Hacker News Reader

Comment by joombaga | Hacker News Reader

> The data you submit is encrypted in Firefox and not decrypted until it is on a server that is not connected to the wider internet.

Okay, stupid question: How does it get there? Sneakernet?

View on HN

User's computer => Encrypted => Sent over the internet => Mozilla's public servers => Mozilla intranet gateway => Mozilla non-internet-facing server => Decrypted here

It doesn't say the server is completely offline. It can be connected to through a server which can connect to both that server and the wider internet, but the machine in question cannot.

hopefully the server connected to the wider internet can only receive from the wider internet and not send anything to the wider internet. Otherwise it can just be used as a proxy to the server that’s not connected to the internet.

Hmm. If I was describing a server behind a bastion host I'd feel dishonest saying it's "not connected to the wider internet".

I agree. A more honest and accurate way of putting it would be, “not accessible from the wider Internet.” On the other hand, with immutable servers, giving them no route to the wider Internet actually could be possible.

You will send your data to publicly available server, which will forward it to other server available only through local network, hidden from the prying eyes, secured by firewall, routers, and/or some network configuration.

Either sneakernet, or the server is disconnected before the private key is attached, I assume. But sneakernet makes the most sense to me.

Not directly connected to the wider internet ? As in not referenced by DNS, but connected to machines which are ?

It could store it on a network filesystem. The computer that writes it would be connected to the internet, and the computer that reads it would not. Or it could store it in a database.

Encrypted data is uploaded to some Mozilla server. From there, the the encrypted data is copied onto some sort of storage device (USB stick or DVD), which is then inserted into the non-connected machine where it is decrypted.

Can't edit, but should add that this is speculation

Most likely they mean that it only gets decrypted after going through a bastion-like host that's connected to both the internet and one of their intranets.

A sneakernet would be an option but it's fairly unlikely

Hmm. If I was describing a server behind a bastion host I'd feel dishonest saying it's "not connected to the wider internet".

> Okay, stupid question: How does it get there? Sneakernet?

Homing pigeon.

It gets there encrypted via the internet

Reply on news.ycombinator.com