5 ms·

> "Unlike its predecessor, Dotcom's new site Mega offers secure encryption, which he says protects each user's identity and data." I haven't kept up with Mega

by john_b 13y ago

> "Unlike its predecessor, Dotcom's new site Mega offers secure encryption, which he says protects each user's identity and data." I haven't kept up with Mega much lately, but does anyone know if the security issues identified after the Mega launch were ever fixed (see e.g. http://fail0verflow.com/blog/2013/megafail.html http://fail0verflow.com/blog/2013/megafail.html)? It seemed like the Mega launch was rushed to take advantage of the free publicity they were getting, but I would expect that they've had enough time to get their house in order by now.

oib 13y ago
At the end of the post: Update (2013-01-24): Mega has now switched to using SHA-256. They get points for fixing it quickly, but I wonder what other subtle or not-so-subtle security problems remain.
pearjuice 13y ago
It wouldn't matter. You have no insight in whether Dotcom stores the keys to decrypt the data somewhere. Unless the entire mega fad is open sourced and we can verify the code in the repos runs on their webservers, you cannot justify using Dotcom his bussiness knowing what he has done in the past to obtain financial gain over the backs of others.
- Dylan16807 13y ago
  It encrypts in the browser, you can check the source code just fine.
  - pyre 13y ago
    The issue with browser-based encryption, is that you would have to check the source code every time that it's served to you.
    - nawitus 13y ago
      Many sites (like blockchain.info) offer a browser extension which does the checking for you every time automatically. Mega also has a browser extension which does downloading, but I'm unsure if it does checking.
    - shawabawa3 13y ago
      They could release an api that let you upload with your own client (maybe they have already?) edit: Apparently there is an API, problem solved.
    - jlarocco 13y ago
      Not really. You can verify it once and generate a secure hash from it. Then the second time you could just check the hash. It wouldn't be too difficult to write a browser extension that did it automatically, or a javascript bookmarklet for it.
      - schmrz 13y ago
        But then you have to generate the hash each time the source code changes. And you also have to verify the source code each time yourself because you can't know if it's a regular update from mega (they probably update daily or weekly) or if someone compromised the source code.
        mahyarm 13y ago
        You can solve it with something like this: http://perspectives-project.org/ http://perspectives-project.org/
        Dylan16807 13y ago
        That sounds like normal software to me. Nobody is forcing you to update unless the ABI changes. And you can start a mailing list that talks about updates if you like.
    - gizmo686 13y ago
      Not really. If enough people audit the code at random times, then the host would not be able to get away with serving malicious code for very long.
Dylan16807 13y ago
In addition to oib pointing out that it was fixed same-day, that security flaw wasn't a big deal in the first place, only relevant if the CDN was compromised.

by john_b 13y ago

oib 13y ago

At the end of the post: Update (2013-01-24): Mega has now switched to using SHA-256. They get points for fixing it quickly, but I wonder what other subtle or not-so-subtle security problems remain.

pearjuice 13y ago

It wouldn't matter. You have no insight in whether Dotcom stores the keys to decrypt the data somewhere. Unless the entire mega fad is open sourced and we can verify the code in the repos runs on their webservers, you cannot justify using Dotcom his bussiness knowing what he has done in the past to obtain financial gain over the backs of others.

Dylan16807 13y ago
It encrypts in the browser, you can check the source code just fine.
- pyre 13y ago
  The issue with browser-based encryption, is that you would have to check the source code every time that it's served to you.
  - nawitus 13y ago
    Many sites (like blockchain.info) offer a browser extension which does the checking for you every time automatically. Mega also has a browser extension which does downloading, but I'm unsure if it does checking.
  - shawabawa3 13y ago
    They could release an api that let you upload with your own client (maybe they have already?) edit: Apparently there is an API, problem solved.
  - jlarocco 13y ago
    Not really. You can verify it once and generate a secure hash from it. Then the second time you could just check the hash. It wouldn't be too difficult to write a browser extension that did it automatically, or a javascript bookmarklet for it.
    - schmrz 13y ago
      But then you have to generate the hash each time the source code changes. And you also have to verify the source code each time yourself because you can't know if it's a regular update from mega (they probably update daily or weekly) or if someone compromised the source code.
      - mahyarm 13y ago
        You can solve it with something like this: http://perspectives-project.org/ http://perspectives-project.org/
      - Dylan16807 13y ago
        That sounds like normal software to me. Nobody is forcing you to update unless the ABI changes. And you can start a mailing list that talks about updates if you like.
  - gizmo686 13y ago
    Not really. If enough people audit the code at random times, then the host would not be able to get away with serving malicious code for very long.

Dylan16807 13y ago

In addition to oib pointing out that it was fixed same-day, that security flaw wasn't a big deal in the first place, only relevant if the CDN was compromised.