Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mega has launched

mega.co.nz

Post reply on HN
Print view View original

61–70 of 272 posts

Re: Mega has launched

#61

Post by gjulianm »

dexter313 wrote: post #55
gjulianm wrote: post #48

I just found a weird things on they ToS [1] ... 8. Our service may automatically delete a piece of data you upload or give someone else access to where it determines that that data is an exact duplicate of original data already on our service. In that case, you will access that original data. Duplicate check, I get that. But, how do they do it? They say the files are encrypted on the browser, so if I upload file X an…

The user's javascript that encrypted the file can also make a hash send it to mega, and then they check if they already have that. EDIT: They never get to see your key or what is in the file.

Ok, so I try to upload a.exe to Mega. They make a hash, detect someone has already uploaded it. They don't upload my file, and instead they place a link in my account to that "a.exe" of some other user. How can I access it then? Because it's encrypted with a key which is not mine.

Re: Mega has launched

#62

Post by jiggy2011 »

gjulianm wrote: post #48

I just found a weird things on they ToS [1] ... 8. Our service may automatically delete a piece of data you upload or give someone else access to where it determines that that data is an exact duplicate of original data already on our service. In that case, you will access that original data. Duplicate check, I get that. But, how do they do it? They say the files are encrypted on the browser, so if I upload file X an…

Possibly convergent encryption, basically when you encrypt the file you use a hash of the file as the key. This key can then be encrypted with several different passwords meaning that several people can decrypt this file.

Re: Mega has launched

#63

Post by TruthElixirX »

Alphasite_ wrote: post #37

How exactly does this work, if they don't have access to the original? > 8. Our service may automatically delete a piece of data you upload or give someone else access to where it determines that that data is an exact duplicate of original data already on our service. In that case, you will access that original data.

I don't think it does. I think that is just there for legal reasons.

Re: Mega has launched

#64

Post by tommoor »

gjulianm wrote: post #48

I just found a weird things on they ToS [1] ... 8. Our service may automatically delete a piece of data you upload or give someone else access to where it determines that that data is an exact duplicate of original data already on our service. In that case, you will access that original data. Duplicate check, I get that. But, how do they do it? They say the files are encrypted on the browser, so if I upload file X an…

Got to wonder if this is a bit of copy and paste from the old terms, although you would think they would have checked this quite thoroughly! Good spot.

Re: Mega has launched

#65

Post by kps »

alexqgb wrote: post #13

The clean interface makes the tagline (lifted from Daft Punk w/o credit) that much more conspicuous. Clearly, some things haven't changed.

I assume they paid six million dollars for it.

Re: Mega has launched

#66

Post by ollysb »

archgrove wrote: post #47
frewsxcv wrote: post #27

Earlier quoted context omitted.

Well, why do you use Safari?

I use it because it supports proper continuous zooming with pinch-to-zoom on a trackpad (exactly like Safari on iOS devices). Chrome does a weird step-by-step increment that seems to involve re-laying out the page at each step. The multi-touch interaction with Safari is just better in general, IMO.

I hadn't noticed that, it's pretty slick actually, if you keep pinching it also zooms out to show you all of the tabs you have open.

Re: Mega has launched

#67

Post by jiggy2011 »

gjulianm wrote: post #61
dexter313 wrote: post #55

Earlier quoted context omitted.

The user's javascript that encrypted the file can also make a hash send it to mega, and then they check if they already have that. EDIT: They never get to see your key or what is in the file.

Ok, so I try to upload a.exe to Mega. They make a hash, detect someone has already uploaded it. They don't upload my file, and instead they place a link in my account to that "a.exe" of some other user. How can I access it then? Because it's encrypted with a key which is not mine.

The hashing is done by the client before upload. So if all clients use the same hash algo they will generate the same hash for the same file. So it is encrypted with a key that you know because you have the original file.

Re: Mega has launched

#68

Post by beala »

dabeeeenster wrote: post #53
beala wrote: post #49

Earlier quoted context omitted.

According to the help page, no keys (except the public key) ever leave the client [1]. [1] https://mega.co.nz/#help_security EDIT: The senario in the posts above sound more likely. The exact text of the help is "No usable encryption keys ever leave the client computers (with the exception of RSA public keys)." So they probably store an encrypted version of the keys server side.

In that case if I log in with a different browser, how do I access my stuff? How do other people access my stuff? Doesn't work...

According to Ars, the public sharing works by bundling the encryption key with the link to the data [1]. I don't have reliable access to the site, so I don't want to speculate too much, but I suppose there must be a way to export your keys so you can view your files from different computers.

I agree with the sentiment, though, that this is security theater. It's subject to the same problem as Hushmail, where they could be forced to snoop on their customers by modifying client code.

[1] http://arstechnica.com/business/2013/01/mega-arrives-ars-goe...

Re: Mega has launched

#70

Post by gee_totes »

zalew wrote: post #57

"Warning: You are using an outdated browser, which adversely affects your file transfer performance. Please upgrade to Google Chrome." is this a joke? I'm on FF19

Really? I'm on FF3 and I didn't get a notice, which was quite surprising.

File upload didn't work though....

Post reply on HN