3 ms·

No they can't Notice the format of the URL example.com/fileA#encryption-key All MEGA has logged is: example.com/fileA encryption-key is generated client si

• oh_sigh 11y ago
  That's why I said one logging statement could grab the key. Just log the fragment to a service that you run somewhere, and all of the sudden you have the key.
  • SixSigma 11y ago
    who is "you"? The fragment is only ever transmitted by the uploaded to the recipient. I'm not familiar with Mega but presumably this transmission is also encrypted. So your chance of getting it is low. And certainly Mega can deny ever receiving it.
    • oh_sigh 11y ago
      "You" being the people who wrote the client side script. Yes, the fragment is not normally transmitted to the server, but since the user is running code on their browser which was provided to them by mega, all mega needs to do is log the fragment back to their servers with a simple ajax call. The point wasn't that mega can deny ever getting the key - the point was that this "security" system in place is very obviously designed to workaround the problem of mega knowing what files they were trading. This would probably be viewed as willful blindness and not actually protect them in court: see: https://news.ycombinator.com/item?id=10415535 https://news.ycombinator.com/item?id=10415535