Wormhole promises to be a better longer-living Firefox Send alternative
Wormhole is a new file sharing service that promises to be a better longer-living version of Firefox Send, a file sharing service that Mozilla discontinued some time ago. Does Wormhole live up to the promises that it makes? Let's find out.
First, the basics: Wormhole can be used by anyone to send files with a total size of up to 10 Gigabytes. The service uses end-to-end encryption, and that means that the owners of Wormhole as well as the Internet Service Provider or network listeners, don't know the content of the files that are shared using the service.
To use it, visit the Wormhole website and either use drag & drop to add files to the send queue or use the file/folder browser instead. Wormhole works in all modern web browsers.
You get options to copy the link to the cloud copy of the files and a share link right away, even before the actual upload has started; this is one distinguishing factor as most file sharing services display share links and options only after a successful transfer. Wormhole calls this "instant file streaming", and recipients may start downloading files even before the upload completes.
You may copy the link to share it with others, or use the share option to use sharing options provided by the operating system. Recipients may download all files or only select files.
One interesting option that Wormhole supports is the direct sharing via WiFi or Bluetooth; these may offer faster transfer speeds as local networks are utilized when possible.
The encrypted files are stored for 24 hours in the cloud before they are deleted automatically.
The Wormhole security page reveals information about the implemented security techniques. Besides end-to-end encryption, Wormhole promises that it does not display advertisement or will load trackers. The service's key management and other security features are outlined on the page as well.
Firefox Send did support a number of features and options that Wormhole does not support at the time of writing, including password protection of files, download limits, or different storage limits.
Wormhole does not require an account at the time of writing, has a large file size limit, and supports local area network sharing. The features could make it a popular solution for Internet users.
It is unclear how Wormhole is financed. The lack of a commercial option and the guarantee that ads or trackers are not implemented, leaves the question open at the time of writing. I contacted Wormhole but have yet to receive a reply.
It is possible that a paid version is planned for the future, or that the service plans to finance itself through donations.
Update: The developers confirmed in an email that they have plans to introduce paid plans in the future; these will support larger file transfers and customization options.
Now You: do you use file sending services on the Internet?
How do I block the Wormhole background animation? It eats over 50% of my old cpu.
Maybe using a RAM disk is a better choice. For example, if you restart Firefox, previously visited pages or sites will load faster. If you use Firefox memory, once it restarts it is all gone. But knowing you, I guess you probably prefer that because of privacy.
@Steve, I’m assuming your comment refers to my above post where I mentioned the RAMDisk.
>”Maybe using a RAM disk is a better choice. For example, if you restart Firefox, previously visited pages or sites will load faster.”
I guess you meant pages in general will load faster (especially once in the memory cache) except those which have been visited in previous session(s) , given those have to be reloaded because not cached on the disk …
Indeed with Disk cache disabled all is gone when exiting Firefox, “all” being what is included in the Disk cache IF Firefox’s ‘Clear History on exit’ doesn’t include the ‘Cache’. What I mean is that another privacy approach can be that of enabling the disk cache and wiping its cache on Firefox exit.
But indeed I prefer the RAMDisk and no disk cache. Not only for privacy but also for speed and no writing to disk (rather old “traditional” hard-disks here). I’d consider things differently, maybe/likely, if I had a slow connection speed. My FF profile is on the RAMDisk and all FF session operations are quasi instantaneous.
Awesome site!
It can even do peer-to-peer with webRTC. Then in that case it’s true that the recipient may see the IP address of the sender…
“It is unclear how Wormhole is financed. The lack of a commercial option and the guarantee that ads or trackers are not implemented, leaves the question open at the time of writing. I contacted Wormhole but have yet to receive a reply.”
Motivations are important for a project like that because even if it is supposed to be E2EE and therefore mostly trustless, it is E2EE *in a browser*, so not really E2EE, because their server resends the code every time the service is used and could send a maliciously modified code at any time, even the code was checked a first time.
They say
“We started a company – Socket Inc – to bring end-to-end encryption to consumer and enterprise apps. We plan to explore the limits of what web browsers can do – especially in terms of shifting computation to the client-side, to improve the security and privacy of web apps. Wormhole is our first foray into that.”
The authors are known free software developers, one of them created WebTorrent.
“Wormhole promises that it does not display advertisement or will load trackers.”
Another good point if true compared to Mozilla services, no Google Analytics threat and no Mozilla drone to explain to us that not wanting Google Analytics is misunderstanding privacy.
Unfortunately I confirm the sentry.io connection, some sort of performance monitoring tracker that is rightly blocked in EasyPrivacy…
It’s not clear if the following means that there is no IP address logging at all:
“Additional technical information is stored on our servers, including randomly generated authentication tokens, keys, push tokens, and other material that is necessary to establish connections and transmit files. Socket limits this additional technical information to the minimum required to operate the Services.”
If so, another good point compared to Firefox Send which was happy logging lots of things (a rule of thumb is to avoid Mozilla products anyway if privacy is a concern).
Also different from Web Wormhole, which is open source and based off Magic Wormhole: https://webwormhole.io/
https://twitter.com/feross/status/1377533353616834569?s=20
Very cool! As always with things that look to good to be true, follow the money… What’s your business model?
In the short term, we’re planning to introduce a Pro plan which lets you send larger files.
Longer term, we’d like to build more types of consumer apps with end-to-end encryption – photos, documents, etc. which will be paid.
There’s a fork of FIrefox Send by Tim Visee. I’d suggest checking that out as well. Here’s a list of instances: github.com/timvisee/send-instances/
I encounter an issue at this time with uploading a file to Wormhole.
1- Once a file’s upload (363+MB for testing) has started I get a message informing me that Firefox is full and upload process is terminated. Full? Maybe because my Firefox profile is on a RAMDisk with 42MB free out of 128MB? No idea. But if I reload Wormhole’s page and start the upload process again, then it uploads flawlessly. Odd. Must be a clash with one/several of my deep tweaks.
2- uBlock Origin blocks a connection which is correlated to the upload process :
Filter : ||sentry.io^$3p
Filter List : Fanboy+Easylist-Merged Complete List (custom list)
Note : the filter may be inappropriate even if Fanboy’s lists are serious. May happen.
Investigating …
I was able to upload a 500MB file but took about 20 minutes and RAM consumption went rampage up to 4GB, which interestingly was not freed even after upload was done. I had to quit the browser entirely.
Appears I misunderstood the “Firefox full” message. In fact Wormhole requires the user’s disk cache and I have no disk cache because I’ve set cache to RAM only here on Firefox :
pref(“browser.cache.disk.enable”, false);
pref(“browser.cache.memory.enable”, true);
pref(“browser.cache.memory.capacity”, 1048576) // 1GB does it all.
So I’d have to enable disk cache, which I won’t do for just one app. Never encountered such a requirement before, this is the first time (I’ve known better first times!).
The name sounds like malware, maybe trojan would be better? :)
Seems like they’re pushing use of WebRTC which gives out a lot of info by design, OK if privacy isn’t an issue. Works without it, too.
Our email provider offers enough storage space for our needs with encrypted passworded links, so we use them.
More and more ways to send files. SendAnywhere or Mega or MediFire or GDrive or Dropbox, or, etc. all work well.
I’ve been impressed with Sharedrop and love Swiss Transfer although the “Swiss” in a name always makes me wonder how “swiss” is your “swiss?”
Wormhole–keep the name for those times when nothing else will do.
I’ve used https://www.swisstransfer.com/en as well, good for non-critical or non-private things.
Lots of non end-to-end encrypted things here.
Now You: do you use file sending services on the Internet?
This question like most questions asked after any arbitrary article, is loaded at best, does it really ask the question some security conscientious users are asking themselves? I think not.
Firefox send ended because of 3rd party abuse of service to distribute malware and the such.
Does this service differentiate from Firefox send in this respect?
Why is this service even being mentioned in a comparative way to Firefox send?
This isn’t journalism, this is just advertising disguised as journalism.
> This isn’t journalism, this is just advertising disguised as journalism.
The title of this site says: “Tech News”. There are hundreds of articles talking about all sorts of products related to software, including file sharing, why wouldn’t they write about this one in particular?
> Why is this service even being mentioned in a comparative way to Firefox send?
It’s compared to Firefox Send, because it replaces that functionality which is sharing files in a securely and easily over a browser.
> Firefox send ended because of 3rd party abuse of service to distribute malware and the such.
One point that seems different about Wormhole is that it allows peer-to-peer file sharing. Depending on the implementation, that could mean that even if they’re shutdown the code can be repurposed easily and used right in the browser without a central server.
Just to ask is 24 hours long enough? Or is it more for instant sends – given that as soon as you start uploading you can start downloading it. I just wondered, because most of the time, I don’t tend to read my emails on the same day or grab a download from a website on the same day. So I could see that be irksome after a while.
You are thinking of Magic Wormhole, which is a different thing, they just stole the name.
It’s a shame it’s capitalizing on the name of Magic Wormhole https://github.com/magic-wormhole/magic-wormhole while being incompatible with it and the various clients that exist.
I agree that the name is unfortunately too similar but that can be disputed later. As for the functionality the difference is that this works right in the browser whereas magic-wormhole has to be downloaded, which makes this much more user-friendly.
capitalize is a strong word if no one has heard of the former application.
in an after thought: I know workhole from Ubuntu: it is a Terminal based file sending App. both comuters need wormhole. One computer sends a file and generate a code. On the other computer in a terminal specify wormhole receive with the code and the file is transfered. Worked good, though have not used it for a long time.
I was regularly using Firefox Send, and it is a pity that that service has ended. Since then, I do use either email(Protonmail), for small stuff or Mega for larger stuff and OnionShare for sensitive data.
Will give wormhole a try , though the missing option for a password is regretful.
Also , I did not read whether this is OpenSource??; would be better it is!
According to the developers, they’re working on fixing a few bugs that were found at launch time and the code will be made available then. They don’t have an ETA yet, and I would avoid using this Wormhole until then.