5 ms·

> Mozilla says it “does not have the ability to access the content of your encrypted file.” This can't possibly be true. Since Mozilla is encrypting the file,

> Mozilla says it “does not have the ability to access the content of your encrypted file.” This can't possibly be true. Since Mozilla is encrypting the file, they can also decrypt it (and must do so when the recipient downloads it). Edit: I was wrong, but will leave this comment because the explanation is useful.

zeveb 9y ago
Mozilla also say that your Sync passwords are secure, but they aren't — they are secured with one's account password, which is processed by JavaScript downloaded from Mozilla. At any time they can target — or be compelled to target — a user with malicious JavaScript which sends his password (and hence access to all his 'secured' data) to Mozilla or any other organisation.
jvannistelrooy 9y ago
What if it's encrypted on the client (browser)? I'm not saying they do, but then their statement could be true.
ericmoritz 9y ago
I don't know for certain without digging into the code but they are probably using the WebCryptoAPI and doing everything client-side to encrypt the file. The URL that is shared contains the key for the file. You'll notice that the URL contains a fragment identifier, i.e the #foo part of http://example.com/#foo http://example.com/#foo, this isn't transmitted to the server by the browser and therefore the key isn't exposed beyond who the URL is shared to. https://www.w3.org/TR/WebCryptoAPI/ https://www.w3.org/TR/WebCryptoAPI/
- ericmoritz 9y ago
  Yup, that's exactly what they're doing: https://github.com/mozilla/send/blob/65c24990cd1646bc8c6e6c05d7caadfb59c17450/frontend/src/fileReceiver.js#L45 https://github.com/mozilla/send/blob/65c24990cd1646bc8c6e6c0...
- brianberns 9y ago
  I hadn't considered that possibility. Interesting idea. Thank you.
- criddell 9y ago
  Doesn't it come down to us trusting Mozilla though?
  - dragonwriter 9y ago
    Yes, since they could change the JS without notice from to do something different, and could conceivably be ordered by a government to do so generally or targeting a specific set of users.
Null-Set 9y ago
Your browser is encrypting the the file before upload. https://github.com/mozilla/send/blob/master/frontend/src/fileSender.js#L68 https://github.com/mozilla/send/blob/master/frontend/src/fil...
b101010 9y ago
The share links look like this https:// https:// send.firefox.com/download/<$file_identifier>/#<$encryption_key> Data after the # in the url should not be sent to the http server by the client. Encryption/decryption is presumably handled in the users browser by JavaScript. The statement about not having the ability to access the contents of the files is perhaps somewhat misleading as they do control the JavaScript that either creates the key or will be given access to the key when someone retrieves the file (by reading it off the end of the url).
- pbhjpbhj 9y ago
  When inevitably someone copy-pastes the url in to Google search will Google visiting the URL then cause the file to be deleted before the intended recipient can download it? Are there other ISP based systems, say, that perhaps sample the head of a file for anti-malware purposes that might do the same?
  - pbhjpbhj 9y ago
    Edit: seems to work fine, even used Facebook to post link (privately), and they apparently didn't trigger the deletion. Looks good.

zeveb 9y ago

Mozilla also say that your Sync passwords are secure, but they aren't — they are secured with one's account password, which is processed by JavaScript downloaded from Mozilla. At any time they can target — or be compelled to target — a user with malicious JavaScript which sends his password (and hence access to all his 'secured' data) to Mozilla or any other organisation.

jvannistelrooy 9y ago

What if it's encrypted on the client (browser)? I'm not saying they do, but then their statement could be true.

ericmoritz 9y ago

I don't know for certain without digging into the code but they are probably using the WebCryptoAPI and doing everything client-side to encrypt the file. The URL that is shared contains the key for the file. You'll notice that the URL contains a fragment identifier, i.e the #foo part of http://example.com/#foo http://example.com/#foo, this isn't transmitted to the server by the browser and therefore the key isn't exposed beyond who the URL is shared to. https://www.w3.org/TR/WebCryptoAPI/ https://www.w3.org/TR/WebCryptoAPI/

ericmoritz 9y ago
Yup, that's exactly what they're doing: https://github.com/mozilla/send/blob/65c24990cd1646bc8c6e6c05d7caadfb59c17450/frontend/src/fileReceiver.js#L45 https://github.com/mozilla/send/blob/65c24990cd1646bc8c6e6c0...
brianberns 9y ago
I hadn't considered that possibility. Interesting idea. Thank you.
criddell 9y ago
Doesn't it come down to us trusting Mozilla though?
- dragonwriter 9y ago
  Yes, since they could change the JS without notice from to do something different, and could conceivably be ordered by a government to do so generally or targeting a specific set of users.

Null-Set 9y ago

Your browser is encrypting the the file before upload. https://github.com/mozilla/send/blob/master/frontend/src/fileSender.js#L68 https://github.com/mozilla/send/blob/master/frontend/src/fil...

b101010 9y ago

The share links look like this https:// https:// send.firefox.com/download/<$file_identifier>/#<$encryption_key> Data after the # in the url should not be sent to the http server by the client. Encryption/decryption is presumably handled in the users browser by JavaScript. The statement about not having the ability to access the contents of the files is perhaps somewhat misleading as they do control the JavaScript that either creates the key or will be given access to the key when someone retrieves the file (by reading it off the end of the url).

pbhjpbhj 9y ago
When inevitably someone copy-pastes the url in to Google search will Google visiting the URL then cause the file to be deleted before the intended recipient can download it? Are there other ISP based systems, say, that perhaps sample the head of a file for anti-malware purposes that might do the same?
- pbhjpbhj 9y ago
  Edit: seems to work fine, even used Facebook to post link (privately), and they apparently didn't trigger the deletion. Looks good.