great name if you hate the idea of people searching for it.
I this is the most effective search I could find:
https://www.google.com/search?q=“Mozilla’s+Firefox+Send”
Not great for a product that is not Mozilla’s Firefox Send!
Send lets you share files with end-to-end encryption
How is this possible if the only thing that is shared between sender and receiver is just a link (that is provided by the website)?
How can we trust https://send.vis.ee/? Who are they?
How it works: I don’t know about this service in particular, but usually the shared contains the encryption key so like this: example.com/files/file_id/encryption_key or something similar
As for trust: This appears to be a individual, so you will have to just trust it when using the public instance. However, since it is FOSS, you can audit the code and spin up your own instance
How it works: I don’t know about this service in particular, but usually the shared contains the encryption key so like this: example.com/files/file_id/encryption_key or something similar
But if the key is in the URL, that’s provided by the server, where’s the utility of the encryption since the server knows it and so does everyone that has the URL?
So the trick is to use the
#fragmentpart of the URL, that is not sent to the server.Of course the JS one downloads from the server could easily upload it to it, so you still need to trust the JS.
But the JS code could be checked on the webpage, correct? If so, the page could be trysted (if vetted).
In theory, yes. But if you follow the link and that leads to downloading the JS and running it, you’re already too late inspecting it.
And even if you review it once (and it wasn’t too large or obfuscated via minification), the next time you load a page, the JS can be different. I guess there could be a web browser extension for pinning the code?
The only practial alternative I know of is to have a local client you can review once (and after updates).
This is cool. If you’re worried about the safety on their instance, spin your own. They have a very clear and simple docker way to do just that.
