I don't know for certain without digging into the code but they are probably using the WebCryptoAPI and doing everything client-side to encrypt the file.

The URL that is shared contains the key for the file. You'll notice that the URL contains a fragment identifier, i.e the #foo part of http://example.com/#foo, this isn't transmitted to the server by the browser and therefore the key isn't exposed beyond who the URL is shared to.

https://www.w3.org/TR/WebCryptoAPI/

Yup, that's exactly what they're doing: https://github.com/mozilla/send/blob/65c24990cd1646bc8c6e6c0...

Doesn't it come down to us trusting Mozilla though?

Yes, since they could change the JS without notice from to do something different, and could conceivably be ordered by a government to do so generally or targeting a specific set of users.

I hadn't considered that possibility. Interesting idea. Thank you.

The share links look like this

https:// send.firefox.com/download/<$file_identifier>/#<$encryption_key>

Data after the # in the url should not be sent to the http server by the client. Encryption/decryption is presumably handled in the users browser by JavaScript.

The statement about not having the ability to access the contents of the files is perhaps somewhat misleading as they do control the JavaScript that either creates the key or will be given access to the key when someone retrieves the file (by reading it off the end of the url).

When inevitably someone copy-pastes the url in to Google search will Google visiting the URL then cause the file to be deleted before the intended recipient can download it?

Are there other ISP based systems, say, that perhaps sample the head of a file for anti-malware purposes that might do the same?

Edit: seems to work fine, even used Facebook to post link (privately), and they apparently didn't trigger the deletion. Looks good.

Mozilla also say that your Sync passwords are secure, but they aren't — they are secured with one's account password, which is processed by JavaScript downloaded from Mozilla. At any time they can target — or be compelled to target — a user with malicious JavaScript which sends his password (and hence access to all his 'secured' data) to Mozilla or any other organisation.

What if it's encrypted on the client (browser)? I'm not saying they do, but then their statement could be true.

Your browser is encrypting the the file before upload.

https://github.com/mozilla/send/blob/master/frontend/src/fil...