I've built `ffsend` as CLI tool for Send to securely share files from the command line. It has been a great success! Thanks Mozilla, for building and providing this amazing service!
For the interested: https://github.com/timvisee/ffsend
I'm currently hosting a public Send instance myself to ffsend keep working. Let's see how long I can keep this going (and funded).
First transfer.sh and now Firefox Send are closed. What service should I trust to send file quickly and securely.
I just rent a VPS, temporarily host the file on there, and give whoever it is a link.
Edit: If my threat model were to include protecting the contents of the file from the VPS provider I would probably encrypt it client side with GPG or something similar.
You can still use ffsend for now, it still works and uses the Send instance I'm hosting (send dot vis dot ee). Some generous users started sponsoring me through GitHub, so that'll definitely help keep it alive longer.
I haven't found a great alternative myself yet.
There is also a Golang port: https://github.com/psanford/wormhole-william
It runs Send in Docker. I set up this configuration for it: https://github.com/timvisee/send-docker-compose
If someone sends an encrypted email containing illegal content, is email then considered harmful?
You design a system that gives you (the hoster) zero ability to inspect, modify, block, censor, restrict any of your users' content and in doing so you're allowed to abdicate all responsibility for how the system is used because you're literally incapable of controlling it. Pure infrastructure with none of the messy real-world bits.
I've thought about it though, but haven't settled on anything yet. I can't inspect files. I'll add an abuse report notice soon, abuse@ is already live. I'll attempt to manually review cases. That doesn't prevent illegal sharing, but I think that's the best I can do. If things get out of hand, I might take the instance down. I don't want to support hosting illegal stuff.
A newer Send version (yet to deploy) also shows a clear warning, and requires users to tick a confirmation box, when downloading through the webpage. I hope that helps preventing malware installations.
Between the short TTL and E2E encryption, I'm struggling to think of any legal obligations you would have in most western jurisdictions. Perhaps logging in some places? Even the DMCA permits more than 24 hours to respond to a takedown notice.