
Firefox Send: Private, Encrypted File Sharing - networked
https://send.firefox.com/
======
nneonneo
The last time this was posted I hacked up a quick and dirty Python client for
Send:
[https://github.com/nneonneo/ffsend](https://github.com/nneonneo/ffsend). I
just updated it for recent Send changes, which streamlined the crypto and
removed some redundancy.

Firefox’s JS client requires the whole file be in memory in order to perform
the encryption, and has to decrypt the whole file in memory in order to
download it. My client doesn’t have that limitation so it could theoretically
upload much larger files (subject only to the server’s upload limit).

~~~
solnyshok
have you bumped already into server upload limit?

~~~
ihale
Would that not simply be your specific allotted disk space, and bandwidth?

------
sarabande
I'm curious -- Mozilla says it can't decrypt the file on their side:

    
    
        Mozilla does not have the ability to access the content of your encrypted file [...] 
        https://testpilot.firefox.com/experiments/send
    

How is the receiver able to decrypt the file -- i.e. what is the decryption
key if not the URL slug, which presumably Mozilla has as well?

~~~
KwanEsq
The key is the hash, which isn't sent over the wire when loading a page. Now
granted it's accessible via location.hash in the client, but one has to trust
Mozilla not to do that.

~~~
zeveb
> one has to trust Mozilla not to do that.

Exactly. One has to trust Mozilla _every time one visits the page_. They could
_easily_ configure it to be malicious one time out of a million (say); what
are the odds that they would be caught?

Web-page-based crypto is fundamentally insecure, and Mozilla is committing an
extremely grave error in encouraging users to trust it (as they also do with
their Firefox Accounts). Security is _important_ , and snake-oil solutions are
worse than worthless.

~~~
Yoric
Send is meant to be an improvement on Dropbox & co for a specific use case.

Is it perfect? No, it isn't. But it is still a considerable improvement.

If you have a better solution in mind for the average user crowd, feel free to
suggest it, of course.

~~~
carussell
Spec out and implement resource pinning, already. Like RFC 8246, but authored
more with the user's interests in mind, rather than the service's.

As a show of nothing-up-the-sleeve, a service asserts that it's in a stable
state and will continue to serve exact copies of the resources as they exist
now—that they will not change out from beneath the client in subsequent
requests. When a user chooses to use resource pinning, the browser checks that
this is true, and if finding a new deployment has occurred, the browser will
refuse to accept it without deliberate consent and action from the user
(something on par with invalid cert screen).

This means that for a subset of services (those whose business logic can run
primarily on the client side), the users need not trust the server, they need
only to trust the app, which can be audited.

When deploying updated resources, services SHOULD make the update well-
advertised and accompany it with some notice out of band (such as a post about
the new "release", its changelog, and a link to the repo), so the new
deployment may be audited.

When new deployments occur, clients SHOULD allow the user to opt for
continuing to using the pinned resources, and services SHOULD be implemented
in such a way that this is handled gracefully. This gives the user continuity
of access while the user (or their org) is carrying out the audit process.

Areas where this would be useful:

\- HIPAA compliance

\- Web crypto that isn't fundamentally broken

\- Stronger guarantees for non-local resources used in Web Extensions—in fact,
the entire extension update mechanism could probably be more or less rebased
on top of the resource pinning policy

~~~
the8472
This would also have the added bonus that one could reload such pinned
resources from anywhere once you got the pin. Even without TLS setup or having
to trust certificate chains.

Caching proxies would suddenly become viable again because only the first
download has to through HTTPS while "I don't have this in the local cache
anymore, can you serve me this content" requests could go through sidechannels
or outside the TLS handshake or something like that. Caches could even perform
downgrade non-attacks.

~~~
Dylan16807
How many pins would you expect a browser instance to have? I feel like most of
the time the pinned content could fit in the browser cache and make this
variety of proxy-side caching pointless.

~~~
the8472
Immutable content is a prerequisite for pins. The caching benefits mostly fall
out of the immutability, not the pinning. So as long as the hypothetical
standard would allow one to be used without the other additional uses could
fall out of that stack.

~~~
Dylan16807
My point is, those particular benefits only exist in a narrow circumstance
where the browser is half-caching.

------
zaroth
As I recall, there was a Bitcoin wallet service which relied on securing the
access key behind the '#' in the URL for its security -- turns out it's not
perfectly reliable and shouldn't be used for protecting money. Likewise for
files you really need to be secure.

Since boring crypto shouldn't have weird failure modes like this, I'm thinking
this design is a big mistake?

EDIT: I think it was Instawallet and apparently while they had robots.txt set
to prevent crawling, the theory was people typing their URL into Google (or
Omnibar) would alert Google to the URL and it got into search results anyway.

I know that web-keys is based on the theory that since the fragment isn't sent
by User-Agents in the Request-Uri that it's secure, but there are things that
see the full URL which aren't conforming agents, and it just seems risky for
any long-lived secret.

~~~
akavel
Given that it's explicitly a _short_ -lived secret (below 24h), and one-use -
so probably Google crawler (or typing into url bar - presumably to immediately
follow by Enter) would invalidate it on first access - I don't feel convinced
any of those concerns apply?

------
NikolaeVarius
It really is a shame that there still isn't a easy way (A person whose
computer knowledge extends to using facebook), that I know of, of sending
arbitrarily large files that isn't tethered to a specific cloud service and is
also reliable (can tolerate connection dropping).

It seems that bitorrent protocols are pretty close, but I don't think there is
a seamless client that allows for "magical" point to point transactions.

~~~
AndrewDucker
You're at a computer.

You need to connect to another computer.

First you need to know a route to that computer. If it has an externally
reachable IP address and you know that, then great. If it has an externally
reachable IP address and a DNS entry and you know _that_, then also great.

If you don't know the IP address or domain name of the other computer then
you'll have to do some kind of lookup/exchange to find it. That means some
kind of centralised service to provide the lookup functionality.

If the other computer doesn't even has an externally reachable IP address then
a central service is going to have to act as a connection point which you can
both connect to (or provide some other method of helping the two of you
connect).

I'm not aware of any entirely decentralised system which would allow two
computers which are behind NAT to find and then talk to each other. Or any
obvious design which would work there.

~~~
jchw
Two thoughts:

\- IPv6 kind of helps here, at least if we hope that no NAT standard ever
makes it into IPv6. Crossing my fingers.

\- There does exist at least one NAT hole-punching technique that can traverse
two NATs with no central server using ICMP-based holepunching and UDP.
Obviously, like all hole punching techniques, it only works on certain kinds
of NATs, and firewalls can kill it.

~~~
ac2u
> There does exist at least one NAT hole-punching technique that can traverse
> two NATs with no central server using ICMP-based holepunching and UDP.
> Obviously, like all hole punching techniques, it only works on certain kinds
> of NATs, and firewalls can kill it.

I think you're referring to this? Clever hack indeed.
[https://github.com/samyk/pwnat](https://github.com/samyk/pwnat)

------
mtgx
They should add this as a shortcut button in Firefox. I think it makes even
more sense than having the Pocket icon there. Not everyone may want to save
their articles on another service, but pretty much everyone needs to send a
file privately to someone else every now and then. So something like this
should be super-easy to access.

I learned about Firefox Send when it launched but completely forgot about it
until now. I would definitely use it more if it had an easy-to-access (read:
not burried in the Settings page) shortcut in the browser.

~~~
floatingatoll
It's a Test Pilot project, so easy-to-access may be deferred until they choose
to upgrade it from Test to Release, but it is certain they'll consider ease-
of-use _if /when_ they do decide to release it.

------
narag
This is actually very useful. You can send files from and to mobile devices
and desktop. Delete on download doesn't seem to be a problem, just adjust your
storage strategy. Security could be acceptable for most use cases. I hope they
add it to the browser.

------
spyridonas
I think Mozilla should create a more privacy friendly analytics service, since
they experiment with new projects

~~~
jagermo
Do you know Piwik? Its a really nice open source, self hostable alternative to
Google Analytics. I've been running it for years, very stable and great
insight.

www.piwik.org

------
Aissen
I've just checked the code. It indeed deletes the file once a download has
been completely consumed, so it can't really replace other file-sharing
services. BUT I wonder how does it deal with race conditions ? My guess is
that if many people start a download at the same time, they'll all be able to
complete it before the file goes away. At least that's how I'd see it working
with S3 or local storage.

You could abuse it by sending the same file many times in order to create lots
of download links; but there's little to gain in bandwidth savings: you might
as well run your own server. The only advantage I'd see is hiding your IP
address, but then you could also run a tor hidden service. The other would be
bandwidth amplification by synchronizing all the clients (for big files).

~~~
ge0rg
The sender could open a download connection and stall it as far as possible
(maybe keep the download rate shaped to some bytes/second, to prevent an
inactivity timeout). That would open a large time window for further
downloads.

~~~
AgentME
I assume the file would be deleted as soon as any client finishes downloading.
(If the files are backed by regular files on a unix-like system, then the
existing open handles to the file will keep working, allowing currently-
connected clients to finish downloading, but preventing any new clients from
starting the download.)

~~~
Aissen
Indeed, I tested this too, but forgot to mention. That's how it works.

------
mnx
It seems nice, but I think it should be made more explicit upon downloading,
that you can only do that once. I can see myself e.g. downloading a file I
received on my phone to take a quick look, intending to then download it again
on my computer later. I would be surprised to see it just gone.

~~~
fluxsauce
Known issue, apparently -
[https://github.com/mozilla/send/issues/497](https://github.com/mozilla/send/issues/497)

------
ElijahLynn
One thing that could be improved with this is to have an option for a human
readable/typeable link. I wanted to quickly transfer a file from my desktop to
my phone. Used Send and realized I didn't want to type that cryptographic URL.

I ran the Send link through Typer.in (specializing in hand-typed urls) and it
worked as I initially expected. However, it would be nice if Send had this
functionality by default.

~~~
jwcacces
Typer.in stores the link you give it, and returns a human readable lookup
link. The whole point of Send is that the link includes the secret key to
decrypt your file. Whoever you give that secret to, including Typer.in can get
the file.

The Send link must include the secret key, because no one else should get it,
and that key must be of sufficient length to protect your file. Thus human-
readable-izing it could do nothing to decrease its complexity and would just
result in a huge string of words that were just as much as a pain to type in.

~~~
indiv0
At least at the moment, downloading the file once removes it from Mozilla's
servers. So in the event typer.in used the URL you provided to download the
file, you would know as the file would no longer be accessible.

------
lwerdna
If you only need to send text,
[https://cryptopaste.com](https://cryptopaste.com) does everything client side
and shows the ciphertext in a "staging area" before you commit it to the
cloud.

You can instead save it as a self-decrypting document, attaching it to email,
copy to thumbdrive, upload dropbox, etc.

~~~
n2j3
Great implementation but doesn't work with Greek, spews out garbage. Here
against original text in notepad.exe
[https://i.imgur.com/n1WCsnZ.png](https://i.imgur.com/n1WCsnZ.png)

~~~
lwerdna
If you have a chance, please try again. UTF-8 support is added.

~~~
n2j3
It works, thanks!

------
floatingatoll
This is technically a dupe of
[https://news.ycombinator.com/item?id=14901998](https://news.ycombinator.com/item?id=14901998)
from a couple months ago.

------
Devid2014
1 download limit looks really problematic to me. Some times download just do
not start or get aborted and then everything need to be done again.

Something like 3 downloads limit would make this more usable!

~~~
Aissen
No, this is only deleted if all the file has been transferred.

------
fefe23
Why do the Mozilla people keep doing this sort of thing? Aren't they supposed
to be making a good browser?

I remember them telling me they are now going back to their core competences.
I think it was after Firefox OS failed.

Not trying to piss on anyone's parade here, just wondering how this kind of
thing keeps happening. I was wondering the same thing when Mozilla added
Pocket and now Cliqz to Firefox.

What is the rationale here? Do they have leftover money they need to spend
before January 1st or something?

~~~
potch
Perhaps peruse this: [https://www.mozilla.org/en-
US/mission/](https://www.mozilla.org/en-US/mission/)

Firefox is Mozilla's flagship, and the largest by far way in which we achieve
our mission, but our goal is a healthy and open internet.

Additionally, this is a great way to determine whether something like this
would work well as an in-browser feature, and we've built it in such a way
that it works in more browsers than just Firefox on day one.

~~~
actionscripted
> ...and we've built it in such a way that it works in more browsers than just
> Firefox on day one.

Sure wish other browser vendors would consider other browsers when releasing
their products.

~~~
duncan_bayne
Google won't because the browser isn't their product. Your data and attention
are their product, which they acquire in exchange for a free browser.

~~~
duncan_bayne
Unsure why this seems controversial. Google is an advertising company, not a
Web browser company.

~~~
flukus
An advertising company with 60,000 employees whose interests overlap with this
forum ;)

Most of the wealth in silicon valley comes from productizing eyeballs.

In related news, this just triggered someone into downvoting my entire post
history!

------
rebyn
I've just uploaded a 140MB file from my mountain cabin (in Viet Nam) and it
was lightning fast. I then gave the link to a friend of mine residing in
Melbourne, Australia and his download speed was blazing fast as well. Would be
keen to learn more about the infrastructure setup behind this service to
achieve such a good performance.

~~~
hnarn
Probably Amazon.

------
geostyx
This has been out for a while. I use it occasionally, but a single download is
a narrow use case.

~~~
hnarn
> a single download is a narrow use case.

Is it really? I mean, if I wanted to send a file to someone via Google's
e-mail servers or a chat application like Facebook Messenger but wanted to
make sure it didn't stick around for those two companies to data mine, this
seems like it would do the trick.

From Mozilla's perspective, doing "one upload, one download" also kind of
solves the problem of becoming a new "megaupload" for illegal content. Not the
problem of the illegal content being there (since it's unsolvable), but the
accountability of being the party responsible for spreading it around.

------
sangd
What does it mean "it’s best to keep your file under 1GB"? Can I send 2GB+
size files?

------
Larrikin
Can anyone confirm whether this works in Safari/iOS now? It seemed great but
when I tried to send some files to friends to promote it it completely shat
the bed and my mobile friends ended up getting nothing but garbled text when
the (fairly large) downloads finished. It was quite frustrating since the
upload was painfully slow.

~~~
kiliankoe
Seems to work fine on my end.

------
peternicky
How does this compare to Keybase folders?

------
viperscape
Pushbullet offers a great service. I'm not related to the team, but really
enjoy the product. It's both an addon for browsers, desktop app, and
standalone mobile app. Easy as pie, and now they have 'portal' which is local
network direct transfers

------
wyred
I made a subreddit for anyone to upload any file and the first person who
accesses the link gets to download it.

[https://www.reddit.com/r/send/](https://www.reddit.com/r/send/)

------
naskwo
Is this a Wetransfer killer?

~~~
jagermo
No, since its just downloadable once.

------
thinkMOAR
Just my experience/test: it takes longer to upload the file to mozilla then it
would have sending directly to DSL of a friend..

edit- Download tested now too, not bad, though nothing to write home about.

~~~
AndrewDucker
What software did you use to create a direct connection to your friend?

~~~
thinkMOAR
https

~~~
chrisper
That's a protocol. Not a software.

~~~
thinkMOAR
You must be great at parties. Software is irrelevant imo. Indicating same
protocol as FF send is imho more relevant.

~~~
ohitsdom
The whole point of this discussion is that sending files to another computer
is still cumbersome. Software is entirely relevant. So if you're complaining
about speed of FF Send, you should specify what you're comparing it to.

~~~
thinkMOAR
lol no.. my point was that it wasn't as fast as i would expect a service from
mozilla to run and broadband connections here are a lot faster. Second, it
wasn't a complaint, just an observation.

And if you really think one 'https' enabled webserver software on a home
subscriber cable/dsl connection is much faster then the other for a single
download, then i will have to inform you that you are mistaken.

And setting up a simple webserver to exchange files isn't that hard at all. To
say file sharing is cumbersome is a bit stretching the truth.

------
_pdp_
In order to take this further, this functionality needs to be part of the
browser so that one can trust the page is not maliciously modified in transit
or at the server.

------
skarap
Mandatory XKCD link: [https://xkcd.com/949/](https://xkcd.com/949/)

------
bikamonki
I need something like this to send myself links from my phone to my pc.

~~~
Markoff
Chrome, Firefox or Samsung browser have all bookmarks sync

------
metahost
So, where is the money coming from ? Who's the product here ?

~~~
soapdog
When thinking about a Mozilla offering, it is healthy to think beyond "money
and product" as this type of analysis will usually leave you with a conclusion
of "this doesn't make business sense".

Mozilla is in the game of keeping the internet healthy. Part of it involves
products, such as Firefox and its quest to recover userbase. Parts of it
involves money, such as MOSS awarding grants or prizes for FOSS stuff they use
and see value.

But most of Mozilla actions can be thought on "how close they get Mozilla to
achieve its mission as stated in the Mozilla Manifesto[1]". In the case of
Firefox Send, it enables less friction sending files and protects the user
privacy, so it IMHO advances item #4 of the manifesto: "Individuals’ security
and privacy on the Internet are fundamental and must not be treated as
optional." It also serves as a nice branding reminder for people, as it works
with other browsers, makes people using some other solution remember
Firefox...

[1]: [https://www.mozilla.org/en-
US/about/manifesto/](https://www.mozilla.org/en-US/about/manifesto/)

~~~
programmarchy
Not sure how true that is anymore. They seem to by trying hard to squander
their reputation. First their MITI officially signaled they now consider
themselves a political force, then the whole Cliqz debacle following shortly
after showed their willingness to sacrifice their principles.

~~~
superkuh
Don't forget their switch to a walled garden for extensions in order to
protect users from themselves.

~~~
soapdog
That is FUD and also a lie. You can still distribute your extensions on
whatever site you want, you just need to sign them on AMO.

The workflow is:

1 - Build webextension 2 - Upload to AMO 3 - Choose "distribute on AMO" or
"sign and distribute on your site"

~~~
superkuh
If I need to get Mozilla's approval before I can run code in the browser
running on my machine then I see a wall. That they've automated it so much as
to mitigate the protection a walled garden normally gives almost makes it
worse.

~~~
chungy
You can install Firefox Beta or Nightly and have unrestricted extension
installation options (or use a Linux distro's packages: most of such firefox
packages do _not_ require signed extensions).

It's a measure to prevent casual trojans, there are many ways around it for
non-casuals and developers to employ.

~~~
superkuh
>or use a Linux distro's packages: most of such firefox packages do not
require signed extensions

That's actually pretty cool. Can you give me an example distro that does that
with Firefox (w/FF brandings)?

~~~
chungy
Both Debian and Arch do this.

------
Markoff
how is this different from Mega.nz ?

------
mcemilg
But why?

~~~
Markoff
because it's easier to do this than give mobile Firefox users option to pull
down to refresh, thus enjoy Brave or Samsung browser and stay away from
Firefox

------
marindez
I don't understand why is this called Firefox Send. Shouldn't it be called
Mozilla Send?

~~~
elsurudo
Probably branding purposes. Even non-techies recognize the Firefox brand.
Mozilla – not so much.

~~~
Markoff
eh, what's current Firefox market share? I would not bet my money many non
techies recognize Firefox at all, it's pretty niche nerd product for people
with addon fetish, rest of the world just use Chrome/IE/Edge

------
Numberwang
I wonder how many downloads can be done before it expires

~~~
0xfeba
Another commentator found you can initiate multiple downloads, and complete
them all. As long as you start them before any finishes.

------
lucb1e
Let me guess, with free Pocket® integration?

Mozilla blew it for me recently in so many ways, I am taking them about as
seriously as I would Facebook right now.

~~~
hollander
How can you compare the Pocket thing with Facebook? The good kid messed up
this time. And you can simply ignore it, don't have to use it. Yes like you
can decide not to use Facebook, but then all your friends and family use it,
or use Instagram of Whatsapp and force you to use it. That includes uploading
your complete contact list two or three times.

Do you have to use Firefox because your family uses it? I don't think so.

How do those two compare?

~~~
srathi
They are repeating it with the Cliqz integration now. I love Firefox, but
these decisions are baffling!

------
SgtSauceBoss
I've learned not to trust companies when they tout "completely encrypted" and
"totally private".

Show me the open source code, otherwise they're likely collecting data in some
way to pay for hosting this web application.

~~~
yscik
Here you go:
[https://github.com/mozilla/send](https://github.com/mozilla/send)

------
vesinisa
Do they share my files and "anonymized" upload history with a third party
(edit: was "advertising company") for this service as well?

~~~
eli
You can see exactly what they collect here
[https://github.com/mozilla/send/blob/master/docs/metrics.md](https://github.com/mozilla/send/blob/master/docs/metrics.md)
and decide for yourself.

I think it's misleading to refer to Google as an advertising company when
talking about Analytics since this data won't be used for targeting ads.

~~~
vesinisa
I was actually referring to this incident where Mozilla started shipping an
opt-out "addon" in Firefox that automatically shares your browsing history
with a third party:

[https://www.reddit.com/r/firefox/comments/74n0b2/mozilla_shi...](https://www.reddit.com/r/firefox/comments/74n0b2/mozilla_ships_cliqz_experiment_in_germany_for_1/)

~~~
eli
OK, well this doesn't do that.

