3 ms·
To be honest, I think some form of abuse was bound to happen. Your files are encrypted client-side with JavaScript before uploading, so to the server it's just
by zxcvgm 6y ago
To be honest, I think some form of abuse was bound to happen. Your files are encrypted client-side with JavaScript before uploading, so to the server it's just an opaque blob.
Out of curiosity, I did some technical analysis¹ of how your files were being encrypted to see if they were really secure and as a side-effect, also wrote a Go client for it.
An interesting property I did discover about the way the encryption keys are derived is that the scheme allows you to delegate an oblivious third-party to download the blob for you, without actually revealing the file contents to them.
¹ https://irq5.io/2019/05/14/data-encryption-on-firefox-send/ https://irq5.io/2019/05/14/data-encryption-on-firefox-send/
- fireattack 6y agoMight be a stupid question, but why server can't see the secret key? You said that "note that URL fragments are never sent to the server", which is true when uploading the file. But when someone is downloading the file, they need to use this full URL with secret key right? By then, the server will get the key and can decrypt the file themselves.
- hiq 6y agoSee the post that OP linked: > Note that URL fragments are never sent to the server. They are often used for page anchors, and sometimes to keep track of local state in SPA. Also see: https://en.wikipedia.org/wiki/URI_fragment#Basics https://en.wikipedia.org/wiki/URI_fragment#Basics
- fireattack 6y agoThank you for the info. I thought it's setup specific, didn't know anchor string is never sent to servers in general.