8 ms·

A word on cryptography

130 points by rsingel 14y ago

augustl 14y ago
The article is not accessible from what their system deems a mobile device (a Nexus 7 in my case), all I get is a redirect to a "dedicated mobile app coming soon" page..
- erre 14y ago
  If that's just your criticism, fair enough. But, in case you think that makes you unable to actually read the article: on the Nexus 7, you can click the "menu" button (those three vertical dots) and select "Request desktop site".
  - augustl 14y ago
    Ah, good stuff, didn't know Chrome for Android could do that!
htf 14y ago
It looks like they know what they're doing. I was especially curious about deduplication. The way they do it sounds perfectly reasonable: > MEGA indeed uses deduplication, but it does so based on the entire file post-encryption rather than on blocks pre-encryption. If the same file is uploaded twice, encrypted with the same random 128-bit key, only one copy is stored on the server. Or, if (and this is much more likely!) a file is copied between folders or user accounts through the file manager or the API, all copies point to the same physical file.
- wmf 14y ago
  Basically this isn't dedupe. If two people upload the same file, Mega will store two copies.
  - eps 14y ago
    But is it possible to share a file and a key, so that a receiver of a share wouldn't need to re-encrypt the file and could instead stash a copy as is? I bet they support this. If I were Mega, I'd be doing this yesterday.
    - wmf 14y ago
      Sure, they do that. But I don't consider symlinking to be dedupe either.
- guessWhy 14y ago
  Yes, but the first part makes no sense. If the 128-bit key is indeed chosen at random for each file (as it should be), the probability that the same key will be chosen again for a second upload of the same file is effectively zero (1/2^128).
  - RaphiePS 14y ago
    It'd make more sense to derive the key from the data. That way, if two files are duplicates, their encrypted versions will also be duplicates.
    - wmf 14y ago
      As mentioned in the last ten Mega crypto threads, security pedants aren't satisfied with the level of privacy that convergent encryption provides.
      - guessWhy 14y ago
        I better idea might be to use convergent encryption only for really large files. Practically this would mean deduplication of software, movies, etc.
        AnthonyMouse 14y ago
        That has a good practical benefit (deduplication of files that most benefit from deduplication), but it doesn't actually solve the security problems at all, it's just choosing to make the trade off one way for large files and a different way for smaller files. If you have a legitimate reason to want privacy against data confirmation attacks then you need what you need regardless of file size. The whole thing with deduplication is a little bit overblown anyway. You don't want a hundred copies of the same big file, but is that what really happens? Nobody wants to upload the same file a hundred times, especially if the file is very large. Once there is already a copy, passing around a link to it is much easier than uploading it again. So the most common cause for it to happen is when two totally unrelated people upload the same bit-for-bit identical file, which happens, but not so often as to be prohibitive. And in many cases file-level deduplication is difficult or impossible anyway because users make changes to the files (like editing embedded metadata or pointlessly encapsulating a single already-compressed file into a .rar archive), so the benefits you get from deduplication are not nothing, but there are situations where it is or isn't a reasonable trade off to make against privacy.
- jd007 14y ago
  So it basically dedupes whatever you copy to a different folder on your own account. I guess this is the best they can do without knowing anything about the files (though not really that useful). To get true deduplication, convergent encryption is needed, which reveals more information about what you are storing (e.g. if I store the same file as you I will know what your file is)
- kylemaxwell 14y ago
  It looks like they know what they're doing. Based on all the analyses published so far, it does not look like that at all. In your view, what makes it appear that their crypto was implemented in anything resembling a proper fashion?
  - htf 14y ago
    Yeah they did some things wrong apparently. I don't even know enough to pass judgment.
oconnore 14y ago
It's important to understand that the only reason they are doing this at all is for copyright defense.
- tptacek 14y ago
  I find that idea very hard to square with their home page.
  - jlgreco 14y ago
    I'm not so sure using encryption just to eliminate liability for themselves would go over all that well. It makes sense to me that they would lie about the purpose. Certainly if they are advertising security for end users, they should deliver it properly, but honestly I doubt that is their actual intent. This seems to be the sort of 'security' that only needs to be strong enough that they can say with a straight face in court that they cannot break it themselves.
  - oconnore 14y ago
    They get shut down for copyright infringement and immediately come back with a service touting a privacy system. Privacy from whom? At Megaupload, your files were private from other people. Mega themselves has/had no interest in snooping through your files. Various copyright enforcement agencies are very interested in ensuring that users are not violating copyright. There is nothing about their system that is less secure than Megaupload was. In both cases, everything goes over HTTPS. The only new addition (no matter how broken their system is) is that now Mega cannot be reasonable expected to monitor file upload content, or provide third parties with the ability to monitor content.
    - tptacek 14y ago
      They didn't say "Strong". They said "Stronger". They didn't say "Safe". They said "Safer".
      - deleted 14y ago
        [deleted]
comex 14y ago
marcan tweeted that the JavaScript verification mentioned in the article is completely broken: https://twitter.com/marcan42 https://twitter.com/marcan42 I thought MEGA's sales pitch was pretty good. And then I saw their Javascript hashing code. Oh, the hilarity. They're using a broken variant of CBC-MAC to authenticate their Javascript. Except CBC-MAC isn't a hash. The key is public, so it's a joke. CBC-MAC only works as a MAC, not as a hash function. You can replace all of their JS, do a trivial subtract, and make it "hash" the same. They also make other mistakes, like not authenticating the length and just concatenating the various files, so other attacks are possible.
- tptacek 14y ago
  CBC-MAC is also tricky to get right even if you know what it is. It's a very weird choice. But I wouldn't want to dignify the notion that one piece of Javascript can "validate" other Javascript "files" anyways; the whole notion of Javascript validation is dubious, because what you need to validate is the whole JS runtime, not just individual files. Browsers don't provide tools to do that.
  - comex 14y ago
    Huh? It's perfectly valid in theory for one piece of trusted JavaScript to download another from an insecure source and validate it before evalling it - the attack scenario is not the browser being compromised, it's the source delivering malicious code. (Whether this is really a useful thing to do compared to serving all the JS in one place is another question.)
    - tptacek 14y ago
      Real systems that try to implement this scheme generally wind up implementing the misconception that everything that contributes to the JS runtime comes from discrete Javascript files.
      - dmix 14y ago
        Do you have a source? I tried googling javascript runtime (primarily v8) exploitation and haven't been able to find any examples of this ever happening. Edit: I'm not saying its not plausible, but wouldn't it require root/user access? What benefit would it provide over other type of attacks with that level of access? Just because there's no browser tools to check for it?
zomgbbq 14y ago
Am I the only one that noticed that when the page loads, it shows an image very similar to stripe.com's cloud-with-gears image? Here are the two images overlayed on top of each other: http://i.imgur.com/pEuIbiD.png?1 http://i.imgur.com/pEuIbiD.png?1
- deleted 14y ago
  [deleted]
- e-dard 14y ago
  How many ways are there to draw a cloud?
  - wmf 14y ago
    Obligatory: http://www.hanselman.com/blog/ThereIsOnlyOneCloudIconInTheEntireUniverse.aspx http://www.hanselman.com/blog/ThereIsOnlyOneCloudIconInTheEn... The gears are a little suspicious, though.
- pyre 14y ago
  http://thenextweb.com/apple/2011/10/16/apples-icloud-icon-its-not-as-unique-as-you-might-think/ http://thenextweb.com/apple/2011/10/16/apples-icloud-icon-it...
doe88 14y ago
This is just another example where I don't understand why people are so critical toward someone who try to build something. Are there any flaws? probably, but who would honestly expect such massive code base wouldn't have any flaw? but does that fatally undermine what he's trying to achieve? I don't think so. But i'm going to tell you why he has no good press, because he has no crypto creds, there are plenty of experts who think that you don't have the right to write any crypto code if you don't have the appropriate creds and are very vocals when any attempt is made by someone not of their kind, some of them even behave like bullies. I say don't listen to them, write some crypto code, make some mistakes, learn from them and correct them.
- 30thElement 14y ago
  There's a big difference between writing your own code just to learn how AES works and writing code and then saying "we will protect your privacy using this code". The reason experts discourage people from writing crypto code is because it's Hard; even the experts get it wrong. Even if you ignore all the weaknesses you can create by using bad keys, there are still simple mistakes that will ruin you system. For RSA you need to make sure your key generation isn't subject to Pollard's p-1, Pollard's rho, William's p+1, Fermat factorization, Wiener's attack, and others. And then once you do that, if you pad incorrectly the whole thing gets blown up anyway. This isn't someones little toy app, this is a professionally done, "we will protect your privacy" service with the government already breathing down their neck. The sloppiness they are showing in their crypto (or at least in their presentation of the crypto) is just unacceptable.
  - doe88 14y ago
    "discourage" such an euphemism. You can write crypto code and not rewrite all the primitives, I certainly think that any good software engineer could write his own implementation of operations on GF(2^n) but if it's a good software engineer he will also prefer to pick the right primitives, use the right libraries and write the right crypto glue code. It's not all or nothing. You can be a professional software engineer and write crypto code.
AnthonyMouse 14y ago
It seems like the security vulnerabilities are somewhat beside the point. It's basically a beta, it's got bugs. But what they're trying to do is capable of being secure. You can store data on a server without the server operator having any ability to know what it is. It's not a new thing: You've always been able to upload a truecrypt volume to any untrusted server. They're just trying to make it easier to use for the man in the street. So their implementation has flaws. Security experts are pointing them out. I expect they'll be fixed soon enough.
- cmircea 14y ago
  They haven't found any concrete flaws though. Just speculation and outright wrong information. The "If you can break SSL, you can break MEGA." made my day. I think MEGA is the least of your worries if SSL is broken; credit card transactions would be compromised big time.
  - AnthonyMouse 14y ago
    >They haven't found any concrete flaws though. Just speculation and outright wrong information. I have no doubt that some of the criticism is rooted in just a general hatred and cynicism about "kim.com" and has no foundation, but some of the things they're doing are legitimately questionable. Like having javascript served from their servers have access to your password. If you want it to be secure against them, you can't really do that. If they get compromised then their server will serve compromised javascript and your data can be read by the attackers the next time you access it. But it's a trade off -- using javascript has somewhat lower security but is easier for users to use -- and it seems like they even recognize it. The way around it is to use a community-verified open source client (like a browser plug in) to process users' passwords and never leave them or the unencrypted data in the control of code from the Mega server, and it appears they have plans to do that. And that has other benefits as well, like making it easy to use high entropy machine-generated passwords for every piece of data and having the plug in store the passwords encrypted on your local disk with a master secret, so that you only have to remember one strong password for all your data (or, if you're paranoid, one password for each set of data classified by security level). >The "If you can break SSL, you can break MEGA." made my day. Yeah, is that actually not a straw man? Someone really said that? I have to hope they were being sarcastic.
RaphiePS 14y ago
I have no idea why a simple blog post would take 20 seconds to load--long enough to have its own loading bar! Taking a quick look at the source, it looks like they're doing some sort of crypto. Very weird.
danso 14y ago
I haven't read much actual writing from the Mega crew...but I was impressed with its lack of ad hominem in its rebuttal. Sometimes, these technical debates, especially when played out in the media, can get quite snarky.
- gegenschall 14y ago
  The ad hominem way of discussion may or may not be present in technical debates in general. What actually doesn't surprise me is that this style surfaces on publications associated with Dotcom. If you happen to speak/understand German you (really!) should read this: http://arnold.babsi.de/KIMBLE.txt http://arnold.babsi.de/KIMBLE.txt Basically the file contains old newsgroup postings from de.org.ccc wherein Dotcom (Kimble) argues with or better harrasses the CCC guys. It's really "worthwhile" and and an eye-opener.
  - rolux 14y ago
    If you read German, also take a look at this: http://www.gulli.com/news/12565-nachruf-guenter-freiherr-von-gravenreuth-2010-02-22 http://www.gulli.com/news/12565-nachruf-guenter-freiherr-von... (scroll down for paragraph about Kim Schmitz) The basic idea would be that Megaupload looked very much like his mid-90s warez BBS scheme, just on a much larger scale.
  - rjzzleep 14y ago
    well, you know. i can see now why the ccc guys hate him. my coworkers said he was a douche. and I can also see how they would say he talks more sales than skill... but the other side of it is, he's kinda right too. he's recruiting from the ccc. a good place to recruit from. and he's talking about ACTUALLY making money on stuff. it's kinda what my mother was saying when i was doing mainly opensource stuff. she said, why are you working for free, and I said you don't understand. Germany is a kinda socialist country. I know, I grew up there. That's why there's a whole bunch of great open source projects coming out that place. And then the americans come, and make money on it. I'm kinda derailing, and I could go on, but I'll just leave it at he's a douche, and he may be a fraud, but the guys he's trying to recruit from are not. And he kinda has a point. And look at him now. He's got a shitload of funds, enough to pick a fight with a government, and where's the CCC? It's still hiding behind political correctness, still doing stuff years ahead of defcon, and yet everyone talks about defcon instead.
cometc 14y ago
I would love to see this effort open sourced - both for others to learn from and to establish it's security more openly.
- jy-p 14y ago
  it is essentially open sourced already - the client-side crypto is done in javascript which you can download or find online.
ishansharma 14y ago
Whatever respect and excitement I had for Mega and Dotcom was lost when I tried visiting the link on Phone and iPad and it automatically redirected me to "An app will be launched soon for your device". Huh, I don't know how they do not get Internet. All the messed up encryption and now this. Bye Mega, I'm never joining of visiting you. And Kim Dotcom, sir, you make good entertainment but I don't think your services suit me!
- noknockers 14y ago
  So you're saying that you're pissed off because they're working on a free app for you, for a free service for you?
  - raylu 14y ago
    I think his gripe is that he couldn't see the blog post because their site did some browser detection and took him to the mobile version.
  - ishansharma 14y ago
    No. Just that I can't read post as I'm sent to mobile version automatically from a blog post!
jakozaur 14y ago
It is likely that they got a few flaws, but they make an effort and so many security researchers look at them. Ultimately, they have a good chance to be the most secure hosting service available for masses.
rorrr 14y ago
Some browsers already provide quality random numbers. This works in Chrome: var x = new Uint8Array(10); window.crypto.getRandomValues(x); console.log(x);
- gameshot911 14y ago
  How do I run code in Chrome?
  - bajsejohannes 14y ago
    On OS X: cmd+alt+j, paste, enter Probably substitute cmd for ctrl on other OSes.
rorrr 14y ago
Some browsers already provide quality random numbers. This works in Chrome: var x = new Uint8Array(10); window.crypto.getRandomValues(x); console.log(x);
mnutt 14y ago
Leaving aside the issues of whether they've made mistakes in their crypto, I think the more interesting point brought up by tptacek is that you can't truly trust any client-side application that gets downloaded from the server every time you go to the site. As much as Mega wants to protect your privacy, there is always the possibility that some entity forces them to trivially break your encryption by adding some javascript that uploads your private key and steals your password. Is it possible or desirable to secure a web app from its own creators? The web is by far the largest and most successful software distribution mechanism of all time (depending on how you define 'software') and it's built around the idea that the creator can update the app at any time in a completely agile fashion. But for certain classes of software, maybe it makes sense to protect the users from the authors, or the authors from their future actions. You might be able to accomplish something like this in a really hacked-up fashion with HTML5 application manifests. Perhaps you could have the application manifest include itself, to prevent the page from ever trying to load itself again, and then have all updates happen though an AJAX mechanism that validated each download and allowed third parties to verify that it was safe. But rereading the idea, it sounds neither pleasant to use nor particularly safe. Is this "packaged software" mechanism something that should be built into the browser at some level, or are we just doomed to running this class of applications as native apps?
- kansface 14y ago
  You can't trust any code for which you can't review the source. Even so, you can't trust its interpreter/compiler without verifying its source and the compiler that compiled it. This includes your OS of course. One would probably also want to verify hardware level exploits too.
  - jy-p 14y ago
    well, he's talking about software, so getting into hardware exploits is a bit out-of-scope. that's not to say you shouldn't be worried either your silicon or NIC firmware are compromised ;)
- jy-p 14y ago
  it is conceivable that such a system could work but it would have to rely on some kind of authenticity check on the binary/script that runs. when "crossing your t's and dotting your i's" it is usually best to use an out-of-band method to check signatures, e.g. download binary installer, check gpg signature or calling them on the phone to verify fingerprints. even so, this cannot stop a MITM unless you do the key exchange in person, e.g. meet the software creator and exchange gpg pubkeys on the spot.
rdl 14y ago
I'm not sure if they were being intentionally vague on how the deduplication works, or just bad at writing, or writing for an incompetent audience. It didn't seem clear based on what they said how it works.

130 points by rsingel 14y ago

The article is not accessible from what their system deems a mobile device (a Nexus 7 in my case), all I get is a redirect to a "dedicated mobile app coming soon" page..

erre 14y ago
If that's just your criticism, fair enough. But, in case you think that makes you unable to actually read the article: on the Nexus 7, you can click the "menu" button (those three vertical dots) and select "Request desktop site".
- augustl 14y ago
  Ah, good stuff, didn't know Chrome for Android could do that!

htf 14y ago

It looks like they know what they're doing. I was especially curious about deduplication. The way they do it sounds perfectly reasonable: > MEGA indeed uses deduplication, but it does so based on the entire file post-encryption rather than on blocks pre-encryption. If the same file is uploaded twice, encrypted with the same random 128-bit key, only one copy is stored on the server. Or, if (and this is much more likely!) a file is copied between folders or user accounts through the file manager or the API, all copies point to the same physical file.

wmf 14y ago
Basically this isn't dedupe. If two people upload the same file, Mega will store two copies.
- eps 14y ago
  But is it possible to share a file and a key, so that a receiver of a share wouldn't need to re-encrypt the file and could instead stash a copy as is? I bet they support this. If I were Mega, I'd be doing this yesterday.
  - wmf 14y ago
    Sure, they do that. But I don't consider symlinking to be dedupe either.
guessWhy 14y ago
Yes, but the first part makes no sense. If the 128-bit key is indeed chosen at random for each file (as it should be), the probability that the same key will be chosen again for a second upload of the same file is effectively zero (1/2^128).
- RaphiePS 14y ago
  It'd make more sense to derive the key from the data. That way, if two files are duplicates, their encrypted versions will also be duplicates.
  - wmf 14y ago
    As mentioned in the last ten Mega crypto threads, security pedants aren't satisfied with the level of privacy that convergent encryption provides.
    - guessWhy 14y ago
      I better idea might be to use convergent encryption only for really large files. Practically this would mean deduplication of software, movies, etc.
      - AnthonyMouse 14y ago
        That has a good practical benefit (deduplication of files that most benefit from deduplication), but it doesn't actually solve the security problems at all, it's just choosing to make the trade off one way for large files and a different way for smaller files. If you have a legitimate reason to want privacy against data confirmation attacks then you need what you need regardless of file size. The whole thing with deduplication is a little bit overblown anyway. You don't want a hundred copies of the same big file, but is that what really happens? Nobody wants to upload the same file a hundred times, especially if the file is very large. Once there is already a copy, passing around a link to it is much easier than uploading it again. So the most common cause for it to happen is when two totally unrelated people upload the same bit-for-bit identical file, which happens, but not so often as to be prohibitive. And in many cases file-level deduplication is difficult or impossible anyway because users make changes to the files (like editing embedded metadata or pointlessly encapsulating a single already-compressed file into a .rar archive), so the benefits you get from deduplication are not nothing, but there are situations where it is or isn't a reasonable trade off to make against privacy.
jd007 14y ago
So it basically dedupes whatever you copy to a different folder on your own account. I guess this is the best they can do without knowing anything about the files (though not really that useful). To get true deduplication, convergent encryption is needed, which reveals more information about what you are storing (e.g. if I store the same file as you I will know what your file is)
kylemaxwell 14y ago
It looks like they know what they're doing. Based on all the analyses published so far, it does not look like that at all. In your view, what makes it appear that their crypto was implemented in anything resembling a proper fashion?
- htf 14y ago
  Yeah they did some things wrong apparently. I don't even know enough to pass judgment.

oconnore 14y ago

It's important to understand that the only reason they are doing this at all is for copyright defense.

tptacek 14y ago
I find that idea very hard to square with their home page.
- jlgreco 14y ago
  I'm not so sure using encryption just to eliminate liability for themselves would go over all that well. It makes sense to me that they would lie about the purpose. Certainly if they are advertising security for end users, they should deliver it properly, but honestly I doubt that is their actual intent. This seems to be the sort of 'security' that only needs to be strong enough that they can say with a straight face in court that they cannot break it themselves.
- oconnore 14y ago
  They get shut down for copyright infringement and immediately come back with a service touting a privacy system. Privacy from whom? At Megaupload, your files were private from other people. Mega themselves has/had no interest in snooping through your files. Various copyright enforcement agencies are very interested in ensuring that users are not violating copyright. There is nothing about their system that is less secure than Megaupload was. In both cases, everything goes over HTTPS. The only new addition (no matter how broken their system is) is that now Mega cannot be reasonable expected to monitor file upload content, or provide third parties with the ability to monitor content.
  - tptacek 14y ago
    They didn't say "Strong". They said "Stronger". They didn't say "Safe". They said "Safer".
    - deleted 14y ago
      [deleted]

comex 14y ago

marcan tweeted that the JavaScript verification mentioned in the article is completely broken: https://twitter.com/marcan42 https://twitter.com/marcan42 I thought MEGA's sales pitch was pretty good. And then I saw their Javascript hashing code. Oh, the hilarity. They're using a broken variant of CBC-MAC to authenticate their Javascript. Except CBC-MAC isn't a hash. The key is public, so it's a joke. CBC-MAC only works as a MAC, not as a hash function. You can replace all of their JS, do a trivial subtract, and make it "hash" the same. They also make other mistakes, like not authenticating the length and just concatenating the various files, so other attacks are possible.

tptacek 14y ago
CBC-MAC is also tricky to get right even if you know what it is. It's a very weird choice. But I wouldn't want to dignify the notion that one piece of Javascript can "validate" other Javascript "files" anyways; the whole notion of Javascript validation is dubious, because what you need to validate is the whole JS runtime, not just individual files. Browsers don't provide tools to do that.
- comex 14y ago
  Huh? It's perfectly valid in theory for one piece of trusted JavaScript to download another from an insecure source and validate it before evalling it - the attack scenario is not the browser being compromised, it's the source delivering malicious code. (Whether this is really a useful thing to do compared to serving all the JS in one place is another question.)
  - tptacek 14y ago
    Real systems that try to implement this scheme generally wind up implementing the misconception that everything that contributes to the JS runtime comes from discrete Javascript files.
    - dmix 14y ago
      Do you have a source? I tried googling javascript runtime (primarily v8) exploitation and haven't been able to find any examples of this ever happening. Edit: I'm not saying its not plausible, but wouldn't it require root/user access? What benefit would it provide over other type of attacks with that level of access? Just because there's no browser tools to check for it?

zomgbbq 14y ago

Am I the only one that noticed that when the page loads, it shows an image very similar to stripe.com's cloud-with-gears image? Here are the two images overlayed on top of each other: http://i.imgur.com/pEuIbiD.png?1 http://i.imgur.com/pEuIbiD.png?1

deleted 14y ago
[deleted]
e-dard 14y ago
How many ways are there to draw a cloud?
- wmf 14y ago
  Obligatory: http://www.hanselman.com/blog/ThereIsOnlyOneCloudIconInTheEntireUniverse.aspx http://www.hanselman.com/blog/ThereIsOnlyOneCloudIconInTheEn... The gears are a little suspicious, though.
pyre 14y ago
http://thenextweb.com/apple/2011/10/16/apples-icloud-icon-its-not-as-unique-as-you-might-think/ http://thenextweb.com/apple/2011/10/16/apples-icloud-icon-it...

doe88 14y ago

This is just another example where I don't understand why people are so critical toward someone who try to build something. Are there any flaws? probably, but who would honestly expect such massive code base wouldn't have any flaw? but does that fatally undermine what he's trying to achieve? I don't think so. But i'm going to tell you why he has no good press, because he has no crypto creds, there are plenty of experts who think that you don't have the right to write any crypto code if you don't have the appropriate creds and are very vocals when any attempt is made by someone not of their kind, some of them even behave like bullies. I say don't listen to them, write some crypto code, make some mistakes, learn from them and correct them.

30thElement 14y ago
There's a big difference between writing your own code just to learn how AES works and writing code and then saying "we will protect your privacy using this code". The reason experts discourage people from writing crypto code is because it's Hard; even the experts get it wrong. Even if you ignore all the weaknesses you can create by using bad keys, there are still simple mistakes that will ruin you system. For RSA you need to make sure your key generation isn't subject to Pollard's p-1, Pollard's rho, William's p+1, Fermat factorization, Wiener's attack, and others. And then once you do that, if you pad incorrectly the whole thing gets blown up anyway. This isn't someones little toy app, this is a professionally done, "we will protect your privacy" service with the government already breathing down their neck. The sloppiness they are showing in their crypto (or at least in their presentation of the crypto) is just unacceptable.
- doe88 14y ago
  "discourage" such an euphemism. You can write crypto code and not rewrite all the primitives, I certainly think that any good software engineer could write his own implementation of operations on GF(2^n) but if it's a good software engineer he will also prefer to pick the right primitives, use the right libraries and write the right crypto glue code. It's not all or nothing. You can be a professional software engineer and write crypto code.

AnthonyMouse 14y ago

It seems like the security vulnerabilities are somewhat beside the point. It's basically a beta, it's got bugs. But what they're trying to do is capable of being secure. You can store data on a server without the server operator having any ability to know what it is. It's not a new thing: You've always been able to upload a truecrypt volume to any untrusted server. They're just trying to make it easier to use for the man in the street. So their implementation has flaws. Security experts are pointing them out. I expect they'll be fixed soon enough.

cmircea 14y ago
They haven't found any concrete flaws though. Just speculation and outright wrong information. The "If you can break SSL, you can break MEGA." made my day. I think MEGA is the least of your worries if SSL is broken; credit card transactions would be compromised big time.
- AnthonyMouse 14y ago
  >They haven't found any concrete flaws though. Just speculation and outright wrong information. I have no doubt that some of the criticism is rooted in just a general hatred and cynicism about "kim.com" and has no foundation, but some of the things they're doing are legitimately questionable. Like having javascript served from their servers have access to your password. If you want it to be secure against them, you can't really do that. If they get compromised then their server will serve compromised javascript and your data can be read by the attackers the next time you access it. But it's a trade off -- using javascript has somewhat lower security but is easier for users to use -- and it seems like they even recognize it. The way around it is to use a community-verified open source client (like a browser plug in) to process users' passwords and never leave them or the unencrypted data in the control of code from the Mega server, and it appears they have plans to do that. And that has other benefits as well, like making it easy to use high entropy machine-generated passwords for every piece of data and having the plug in store the passwords encrypted on your local disk with a master secret, so that you only have to remember one strong password for all your data (or, if you're paranoid, one password for each set of data classified by security level). >The "If you can break SSL, you can break MEGA." made my day. Yeah, is that actually not a straw man? Someone really said that? I have to hope they were being sarcastic.

RaphiePS 14y ago

I have no idea why a simple blog post would take 20 seconds to load--long enough to have its own loading bar! Taking a quick look at the source, it looks like they're doing some sort of crypto. Very weird.

danso 14y ago

I haven't read much actual writing from the Mega crew...but I was impressed with its lack of ad hominem in its rebuttal. Sometimes, these technical debates, especially when played out in the media, can get quite snarky.

gegenschall 14y ago
The ad hominem way of discussion may or may not be present in technical debates in general. What actually doesn't surprise me is that this style surfaces on publications associated with Dotcom. If you happen to speak/understand German you (really!) should read this: http://arnold.babsi.de/KIMBLE.txt http://arnold.babsi.de/KIMBLE.txt Basically the file contains old newsgroup postings from de.org.ccc wherein Dotcom (Kimble) argues with or better harrasses the CCC guys. It's really "worthwhile" and and an eye-opener.
- rolux 14y ago
  If you read German, also take a look at this: http://www.gulli.com/news/12565-nachruf-guenter-freiherr-von-gravenreuth-2010-02-22 http://www.gulli.com/news/12565-nachruf-guenter-freiherr-von... (scroll down for paragraph about Kim Schmitz) The basic idea would be that Megaupload looked very much like his mid-90s warez BBS scheme, just on a much larger scale.
- rjzzleep 14y ago
  well, you know. i can see now why the ccc guys hate him. my coworkers said he was a douche. and I can also see how they would say he talks more sales than skill... but the other side of it is, he's kinda right too. he's recruiting from the ccc. a good place to recruit from. and he's talking about ACTUALLY making money on stuff. it's kinda what my mother was saying when i was doing mainly opensource stuff. she said, why are you working for free, and I said you don't understand. Germany is a kinda socialist country. I know, I grew up there. That's why there's a whole bunch of great open source projects coming out that place. And then the americans come, and make money on it. I'm kinda derailing, and I could go on, but I'll just leave it at he's a douche, and he may be a fraud, but the guys he's trying to recruit from are not. And he kinda has a point. And look at him now. He's got a shitload of funds, enough to pick a fight with a government, and where's the CCC? It's still hiding behind political correctness, still doing stuff years ahead of defcon, and yet everyone talks about defcon instead.

cometc 14y ago

I would love to see this effort open sourced - both for others to learn from and to establish it's security more openly.

jy-p 14y ago
it is essentially open sourced already - the client-side crypto is done in javascript which you can download or find online.

ishansharma 14y ago

Whatever respect and excitement I had for Mega and Dotcom was lost when I tried visiting the link on Phone and iPad and it automatically redirected me to "An app will be launched soon for your device". Huh, I don't know how they do not get Internet. All the messed up encryption and now this. Bye Mega, I'm never joining of visiting you. And Kim Dotcom, sir, you make good entertainment but I don't think your services suit me!

noknockers 14y ago
So you're saying that you're pissed off because they're working on a free app for you, for a free service for you?
- raylu 14y ago
  I think his gripe is that he couldn't see the blog post because their site did some browser detection and took him to the mobile version.
- ishansharma 14y ago
  No. Just that I can't read post as I'm sent to mobile version automatically from a blog post!

jakozaur 14y ago

It is likely that they got a few flaws, but they make an effort and so many security researchers look at them. Ultimately, they have a good chance to be the most secure hosting service available for masses.

rorrr 14y ago

Some browsers already provide quality random numbers. This works in Chrome: var x = new Uint8Array(10); window.crypto.getRandomValues(x); console.log(x);

gameshot911 14y ago
How do I run code in Chrome?
- bajsejohannes 14y ago
  On OS X: cmd+alt+j, paste, enter Probably substitute cmd for ctrl on other OSes.

rorrr 14y ago

Some browsers already provide quality random numbers. This works in Chrome: var x = new Uint8Array(10); window.crypto.getRandomValues(x); console.log(x);

mnutt 14y ago

Leaving aside the issues of whether they've made mistakes in their crypto, I think the more interesting point brought up by tptacek is that you can't truly trust any client-side application that gets downloaded from the server every time you go to the site. As much as Mega wants to protect your privacy, there is always the possibility that some entity forces them to trivially break your encryption by adding some javascript that uploads your private key and steals your password. Is it possible or desirable to secure a web app from its own creators? The web is by far the largest and most successful software distribution mechanism of all time (depending on how you define 'software') and it's built around the idea that the creator can update the app at any time in a completely agile fashion. But for certain classes of software, maybe it makes sense to protect the users from the authors, or the authors from their future actions. You might be able to accomplish something like this in a really hacked-up fashion with HTML5 application manifests. Perhaps you could have the application manifest include itself, to prevent the page from ever trying to load itself again, and then have all updates happen though an AJAX mechanism that validated each download and allowed third parties to verify that it was safe. But rereading the idea, it sounds neither pleasant to use nor particularly safe. Is this "packaged software" mechanism something that should be built into the browser at some level, or are we just doomed to running this class of applications as native apps?

kansface 14y ago
You can't trust any code for which you can't review the source. Even so, you can't trust its interpreter/compiler without verifying its source and the compiler that compiled it. This includes your OS of course. One would probably also want to verify hardware level exploits too.
- jy-p 14y ago
  well, he's talking about software, so getting into hardware exploits is a bit out-of-scope. that's not to say you shouldn't be worried either your silicon or NIC firmware are compromised ;)
jy-p 14y ago
it is conceivable that such a system could work but it would have to rely on some kind of authenticity check on the binary/script that runs. when "crossing your t's and dotting your i's" it is usually best to use an out-of-band method to check signatures, e.g. download binary installer, check gpg signature or calling them on the phone to verify fingerprints. even so, this cannot stop a MITM unless you do the key exchange in person, e.g. meet the software creator and exchange gpg pubkeys on the spot.

rdl 14y ago

I'm not sure if they were being intentionally vague on how the deduplication works, or just bad at writing, or writing for an incompetent audience. It didn't seem clear based on what they said how it works.