Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MEGAChat now includes end-to-end encryption

mega.nz

Post reply on HN
Print view View original

1–10 of 98 posts

Re: MEGAChat now includes end-to-end encryption

#4

Post by jpgvm »

It sounds reasonable? If anything this highlights the problem with all the new encrypted communications options, even highly technical people can't really know how good it is from a cursory look. Just because it says end to end encryption and uses some nice ciphers it doesn't mean the implementation is not critically flawed.

I use Signal right now (from Moxie Marlinspike/Whisper Systems) and would only really consider alternatives if they were endorsed by other cryptographers I know because I really just don't have a strong enough grasp of how all the machinery interacts.

Re: MEGAChat now includes end-to-end encryption

#7

Post by jimktrains2 »

vortico wrote: post #6
iofj wrote: post #2

Powered by code that you download every time you use it, and that therefore can leak your keys and conversations at any time, just as centralized chat can.

Hopefully you can download the web client. The mobile apps do not have this problem.

But mobile apps can still wrap web views. Also, if you can't inspect the source, you can't even be reasonably certain keys are handled properly.

Re: MEGAChat now includes end-to-end encryption

#8

Post by treenyc »

jpgvm wrote: post #4

It sounds reasonable? If anything this highlights the problem with all the new encrypted communications options, even highly technical people can't really know how good it is from a cursory look. Just because it says end to end encryption and uses some nice ciphers it doesn't mean the implementation is not critically flawed. I use Signal right now (from Moxie Marlinspike/Whisper Systems) and would only really conside…

It is great that Whisper Systems/Signal implement cryptography properly.

However, the NEWER versions of Signal requires access to your contact to work.

For many users that is a show stopper.

Implement a way for user to search by User ID and allow user to find each other by ID in addition to phone number.

Re: MEGAChat now includes end-to-end encryption

#9

Post by jimktrains2 »

jpgvm wrote: post #4

It sounds reasonable? If anything this highlights the problem with all the new encrypted communications options, even highly technical people can't really know how good it is from a cursory look. Just because it says end to end encryption and uses some nice ciphers it doesn't mean the implementation is not critically flawed. I use Signal right now (from Moxie Marlinspike/Whisper Systems) and would only really conside…

While you can't know without looking at the code, my first-pass test is asking how keys are handled and if the code handling those keys is coming from an untrusted source (in this case the server as JS)(for the sake of this discussion I will admit I implicitly trust Debian and the gpg folks).

If there isn't a good answer to key management, or my key is handled by JS, then it's a no-go for me.

If there is a half-way decent answer to key management, I ask what the threat vectors the system was designed for are. If a broad political statement is made, then I walk away.

While it doesn't actually vet the technical merit of the code, I feel it catches a lot of funniness.

Re: MEGAChat now includes end-to-end encryption

#10

Post by runn1ng »

mtgx wrote: post #3

Didn't Kim Dotcom say you can't trust Mega anymore? http://www.wired.co.uk/news/archive/2015-07/31/kim-dotcom-me...

I frankly never trusted Mega in the first place. Their claims were always grandiose and absurd and their business model (back as Megaupload) was always a bit sketchy.

When I want secure chat, I use Signal from WhisperSystems. Yeah it has usability issues, but it's obvious it's hard to do really secure and secret chat.

Post reply on HN