Mozilla Send

Mozilla Send is the service allowing to create copies of local files and to store them on a remote server. The size of the files loaded on the server should not exceed 1 GB.

Mozilla Send: interface of service

According to developers, using Send service it is possible to send files, using safe, private references which are deactivated automatically then all files are removed from the server. We cover that, a system supports enciphering.

Service works based on Node.js which is supported by the Redis database working at Amazon web services. Enciphering of the file happens on client side then Mozilla loads it into AWS and generates the URL address. It contains an encryption key which is transferred to the receiver of the file.

2017: Start

On August 7 it became known of start by Mozilla company of the service allowing to create copies of local files and to store them on a remote server. Exploratory development of Send actually solves a problem of sending big files on what almost all services of e-mail have serious restrictions.^[1]

Each reference created by Send is deactivated after one loading of the file, or 24 hours later. All sent files in this case will be deleted from the server — developers specify.

Unlike many other developments of the company, use of service will not require installation of an add-on. Send, according to statements of developers, can be used in any modern web browser.

For enciphering and interpretation of files the service uses API of web cryptography of JavaScript with an algorithm AES-GCM. According to Mozilla, the developer company will not have access to interpretation of files even at receipt of a request from law enforcement agencies.

User feedback

According to statements of users, service does not work in mobile browsers in to the operating system iOS and also in the desktop version Safari on Mac.

Besides, the users who tested service found in it vulnerabilities and already drew the attention of developers that AWS can theoretically recover the remote file or even to save it. In this case the key can be recovered either using the magazine, or from that messenger service which is used for sending.

Also after the analysis of the source code of the solution it became clear that Send tells a file SHA256 hash in the form of the clear text that can be used for its identification. On Mozilla assurances, this opportunity will disappear in the next version of Send.

Notes