Open Source

31374 readers

51 users here now

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

Rules

Posts must be relevant to the open source ideology
No NSFW content
No hate speech, bigotry, etc

Related Communities

Community icon from opensource.org, but we are not affiliated with them.

founded 5 years ago

MODERATORS

[email protected]

134

Send: Share Files Safely with This Open-Source Successor Of Firefox Send(Firefox Send Fork) (techwavearena.com)

submitted 2 weeks ago* (last edited 2 weeks ago) by [email protected] to c/[email protected]

32 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] RmDebArc_5 14 points 2 weeks ago (3 children)

How it works: I don’t know about this service in particular, but usually the shared contains the encryption key so like this: example.com/files/file_id/encryption_key or something similar

As for trust: This appears to be a individual, so you will have to just trust it when using the public instance. However, since it is FOSS, you can audit the code and spin up your own instance

[–] [email protected] 4 points 2 weeks ago* (last edited 2 weeks ago)

spin up your own instance

Absolutely. If you're at all worried about sending files through third party sites, set up your own. Provided you trust your own security skills, of course.

I would certainly be more interested in having an install under my own domain than using some rando's that I don't know.

[–] [email protected] 1 points 2 weeks ago (1 children)

How it works: I don’t know about this service in particular, but usually the shared contains the encryption key so like this: example.com/files/file_id/encryption_key or something similar

But if the key is in the URL, that's provided by the server, where's the utility of the encryption since the server knows it and so does everyone that has the URL?

[–] [email protected] 1 points 2 weeks ago (1 children)

So the trick is to use the #fragment part of the URL, that is not sent to the server.

Of course the JS one downloads from the server could easily upload it to it, so you still need to trust the JS.

[–] [email protected] 2 points 2 weeks ago (1 children)

But the JS code could be checked on the webpage, correct? If so, the page could be trysted (if vetted).

[–] [email protected] 2 points 2 weeks ago

In theory, yes. But if you follow the link and that leads to downloading the JS and running it, you're already too late inspecting it.

And even if you review it once (and it wasn't too large or obfuscated via minification), the next time you load a page, the JS can be different. I guess there could be a web browser extension for pinning the code?

The only practial alternative I know of is to have a local client you can review once (and after updates).

[–] [email protected] 1 points 2 weeks ago* (last edited 2 weeks ago)

Actually, I believe Firefox Send encoded the encryption key in a # URL anchor, as that's never sent to the server, but accessible to the client.

example.com/files/file_id#encryption_id

Otherwise, the server would know the key after the file was retrieved.