5 ms·

So you can steal the encryption keys from the browser. What a surprise. I don't think anyone at Mega gives a damn though, or the people who are going to use it

So you can steal the encryption keys from the browser. What a surprise. I don't think anyone at Mega gives a damn though, or the people who are going to use it to upload movies. The only reason there's an encryption key at all is to cover their asses on future lawsuits, not to make Mega amazingly secure.

ChuckMcM 14y ago
This is what I think is the speculation. Let us speculate you wanted to build a "legitimate" Pirate Bay type system, what would you have to do in order to pass the 'sniff test' for litigators while providing an otherwise easy to use service? I am not in any way at all suggesting that Mega is doing this, or that they are even trying to do this. I am simply observing that there is an interesting case to be made where you can swear under oath you did you best to make the site secure, and yet people more sophisticated than you broke into it and had their way with you. How much liability does that protect you from? Any? All? I haven't got a clue here but I find the question an interesting one. Perhaps Eric Goldman will chime in.
- forrestthewoods 14y ago
  Stopping your digital locker online service from being used for mass copyright infringing material is easy. Go ahead and host a movie on dropbox and share a public link on a popular site. See how long it stays valid. A normal system admin might decide a single 4gb file accounting for tens of terabytes of traffic is unusual and investigate the cause. Odds are pretty decent you'll be able to find a source driving all the traffic. Kim Dotcom is going for the blind eye approach. Just close your eyes and cover your ears so it's not your fault. He did this with MegaUpload to the tune of hundreds of millions of dollars of profit. I wonder if the new site will reward users who have highly downloaded files like his last? Can you prove, or disprove, that the cryptography was intentional broken? Doubtful. Can you prove a website didn't try to prevent the mass sharing of copyrighted material? Yes. Is that illegal? Maybe. Should it be? That's whole 'nother can of worms.
  - chacham15 14y ago
    Dropbox doesnt have copyright checking last I checked. The way that they deal with the problem is by bandwidth limiting public urls. You would have the same effect with a video that you legally publish as with an infringing video.
  - belorn 14y ago
    Popularity is not proof of illegal activity. It seems implied that only restricted copyrighted information may bring high traffic, but that's not true. One of the highest traffic torrents I ever had, and which got the computer club network cut off from the university because it was "suspiciously uploading high amount of data" was in fact a linux live cd... It was also a highly effective way to test out the new server's hardware :).
    - forrestthewoods 14y ago
      Of course it's implied because > 99% of high traffic volume files on Mega are going to be copyrighted material. To suggest otherwise would be insane. Is high traffic proof of anything? Of course not. Is it reason to investigate? Absolutely, unless your stated mission is to cover your eyes singing "lalalalalala". Kim Dotcom has already made hundreds of millions of dollars off copyrighted material and he's trying to do it again. I'd say the fact that anyone supports his antics is bewildering but the power of selfishness knows no bounds.
      - deleted 14y ago
        [deleted]
      - belorn 14y ago
        Investigation takes time, effort and money. Its why the police is a group of people being paid to do that work. No one expect the police force to be made out of voluntaries. Why do then suddenly people expect system administrators to do police work for free? How common is it that people go to the local police station in an afternoon and offered to do some work with no expectation of some kind of salary? System administrators are not people that work for free. They expect to get paid like everyone else. They also expect to be able to decide what work they accept, and which ones they do not (ie, they are not slaves). Some do investigations for the police without getting any payment because they feel they want to perform some civil duty to do so, but the above comment imply that they must do so. That is wrong. System administrators should not be forced labor for the police. If there is investigation to do, call the police, pay your taxes (so the police get paid), and let the system work as intended without putting forced labor onto the system administrators of the world. If you dislike a service because its used by criminals (like say, gmail which is abused by spammers), it still the police you should call and not the system administrators.
kybernetikos 14y ago
What I got from this is that the code is intended to be set up so you don't have to trust the CDN, however due to an error in the way it's coded, it turns out you do have to trust the CDN. Given that CDNs are reasonably trustworthy in the absence of government intervention, I expect that Mega will fix this before there are any exploits. It's good work by fail0verflow, but as long as Mega addresses it soon, I don't think it's a big deal. In fact, it's a good test case for how seriously they take this kind of problem.

ChuckMcM 14y ago

This is what I think is the speculation. Let us speculate you wanted to build a "legitimate" Pirate Bay type system, what would you have to do in order to pass the 'sniff test' for litigators while providing an otherwise easy to use service? I am not in any way at all suggesting that Mega is doing this, or that they are even trying to do this. I am simply observing that there is an interesting case to be made where you can swear under oath you did you best to make the site secure, and yet people more sophisticated than you broke into it and had their way with you. How much liability does that protect you from? Any? All? I haven't got a clue here but I find the question an interesting one. Perhaps Eric Goldman will chime in.

forrestthewoods 14y ago
Stopping your digital locker online service from being used for mass copyright infringing material is easy. Go ahead and host a movie on dropbox and share a public link on a popular site. See how long it stays valid. A normal system admin might decide a single 4gb file accounting for tens of terabytes of traffic is unusual and investigate the cause. Odds are pretty decent you'll be able to find a source driving all the traffic. Kim Dotcom is going for the blind eye approach. Just close your eyes and cover your ears so it's not your fault. He did this with MegaUpload to the tune of hundreds of millions of dollars of profit. I wonder if the new site will reward users who have highly downloaded files like his last? Can you prove, or disprove, that the cryptography was intentional broken? Doubtful. Can you prove a website didn't try to prevent the mass sharing of copyrighted material? Yes. Is that illegal? Maybe. Should it be? That's whole 'nother can of worms.
- chacham15 14y ago
  Dropbox doesnt have copyright checking last I checked. The way that they deal with the problem is by bandwidth limiting public urls. You would have the same effect with a video that you legally publish as with an infringing video.
- belorn 14y ago
  Popularity is not proof of illegal activity. It seems implied that only restricted copyrighted information may bring high traffic, but that's not true. One of the highest traffic torrents I ever had, and which got the computer club network cut off from the university because it was "suspiciously uploading high amount of data" was in fact a linux live cd... It was also a highly effective way to test out the new server's hardware :).
  - forrestthewoods 14y ago
    Of course it's implied because > 99% of high traffic volume files on Mega are going to be copyrighted material. To suggest otherwise would be insane. Is high traffic proof of anything? Of course not. Is it reason to investigate? Absolutely, unless your stated mission is to cover your eyes singing "lalalalalala". Kim Dotcom has already made hundreds of millions of dollars off copyrighted material and he's trying to do it again. I'd say the fact that anyone supports his antics is bewildering but the power of selfishness knows no bounds.
    - deleted 14y ago
      [deleted]
    - belorn 14y ago
      Investigation takes time, effort and money. Its why the police is a group of people being paid to do that work. No one expect the police force to be made out of voluntaries. Why do then suddenly people expect system administrators to do police work for free? How common is it that people go to the local police station in an afternoon and offered to do some work with no expectation of some kind of salary? System administrators are not people that work for free. They expect to get paid like everyone else. They also expect to be able to decide what work they accept, and which ones they do not (ie, they are not slaves). Some do investigations for the police without getting any payment because they feel they want to perform some civil duty to do so, but the above comment imply that they must do so. That is wrong. System administrators should not be forced labor for the police. If there is investigation to do, call the police, pay your taxes (so the police get paid), and let the system work as intended without putting forced labor onto the system administrators of the world. If you dislike a service because its used by criminals (like say, gmail which is abused by spammers), it still the police you should call and not the system administrators.

kybernetikos 14y ago

What I got from this is that the code is intended to be set up so you don't have to trust the CDN, however due to an error in the way it's coded, it turns out you do have to trust the CDN. Given that CDNs are reasonably trustworthy in the absence of government intervention, I expect that Mega will fix this before there are any exploits. It's good work by fail0verflow, but as long as Mega addresses it soon, I don't think it's a big deal. In fact, it's a good test case for how seriously they take this kind of problem.