News for hackers. Stuff that matters.

A comment on Firefox Send: Free encrypted file transfer service. Parent comment

Re:Firefox Send: Free encrypted file transfer service by bjt2n3904 on Tuesday March 12, 2019 @11:18AM (#19368967)
Thanks for the info. Let me see if I understand this correctly.

Browsers don't send the anchor tag (ie: with GET requests). FF Send takes advantage of this by using the anchor tag to store the key for decryption.

That is kinda novel. You still need to trust the upload client to not leak the key, but I see that you've written a CLI version. Interesting! Thanks for the response.

[ Parent | on HN ]
Re:Firefox Send: Free encrypted file transfer service by timvisee on Tuesday March 12, 2019 @11:31AM (#19369098)
You got it! The only thing you'd have to worry about is malicious JavaScript on the Firefox Send website which I believe would be highly unlikely. And of course, you must keep your link secret.

Yes, such a CLI tool would help protect you against a MITM with malicious JavaScript.

[ Parent | on HN ]
Re:Firefox Send: Free encrypted file transfer service by Piskvorrr on Tuesday March 12, 2019 @01:23PM (#19370633)
Unlikely but possible. Two words: browser extensions.
[ Parent | on HN ]
Re:Firefox Send: Free encrypted file transfer service by quickthrower2 on Tuesday March 12, 2019 @06:42PM (#19373836)
Three words: My Ether Wallet.
[ Parent | on HN ]
Re:Firefox Send: Free encrypted file transfer service by NKCSS on Tuesday March 12, 2019 @11:20AM (#19368982)
It's not a new idea, the megaupload successor first did it as far as I can remember
[ Parent | on HN ]
Re:Firefox Send: Free encrypted file transfer service by simias on Tuesday March 12, 2019 @11:51AM (#19369383)
Indeed, the website serves you the crypto code but it runs totally on the client so it's perfectly safe and could in no way be backdoored.

More seriously, did they do anything to fix this obvious design flaw? If they want to fish a key they can just serve you a modified JS file and retrieve the key. Unless of course you chose to audit the JS served every time you browse the website.

[ Parent | on HN ]
Re:Firefox Send: Free encrypted file transfer service by solarkraft on Wednesday March 13, 2019 @09:05AM (#19378167)
How would this be possible to fix? I currently don't see any possibility of this.
[ Parent | on HN ]
Re:Firefox Send: Free encrypted file transfer service by coolspot on Tuesday March 12, 2019 @07:55PM (#19374291)
Yes, the mega.co.nz . End-to-end encrypted dropbox analog.
[ Parent | on HN ]
Re:Firefox Send: Free encrypted file transfer service by solarkraft on Wednesday March 13, 2019 @09:03AM (#19378155)
It's cool, but not exactly novel. Mega has done it this way for years.
[ Parent | on HN ]