News for hackers. Stuff that matters.

A comment on Send: A Fork of Mozilla's Firefox Send. Parent comment

Re:Send: A Fork of Mozilla's Firefox Send by antaviana on Wednesday May 05, 2021 @03:03PM (#27054207)
How is end-to-end encryption achieved? By storing the password in the URL and not logging the URL when the file is fetched at the receiving end?
[ Parent | on HN ]
Re:Send: A Fork of Mozilla's Firefox Send by timvisee on Wednesday May 05, 2021 @03:13PM (#27054330)
Encryption is done with JavaScript on the client. The decryption key is attached as hash to the download URL on the client side as well.

When visiting the URL, the key never reaches the server because the hash-part of an URL is never sent and is a local-only thing. So there's no need to strip logging. The client downloads the encrypted blob, and decrypts it on the client.

More info: https://www.reddit.com/r/firefox/comments/lqegb5/reminder_th...

And: https://github.com/timvisee/ffsend#security

[ Parent | on HN ]
Re:Send: A Fork of Mozilla's Firefox Send by ev1 on Wednesday May 05, 2021 @03:11PM (#27054314)
#xxxx contents aren't sent to the server at all, if you trust the underlying javascript running in browser.
[ Parent | on HN ]