6 ms·
I don't know for certain without digging into the code but they are probably using the WebCryptoAPI and doing everything client-side to encrypt the file. The U
by ericmoritz 9y ago
I don't know for certain without digging into the code but they are probably using the WebCryptoAPI and doing everything client-side to encrypt the file.
The URL that is shared contains the key for the file. You'll notice that the URL contains a fragment identifier, i.e the #foo part of http://example.com/#foo http://example.com/#foo, this isn't transmitted to the server by the browser and therefore the key isn't exposed beyond who the URL is shared to.
https://www.w3.org/TR/WebCryptoAPI/ https://www.w3.org/TR/WebCryptoAPI/
- ericmoritz 9y agoYup, that's exactly what they're doing: https://github.com/mozilla/send/blob/65c24990cd1646bc8c6e6c05d7caadfb59c17450/frontend/src/fileReceiver.js#L45 https://github.com/mozilla/send/blob/65c24990cd1646bc8c6e6c0...
- brianberns 9y agoI hadn't considered that possibility. Interesting idea. Thank you.
- criddell 9y agoDoesn't it come down to us trusting Mozilla though?
- dragonwriter 9y agoYes, since they could change the JS without notice from to do something different, and could conceivably be ordered by a government to do so generally or targeting a specific set of users.