5 ms·

Thanks, I had no idea that's how it worked. Embedding the key in a part of the URL that's not sent to the server is a stroke of genius. I still find it surpris

Thanks, I had no idea that's how it worked. Embedding the key in a part of the URL that's not sent to the server is a stroke of genius. I still find it surprising that so many people use Mega (at least enough that it can stay in business) when BitTorrent can easily saturate a downlink and is free.

Daedren 2y ago
Hosting pirated content is a liability, and putting it on MEGA helps clear it. Many countries have issues with torrenting such data too, as it's an easy way to get a notice at home from your ISP if you're not on a VPN. I assume many kids in dorms and whatnot may have bittorrent traffic blocked as well.
cevn 2y ago
I dunno if this is unreasonable, but I fear dling Torrents with high number of seeders in case one of them is malicious. With Mega you only had to trust one server.
- codetrotter 2y ago
  Torrent files have hash check sums of the fragments. If someone sends you a bad fragment it will be discarded. Magnet links are also hashes, so when you retrieve torrent metadata from your peers from a magnet link that data will also be verified for integrity. However, if the original torrent itself was made from malicious data then it’s still gonna result in malicious code on your system. Interestingly though, it is probably far more likely that a torrent with a very low number of seeders is malicious, than that a popular torrent contains malicious data in the files you download. I suppose it could still be possible that the malicious code sent by a peer was targeting a weakness in your torrent client itself though. And that they could get remote code execution on your computer that way. The main thing I would worry about with torrents is that your IP could be seen in the swarm by one of the companies that monitor torrent peers on behalf of rights holders and send you a nasty demand for money and threats of legal action.
  - themaninthedark 2y ago
    Malice in this context could mean that they are concerned about someone tracking the activity. If you are connected to a server, the server is the only connection(and only one with a log) but with a torrent, there are multiple connections so multiple parties could be keeping logs. Depending on how a file is split in the torrent, it could be possible to add malice data with a collision: https://www.mscs.dal.ca/~selinger/md5collision/ https://www.mscs.dal.ca/~selinger/md5collision/
    - fluoridation 2y ago
      BitTorrent uses SHA-1, not MD5. It's not ideal, but hardly vulnerable.
      - kbolino 2y ago
        SHA-1 has been broken since 2017. It is considerably more expensive to produce a SHA-1 collision than an MD5 collision, but certainly not impossible. However, BitTorrent v2 also came out in 2017 and uses SHA-256, for which no known collisions exist even today.
rvnx 2y ago
Legally they can decrypt the content though, they have access to the key, they just need to change a piece of JavaScript so it sends back to the key to their server the next time a page visitor comes. It's up to the courts and to them to decide. Perhaps they are doing it already, but just keeping it low-profile, so the "real" dangerous people get attracted to the service and caught. Like VPNs.

Daedren 2y ago

Hosting pirated content is a liability, and putting it on MEGA helps clear it. Many countries have issues with torrenting such data too, as it's an easy way to get a notice at home from your ISP if you're not on a VPN. I assume many kids in dorms and whatnot may have bittorrent traffic blocked as well.

cevn 2y ago

I dunno if this is unreasonable, but I fear dling Torrents with high number of seeders in case one of them is malicious. With Mega you only had to trust one server.

codetrotter 2y ago
Torrent files have hash check sums of the fragments. If someone sends you a bad fragment it will be discarded. Magnet links are also hashes, so when you retrieve torrent metadata from your peers from a magnet link that data will also be verified for integrity. However, if the original torrent itself was made from malicious data then it’s still gonna result in malicious code on your system. Interestingly though, it is probably far more likely that a torrent with a very low number of seeders is malicious, than that a popular torrent contains malicious data in the files you download. I suppose it could still be possible that the malicious code sent by a peer was targeting a weakness in your torrent client itself though. And that they could get remote code execution on your computer that way. The main thing I would worry about with torrents is that your IP could be seen in the swarm by one of the companies that monitor torrent peers on behalf of rights holders and send you a nasty demand for money and threats of legal action.
- themaninthedark 2y ago
  Malice in this context could mean that they are concerned about someone tracking the activity. If you are connected to a server, the server is the only connection(and only one with a log) but with a torrent, there are multiple connections so multiple parties could be keeping logs. Depending on how a file is split in the torrent, it could be possible to add malice data with a collision: https://www.mscs.dal.ca/~selinger/md5collision/ https://www.mscs.dal.ca/~selinger/md5collision/
  - fluoridation 2y ago
    BitTorrent uses SHA-1, not MD5. It's not ideal, but hardly vulnerable.
    - kbolino 2y ago
      SHA-1 has been broken since 2017. It is considerably more expensive to produce a SHA-1 collision than an MD5 collision, but certainly not impossible. However, BitTorrent v2 also came out in 2017 and uses SHA-256, for which no known collisions exist even today.

rvnx 2y ago

Legally they can decrypt the content though, they have access to the key, they just need to change a piece of JavaScript so it sends back to the key to their server the next time a page visitor comes. It's up to the courts and to them to decide. Perhaps they are doing it already, but just keeping it low-profile, so the "real" dangerous people get attracted to the service and caught. Like VPNs.