3 ms·

They don't say exactly that. They claim to be able to read your files. The difference between their claims and the actual system after this flaw is this: CDN

by muyuu 14y ago

They don't say exactly that. They claim to be able to read your files. The difference between their claims and the actual system after this flaw is this: CDNs can also potentially read your files if they are malicious and actively try (which would be a breach of their contract I assume). Doesn't change a thing for me to be honest. I don't trust Mega and all their employees, or whoever breaks into their facilities, to have my bank accounts logins and passwords in plain text. I trust them to keep my kindle purchased books with me not being liable of being "broadcasting them" as they are reasonably protecting them. Obviously it's a flaw and they should fix it. But it's not a doom and gloom, "their whole system is a farce" kind of flaw.

DanBC 14y ago
> They don't say exactly that. In big red capitals on their front page they say "THE PRIVACY COMPANY". I couldn't find anything in the 46 point TOS that said explicitly that they can read your files. On their about page they say "Unlike most of our competitors, we use a state of the art browser based encryption technology where you, not us, control the keys." - that doesn't make it sound like they're telling you they can access your files. On their "The Privacy Company" page they quote from the universal declaration of human rights,and they say "All files stored on MEGA are encrypted. All data transfers from and to MEGA are encrypted. And while most cloud storage providers can and do claim the same, MEGA is different – unlike the industry norm where the cloud storage provider holds the decryption key, with MEGA, you control the encryption, you hold the keys, and you decide who you grant or deny access to your files, without requiring any risky software installs. It’s all happening in your web browser!" - that doesn't sound like they're telling you that they can read your files. On their help centre page they say "Because the server can't see filenames, filename collisions have to be dealt with on the client side. With standard settings, if you upload a file that you already seem to have in your account (same target path/filename, same size, same last modification time), it is skipped, but nothing prevents you from keeping multiple files or folders with the same name in the same folder." - which doesn't sound like they're saying they can read your files. They also say "Because our end-to-end encryption model inherently precludes any server-side manipulation of your data, which would be required to implement such a feature." - which also doesn't sound like they're saying they can read your data. But now we find out that not only can they read your files but a CDN could read your files. Since we know that companies must comply with correctly formed legal requests anything that extends the number of companies that can read the files increases the number of companies that can be leaned on by well funded groups. > Obviously it's a flaw and they should fix it. But it's not a doom and gloom, "their whole system is a farce" kind of flaw. Their whole system is cloud storage with encryption - without encryption it's just cloud storage and there's a bunch of other people offering that. Those other providers have the advantage of not having been previously raided by paramilitary police from an aggressive government. Crypto is hard. It's easy to go wrong. I have no idea what kind of research they did before launching, but to have broken crypto a few days after launch is not a good sign.
- muyuu 14y ago
  That's a slogan and it can be interpreted in many ways. If you buy into slogans as tech feature listings. They store with encryption. That remains true. The fact that CDNs can potentially break into it doesn't mean that they store without encryption. Let's not exaggerate the scope of this flaw. A flaw that in any case is going to be fixed soon. Crypto is hard, true. But this system is fixable on the server, so it's not as critical as a hardware system that may need to be recalled. Don't worry, and remember that in any case THEY WILL STILL BE ABLE TO READ YOUR FILES. They are possibly not emphasizing this enough. If you have truly sensitive data don't put it there as-is.

by muyuu 14y ago

DanBC 14y ago

> They don't say exactly that. In big red capitals on their front page they say "THE PRIVACY COMPANY". I couldn't find anything in the 46 point TOS that said explicitly that they can read your files. On their about page they say "Unlike most of our competitors, we use a state of the art browser based encryption technology where you, not us, control the keys." - that doesn't make it sound like they're telling you they can access your files. On their "The Privacy Company" page they quote from the universal declaration of human rights,and they say "All files stored on MEGA are encrypted. All data transfers from and to MEGA are encrypted. And while most cloud storage providers can and do claim the same, MEGA is different – unlike the industry norm where the cloud storage provider holds the decryption key, with MEGA, you control the encryption, you hold the keys, and you decide who you grant or deny access to your files, without requiring any risky software installs. It’s all happening in your web browser!" - that doesn't sound like they're telling you that they can read your files. On their help centre page they say "Because the server can't see filenames, filename collisions have to be dealt with on the client side. With standard settings, if you upload a file that you already seem to have in your account (same target path/filename, same size, same last modification time), it is skipped, but nothing prevents you from keeping multiple files or folders with the same name in the same folder." - which doesn't sound like they're saying they can read your files. They also say "Because our end-to-end encryption model inherently precludes any server-side manipulation of your data, which would be required to implement such a feature." - which also doesn't sound like they're saying they can read your data. But now we find out that not only can they read your files but a CDN could read your files. Since we know that companies must comply with correctly formed legal requests anything that extends the number of companies that can read the files increases the number of companies that can be leaned on by well funded groups. > Obviously it's a flaw and they should fix it. But it's not a doom and gloom, "their whole system is a farce" kind of flaw. Their whole system is cloud storage with encryption - without encryption it's just cloud storage and there's a bunch of other people offering that. Those other providers have the advantage of not having been previously raided by paramilitary police from an aggressive government. Crypto is hard. It's easy to go wrong. I have no idea what kind of research they did before launching, but to have broken crypto a few days after launch is not a good sign.

muyuu 14y ago
That's a slogan and it can be interpreted in many ways. If you buy into slogans as tech feature listings. They store with encryption. That remains true. The fact that CDNs can potentially break into it doesn't mean that they store without encryption. Let's not exaggerate the scope of this flaw. A flaw that in any case is going to be fixed soon. Crypto is hard, true. But this system is fixable on the server, so it's not as critical as a hardware system that may need to be recalled. Don't worry, and remember that in any case THEY WILL STILL BE ABLE TO READ YOUR FILES. They are possibly not emphasizing this enough. If you have truly sensitive data don't put it there as-is.