registered. confirmed. nothing after that.
Mega has launched
81–90 of 272 posts
Re: Mega has launched
#82How exactly does this work, if they don't have access to the original? > 8. Our service may automatically delete a piece of data you upload or give someone else access to where it determines that that data is an exact duplicate of original data already on our service. In that case, you will access that original data.
They take a hash of every X MB of your data before upload. If the hash already exists, then they don't upload it. You just get added to the access list for that particular chunk along with the others who have uploaded it.
Re: Mega has launched
#83I just found a weird things on they ToS [1] ... 8. Our service may automatically delete a piece of data you upload or give someone else access to where it determines that that data is an exact duplicate of original data already on our service. In that case, you will access that original data. Duplicate check, I get that. But, how do they do it? They say the files are encrypted on the browser, so if I upload file X an…
"A node token ("magic cookie") grants access to a subtree of the issuing user's filesystem. An associated symmetric key is required to decrypt and/or store decryptable data."
https://mega.co.nz/#developers
Apparently, they use unsalted symmetric key encryption which allows them to discover [hash(file), password] duplicates. By comparison, the old Megaupload would apparently deduplicate based on [hash(file)] matches.
Suppose Alice and Bob have files [D, E, F] and [F, G, H], respectively. If MEGA discovers that Alice and Bob share a duplicate file F and Alice to reveals her password (through password frequency analysis or to the Government), then all of Bob's files are compromised.
I would personally feel unsafe storing private documents on Mega due to the lack of public/private key encryption, but that's me.
Re: Mega has launched
#84Does anyone understand how their implementation of client-side encryption is actually supposed to make my data safer? After logging in for the first time, a 2048-bit RSA key pair was generated, but it seems that every time I log in I just use a username (email) and password. Does that mean the RSA private key is stored on MEGA's servers? If so, doesn't that render the whole "client side encryption" bit moot? If MEGA…
| Each user account uses a symmetric master key to ECB-
| encrypt all keys of the nodes it keeps in its own trees.
| This master key is stored on MEGA's servers, encrypted
| with a hash derived from the user's login password.
Re: Mega has launched
#85"Warning: You are using an outdated browser, which adversely affects your file transfer performance. Please upgrade to Google Chrome." is this a joke? I'm on FF19
Really? I'm on FF3 and I didn't get a notice, which was quite surprising. File upload didn't work though....
wow, that's even weirder.
btw thanks for the downvote, whoever that was.
Re: Mega has launched
#86How much storage does the free version allow is my question... Couldn't find it any where
Re: Mega has launched
#87Earlier quoted context omitted.
He's claiming 100K registered users in less than one hour. That's nothing?
100k users just confirm the fuss. Another question is if there is any real value to this service.
Apparently some 100 million users found his previous file sharing service to be of some value, until it was shutdown that is. What's difficult to see, however, is what value your pointless dig brings to this discussion.
Re: Mega has launched
#88Earlier quoted context omitted.
The hashing is done by the client before upload. So if all clients use the same hash algo they will generate the same hash for the same file. So it is encrypted with a key that you know because you have the original file.
Deriving the key from the plaintext + the ciphertext is called a known-plaintext attack [1]. AES isn't vulnerable to this. [1] http://en.wikipedia.org/wiki/Known-plaintext_attack#Present_...
It is if you know that the key is derived directly and deterministically from the plaintext itself.
Of course this will only give you the key to that one particular file, not any other files that you do not have yourself.
Re: Mega has launched
#89To everyone asking about the encryption, it isn't really about protecting your data its about protecting themselves. They have created a service that is billed as a drop box competitor but it's not. This is megaupload2, they just need it to not look like they are marketing it as that.
They needed a way to deny any knolage of file sharing and have found a two pronged attack. The encryption means they can deny any knowledge of what they are serving, and marketing it as a drop box type tool means that they aren't marketing it as a blatant tool for illegal file sharing.
Re: Mega has launched
#90After signing up, MEGA suggested that I download Google Chrome to use the service (I was using Safari). I was expecting some affiliate link there, but there wasn't any.
On visiting a download link in Firefox (latest) posted in this thread (https://mega.co.nz/#!jFlzGQiZ!CL2dMi5IAYLUp3ZQ5JS7nmW0sYtudf...) I got the same message - however I can't click anywhere to hide the modal. If you are gonna have such a message at least let me close it!