5 ms·

Kim Dotcom and those in the Mega posse know the encryption they are claiming is mega secure is in fact a mega lie. We all know it, but does it actually matter?

Kim Dotcom and those in the Mega posse know the encryption they are claiming is mega secure is in fact a mega lie. We all know it, but does it actually matter? The whole point of the encryption wasn't so you can upload files without fear of them being looked at by staff, it's to prevent Mega from being taken down by the US government again by claiming they truly can't see the file contents of their server. The encryption, it is a lie but at the end of the day it shouldn't detract from the fact that Mega is a decent cloud hosting platform with decent ideas. Compare Mega to offerings from Mediafire, Dropbox and insert other cloud file storage provider here and Mega is quite compelling considering the free 50gb of space you get.

bad_user 14y ago
Considering the 50GB you get is the reason why I won't touch them.
- DigitalSea 14y ago
  I would be curious to know why. Would you mind elaborating?
  - deleted 14y ago
    [deleted]
  - bad_user 14y ago
    I don't think it's a sustainable business, that's why, unless users will get fucked in the long run, one way or the other. Startups these days and even bigger companies like Google, got into the habit of creating something and giving it away for free or for cheap, then when it gets popular they either raise their prices, pull the plug or sell your data, fucking the same users that made them popular in the process and frankly I'm tired of that. Right now I'm a Dropbox paying customer and decided against GDrive for instance, even though GDrive is cheaper and even though I was and am already a heavy Google Apps user. I went with Dropbox because they value me enough to provide a Linux client and I simply don't trust Google's pricing anymore, considering their recent history. So even though I do use free services right now, for new services and products if it ain't open-source, if it isn't backed by a non-profit and if it doesn't have a decent price tag, then I'm not touching it.
    - nathan_f77 14y ago
      What are your thoughts on Amazon S3, since you're basically their customer by proxy?
ma2rten 14y ago
I don't think it is fair to dismiss it as a "mega lie". I am actually surprised, how thought out the encryption scheme is. The first version might have flaws, but at least they thought about the case that the CDN might be compromised and implemented a quite clever (but flawed) work-around. Most banks don't put such an effort into security of their website. Time will show if they fix this flaw, or not.
- DigitalSea 14y ago
  Maybe not a lie in the sense of the word, but it's obvious looking at their crypto algorithm that at present it is a gimmicky feature. The lack of a strong encryption scheme doesn't degrade the service in my opinion and it's more of a feature to protect Mega and not its users like they are portraying it to be. Given the massive amount of backlash and scrutiny from experts and non-experts alike, Kim always seems to win in the end and I am sure they're already planning on hiring a cryptography master to help them write something more serious as we speak.
  - Havoc 14y ago
    > at present it is a gimmicky feature Its also labelled beta.
Geee 14y ago
They have an API where you can write your own client, if you don't want to use the JS client. This doesn't solve every security problem, but at least this one. I think that they have really tried to make it secure, but they aren't just competent enough. Browser-crypto is always somewhat insecure especially when they actually store your keys and you have to trust them.

bad_user 14y ago

Considering the 50GB you get is the reason why I won't touch them.

DigitalSea 14y ago
I would be curious to know why. Would you mind elaborating?
- deleted 14y ago
  [deleted]
- bad_user 14y ago
  I don't think it's a sustainable business, that's why, unless users will get fucked in the long run, one way or the other. Startups these days and even bigger companies like Google, got into the habit of creating something and giving it away for free or for cheap, then when it gets popular they either raise their prices, pull the plug or sell your data, fucking the same users that made them popular in the process and frankly I'm tired of that. Right now I'm a Dropbox paying customer and decided against GDrive for instance, even though GDrive is cheaper and even though I was and am already a heavy Google Apps user. I went with Dropbox because they value me enough to provide a Linux client and I simply don't trust Google's pricing anymore, considering their recent history. So even though I do use free services right now, for new services and products if it ain't open-source, if it isn't backed by a non-profit and if it doesn't have a decent price tag, then I'm not touching it.
  - nathan_f77 14y ago
    What are your thoughts on Amazon S3, since you're basically their customer by proxy?

ma2rten 14y ago

I don't think it is fair to dismiss it as a "mega lie". I am actually surprised, how thought out the encryption scheme is. The first version might have flaws, but at least they thought about the case that the CDN might be compromised and implemented a quite clever (but flawed) work-around. Most banks don't put such an effort into security of their website. Time will show if they fix this flaw, or not.

DigitalSea 14y ago
Maybe not a lie in the sense of the word, but it's obvious looking at their crypto algorithm that at present it is a gimmicky feature. The lack of a strong encryption scheme doesn't degrade the service in my opinion and it's more of a feature to protect Mega and not its users like they are portraying it to be. Given the massive amount of backlash and scrutiny from experts and non-experts alike, Kim always seems to win in the end and I am sure they're already planning on hiring a cryptography master to help them write something more serious as we speak.
- Havoc 14y ago
  > at present it is a gimmicky feature Its also labelled beta.

Geee 14y ago

They have an API where you can write your own client, if you don't want to use the JS client. This doesn't solve every security problem, but at least this one. I think that they have really tried to make it secure, but they aren't just competent enough. Browser-crypto is always somewhat insecure especially when they actually store your keys and you have to trust them.