password for decryption. This makes a mild barrier to mass scanning content that's uploaded, so at least that's something... but that's little more than a promise I have to trust.
Am I missing something? Where is the "end-to-end" encryption? End-to-end means I don't have to trust you (as much). Please don't turn this into a meaningless buzzword...
EDIT: I did misunderstand something. Please see timvisee's comment below.
Browsers don't send the anchor tag (ie: with GET requests). FF Send takes advantage of this by using the anchor tag to store the key for decryption.
That is kinda novel. You still need to trust the upload client to not leak the key, but I see that you've written a CLI version. Interesting! Thanks for the response.
So you have to send the link through some previously-negotiated secure channel. At that point, why not just send the file through that channel? Is it because signal/whatsapp/etc don't allow large files or because the interface is cumbersome?
I'm working on documenting the code now before I release on GitHub, but it works on the same premise :)
WebCrypto is mana from the gods...
I think the scheme is fairly robust against passive interception though.
What am I looking at here? On PyPI 'pipe' is listed as a "Module enablig a sh like infix syntax (using pipes)", and magic-wormhole's own docs just say to install with pip like anything else.
`pipx` is a convenience utility for installing cli python tools in separate virtual environments and then being able to update them nicely: https://github.com/pipxproject/pipx
So i meant
`pip install --user pipx && pipx install magic-wormhole`
That is, who's paying for the server storage and the bandwidth?
I remember sending a signed PDF via Firefox Send and was at first horrified when I realized I couldn't get the file back after 24 hours but then relieved knowing that the recipient got it and then it disappeared from the internet. Very cool!
If this were on AWS it would be around $0.09 per GB for downloads.
Secondary - In support of Revenue KPI
We believe that a privacy respecting service accessible beyond the reach of Firefox will provide a valuable platform to research, communicate with, and market to conscious choosers we have traditionally found hard to reach.
We will know this to be true when we can conduct six research tasks (surveys, A/B tests, fake doors, etc) in support of premium services KPIs in the first six months after launch.
The metrics section is interesting https://github.com/mozilla/send/blob/master/docs/metrics.md
It sounds like they're investigating a premium service offering targeted at privacy conscious users. (The secondary hypothesis covers "revenue" and will be tested by conducting "research tasks ... in support of premium services KPIs.")
I wish they added a QR code option as well. It would be perfect for quickly copying the link by snapping it with my phone so I can download later.
I also think the blog post could explain more why and how the e2e encryption works. Maybe just by showing an example link and then highlight with colors "this part is private"?
http://send.firefox.com/download/<fileid>/#<secret>
Anyone who obtains the link (e.g. via email interception) gains access to the file.
Since browsers don't transmit the anchor when requesting a resource [1], Firefox servers never see a copy of the key. Provided you trust their JavaScript.
[1] https://stackoverflow.com/questions/3067491/is-the-anchor-pa...
True, but, if a third party decides to use the intercepted link to download the file, and you have it set to a limit of 1 download, the file will self-destruct (if you trust Mozilla). This way, the recipient can know that someone has tampered with the communication, which is certainly an improvement over the status quo (email attachments).
How do they handle abuse though? Like, people using it to host, say, pirated TV shows? Maybe a max download limit that makes it impractical for that use case?
One can always split files.
It only takes screenshots within the confines of a Firefox window.
[1] The protocol is named Google Cast, but all the consumer branding is Chromecast.
Currently, my scanner conveniently sends me emails with scanned documents. But I have not insight into how they actually store and delete the document on the backend.
Would be great if the scanner had the option to upload to Firefox Send and show me a QR code to download it on other devices.
Hinges on the browsers never sending that key, though.
If you want, you can also set a passphrase on the file to share via another channel
If that's the case, I think setting a passphrase should be mandatory. Proxy servers are extremely common at every workplace. Since they probably log all requests, they will capture all keys in the URL.
For certain reasons I get a ton of dropbox space, but for my friends, data quotas kick in on even simple files shared like this.
I believe this is a primary upgrade mechanism for DB--I'd say this new firefox offer is in competish.
Using their revenue from search, like everything else they pay for.
> What's the upside for Mozilla?
"Our mission is to ensure the Internet is a global public resource, open and accessible to all. An Internet that truly puts people first, where individuals can shape their own experience and are empowered, safe and independent."
It works on chrome, and does not work on IE 11 (win 7 doesn't support edge)
https://news.ycombinator.com/item?id=15450524
I haven't been able to upload a file to try.
Much lower trust assumptions
Functionality for dropboxes
We get a lot of customers who want to send us secure data (customer info, etc...) and I’d love a way to make it easy for the customer but still secure.
Does something like this exist, or is this still a pipe dream? Basically FF send, except I provide a known public key to use, rather than it being generated on the fly, requiring the user to find a way to send it to me out-of-band.
Documents are mostly emailed to recipients at the moment (unless they're too large, in which case... um....). The main problem we see is that you end up storing documents in email attachments on your email provider, and using email search tools to try and find documents.
Would this end up the same, only with all documents ending up in the Downloads folder?
Am I wasting my time working on creating a cloud storage sharing solution, and be better working on a method of organising files on the drive, that can also send them to other people?
So why not just use Google Drive (or dropbox)?
I feel with features like secure file sharing (though only with other ppl with google accounts), reasonably good security[1] and Inactive Account Manager[2] it should work for legal docs. Especially considering Google is going to be around for a while.
I would rather use a Mozilla offering but they don't really have too many things for regular consumers outside of firefox and send.
[1]: https://myaccount.google.com/security [2]: https://support.google.com/accounts/answer/3036546?hl=en
But, if I'm logged in, it looks like Mozilla's storing that fragment on their servers: if I upload a file from one browser, then sign in on a different browser, I can see the link I generated (including the fragment) from the first browser in my list of uploads, and I can download the file.
Doesn't that negate their end-to-end encryption if Mozilla servers have access to the keys?
Volafile’s multi-file “room” functionality, with chat, makes it more suited for sharing files among multiple people, while Firefox Send is optimized for sending a single file to a single person or a targeted group.
Is it possible to audit the tech? Is Firefox send open source?
"Firefox Send: a free encrypted file transfer service"
1 to 100 downloads, 1 is the default; or 5 minutes to 7 days, 1 day is the default. And an option to protect with a password.
Upon expiration, entering the URL behaves the same as if you enter a bogus URL, it's basically denied to have ever existed, i.e. it doesn't say this URL has expired.
So what happen once this get popular and waiting to be abused? Just like Mega. Who is going to continue and foot the bill?
about revenue, there are so many valuable directions this can go. It could undercut competitors in ways they cannot sufficiently respond to. (google responding in kind would leave them less reason to not add encrypted storage for drive) By stabilizing this platform they can start to build new privacy-enhancing apps on top. Calendar, contacts, etc. With more dependency on the platform, they will find areas where more storage, longer retention, will be income generating.
privacy may be the only frontier that can displace google,apple,microsoft.
Tutanota also provides free encrypted file transfer service.-- Tresorit Send:https://send.tresorit.com/ ,which allows you to upload and share up to 5GB files using the same end-to-end encrypted technology.
Elseways, It might be that they have bigger plans with it. This might be just a product to learn about market potentials.
Mozilla's manifesto is all about the Internet and Internet privacy. File sharing is one of the areas where the internet is losing privacy.
Edit: mine was actually (partially) better because it assigned a short PIN instead of a full link, which meant you could just look at it and remember it for typing-in, instead of requiring a separate channel to "send" the link.
That's basically a hello world project. As you found out, the hard part is everything else, like funding it.
Honestly half of why I took it down is nobody was really using it. I didn't work terribly hard to market it, as I had no aspirations of getting rich and it would've been tenuous to monetize at all. I just told friends about it, etc.
I didn't imply there was a "hard part" to it. Just a neat idea. No need to dump on it.
It was called "Catch"
The motivating case was when you're in physical proximity to the destination device, but don't have any account linkage between the two (not even messaging/email/social accounts that are connected). The original idea came from university computer labs: transferring homework between the lab computer and a personal one was a pain. I had to sign into dropbox in the browser (and 2FA), or attach it to an email, or carry around a flash drive (which wouldn't work on phones), or whatnot. Just to move the file three feet. A glanceable code with no sign-in bridged that gap.
Other use-cases include people you don't know very well (and therefore don't have an email, phone number, etc.). We demonstrated the prototype to a crowd by uploading a file with the code visible on the projector, and suddenly everyone in the crowd had the file. That was pretty cool.
Here, I'll type the download link for you: https://firefox.com
P2P would be much better, but this isn't that.
Hope Firefox Send solves this ever present problem ;)
Back in my hacker day I used to have an SSH server open on my cellphone and use it to transfer files back and forth with my computer. Why isn't there a mainstream service like that?
1. P2P doesn’t give Google all that juicy mineable data that they get when everything you do makes round trips through their servers.
2. This would also implicitly encourage Android users to rely more on services like Google Drive/Docs for all files, which is good for them.
Edit: Apparently it is disputed that iOS has superior P2P file transfer support vs Android (see reply below), so perhaps all this is a moot point. I was assuming the truth of the parent post, and didn’t realize it was contentious; and since I’m not an Android or iOS expert, I can’t really argue that topic either way.
EDIT: I know you said without going through the internet. Syncthing can be configured to only transfer over specific networks (e.g. home LAN/WI-FI)
I keep my phone's picture in sync with my personal computers ("send only" so I can remove old photos when my SD card is getting full).
I sync a "media" folder where I dump all the music and video I download with the youtube-dl CLI (a "yt" alias makes sure the files are stored in the right directory with some custom parameters).
I sync my KeepassXC databases (work and personal), between my personal Linux laptop, my Android phone and my work MacbookPro. Databases can be merged in a single click if there's any conflict (happens very rarely). I love the Android secure autofill service and fingerprint quick unlock
I use a "temp" folder to drag'n drop stuff between computers so I can file it properly on the right device. On Android, I prefer to use the Syncthing "sharing intent" to make any file/media available on my other devices in just a tap.
I also have installed Syncthing on my Android TV, and occasionally drop HD movies that I download on my phone over P2P (I have a pretty fast connection, so it's easier for me to choose a move from my phone, while in commute, have it download in a few seconds, and either stream it to my TV via Chromecast or open it from the synced folder through Kodi)
This really is a dream setup.
KDE Connect, https://community.kde.org/KDEConnect#What_is_KDE_Connect.3F i've been using it for years
Not technically internet so much as intranet.
If you're using Android, you could just use USB transfer using Android File Transfer [2]. Super easy, super fast.
[1] https://www.resilio.com/individuals/ [2] https://www.android.com/filetransfer/
You may also want to check Syncthing, which others have also recommended.
[0] https://userbase.kde.org/KDE_Connect/Tutorials/Useful_comman...
I'm sure people who know more than me will give me a list of great reasons why it's not straightforward to implement...
But it doesn't change the fact that I have this incredible device (iPhone X) with 256gb of blindingly fast NAND flash storage, of which I am only utilizing 30gb, yet I still have to tote around a f*ing stupid little plastic USB dongle if I want to copy some files around.
Nah, Android phones have done this forever, it's not technical difficulties stopping it from working. It's The Apple Way. They don't want you using your phone that way, or something.
But, they don’t let you access to full file system for some reason.
Instead, there are these 3 ways to share files between your phone and other machines: https://support.apple.com/en-us/HT201301
So not so much for my Linux box or my Android phone, then. As usual with Apple's shiny crap it "all just works" as long as you're only playing inside the walled tarpit.
We have tons of protocols for transferring files over networks, there's no reason for them to go to the public Internet, nor for them to be mobile phone specific.
https://github.com/andyholmes/gnome-shell-extension-gsconnec...
Proprietary but free as in beer.
I do have an iPhone and I love AirDrop for sharing photos with the few friends who also have an iPhone but it's not even an option for me with a Linux laptop.
Works great, and I'm planning on integrating that functionality into my project which transfers files between laptops using only wireless cards, no LAN required. https://github.com/spieglt/flyingcarpet
The correct way to do this is to configure your phone to emulate USB mass storage and then connect with a USB cable.
Your phone looks like a thumb drive. It's the easiest workflow in the world.
Unfortunately, this workflow is off limits because of some licensing requirement from MS for fat32 (or something) which is why neither android nor ios has this very basic, simple feature.
Your comment took me a little by surprise actually because there's no actual need for the internet in SSH and in fact I probably do 90% of my SSHing on local networks. But I guess your usage differs significantly?
I do use this arrangement with split DNS: inside the local LAN, the desktop's DNS resolves to the desktop directly; outside, it resolves to the gateway's external port, whence it's NATed to the desktop. SSH from anywhere :)
What I'm really looking for is a Share button enabled app that can POST arbitrary files to a customizable URL.
It seems like this should be a solved problem but maybe it takes a Mozilla or some other larger entity to push the marketing and the customer support and development to really solve the problem of transferring large files securely.
It's decentralized, end-to-end encrypted and does local discovery of devices on a LAN so it will also works offline.
As long as one device lives and is synced, I have a copy of the files.
IMO if something doesn't require the internet connection, it is more likely to be called "software", not a "service".
I run the reverse; my laptop runs sshd and then I ssh/scp/rsync from termux on my phone. But either way works.
If there's any chance of this thing being exposed to a public network (like, say, a cell network), I'd say that's a very good thing!
woof -i <ip_address> -p <port> <filename>
termux: https://play.google.com/store/apps/details?id=com.termux&hl=....
woof: http://www.home.unix-ag.org/simon/woof.html
Edit:
1. Allows directory upload/download (tar/gzip/bzip2 compressed)
2. Local file server (doesn't go over the internet)
3. Allows upload form (-U option)
4. Allows file to be served <count> number of times (-c option)
cd my/directory && python3 -m http.server 80That uses MTP which the OP already discounted as being "a mess". Frankly my experience matches his and thus I actively avoid MTP whenever I can.
> I think the problem is if its too easy then people will be copying files off of each others phones without permission.
You usually need to unlock the phone to use MTP. If an attacker has access to unlock your phone then it makes no difference if they copying the files via USB, Dropbox, email or whatever - your attacker already has the permission they need to do so.
> We receive IP addresses of downloaders and uploaders as part of our standard server logs. These are retained for 90 days, and for that period, may be connected to activity of a file’s download URL. Although we develop our services in ways that minimize identification, you should know that it may be possible to correlate the IP address of a Send user to the IP address of other Mozilla services with accounts; and if there is a match, this could identify the account email address.
As a side note Nightly build for Ubuntu has been broken since version 61 and there's no sign of any effort to fix it.
I thought this would be some cool realtime system to send from browser to browser, using WebRTC or something. Something that doesn't involve them paying for file servers, by the way.
I believed in Mozilla ! But no, here we are and I just don't see the difference between this and Mega.
EDIT: except for the auto-deletion trick that addresses the piracy problem. But still...