Live data from Hacker News

Mega has launched

mega.co.nz

121–130 of 272 posts

Re: Mega has launched

#121

I just found a weird things on they ToS [1] ... 8. Our service may automatically delete a piece of data you upload or give someone else access to where it determines that that data is an exact duplicate of original data already on our service. In that case, you will access that original data. Duplicate check, I get that. But, how do they do it? They say the files are encrypted on the browser, so if I upload file X an…

Perhaps they de-duplicate using smaller block sizes? Something like 256 bytes.

Also, if you believe Microsoft Outlook, there's something called "compressible encryption", which implies there are encryption schemes that aren't exactly random, meaning in turn that not all N-bit blocks are equally likely.

Re: Mega has launched

#122

Earlier quoted context omitted.

Well, why do you use Safari?

I use Safari because in my experience Chrome is rather buggy on a Mac. Particularly with regard to Spaces. E.g., if I move a Chrome window to a different Space, all of my other Chrome windows will tag along for the ride. It makes using Chrome rather unbearable. Additionally, Safari's interface for managing bookmarks is much nicer.

Hrm, I use Spaces and Chrome with no problems. This isn't the case for everyone.

Re: Mega has launched

#123

I just found a weird things on they ToS [1] ... 8. Our service may automatically delete a piece of data you upload or give someone else access to where it determines that that data is an exact duplicate of original data already on our service. In that case, you will access that original data. Duplicate check, I get that. But, how do they do it? They say the files are encrypted on the browser, so if I upload file X an…

Possibly convergent encryption, basically when you encrypt the file you use a hash of the file as the key. This key can then be encrypted with several different passwords meaning that several people can decrypt this file.

This means that if there's a commonly available plaintext version of a file, then you can encrypt it, compute the hash of the encrypted version and then serve it to Mega along with a DMCA takedown notice.

They wouldn't really want that, would they? So as clever as it is, I doubt they do it this way.

Re: Mega has launched

#124
post #58

Earlier quoted context omitted.

Separate from the realm of rights, witholding credit is a dick move. I mean, the guy can afford a dozen cars and a helicopter, but he won't hire a decent copywriter? Fucker.

Everyone knows that it's Daft Punk. Credit isn't needed. What do you want? "Bigger. Better. Faster. Stronger. Safer. Thanks Daft Punk for all the music!" Daft Punk sold out by their second album anyway, they're hardly underground geniuses in want of credit now. Nonetheless, I think it's just more grandiosity and find it irritating that he riffed on the chorus at all.

What do I want? For him to be thrown in jail. I honestly don't care about people swapping media between themselves. But setting up an exchange to do that, and paying for it by selling space to advertisers? That's not "sharing". That's business. And that business would collapse if he had to pay the copyright holders he depends on.

In general, audiences have NO idea how much time, effort, etc. it takes to produce decent work. Partly, that's by design, since good work should look effortless. But when you count the time getting good, a decent album may represent a decade of someone's life (10,000 hours, etc.) And the thousands of names in the credits of major films represent actual work, by real people. There's no reason these people should be expected to "find a business model" that doesn't rely on some form of legal protection when protection is the backstop of every viable business model in existence (not always legal, in the case of drug cartels; and where there's no protection at all, what you're really talking about is good luck and charity).

That said, I think enforcing copyright at the individual level is a fool's errand. No one writing the law - which evolved over centuries - ever imagined that it would be applicable on such a global scale, in such a granular way. Barring radical change in the law, I think individuals should be exempt from prosecution under something that is so spectacularly unsuited to free individuals and the democracy that depends on their liberty.

But corporations are another story. They're tools, not people, and tools have no rights. Shareholders have rights, employees have rights, citizens whose governments issue corporate charters have rights. But corporations themselves? No rights whatsoever. There's no threat to democracy in making them secure permission - by paying for it on fairly negotiated terms - or getting sued into oblivion. Indeed, that's the exact expectation around which the law and industries that pay for copyrights both developed. The Internet's appearance doesn't change the premise that anyone building a business around material they didn't produce, should include the properly negotiated price of their inputs in the prices they charge to others. Obviously, that's my own standard. It's not reflected in law. But I think it's a fair break. If it were reflected in law, I think we could put the copyright wars behind us for the foreseeable future.

As far as Kim Dotcom goes, it's clear he made his money on the wrong side of this line. That's why I'd like to see him jailed under law which should make jailing him a no brainer. I have no idea how he's going to pay for his current venture, but I'm pretty sure he says "safer" not "safe" for good reason. You'd have to be an idiot to give Mega the same level of trust that Dropbox enjoys.

Re: Mega has launched

#125
post #13

The clean interface makes the tagline (lifted from Daft Punk w/o credit) that much more conspicuous. Clearly, some things haven't changed.

The Olympic motto, which is virtually identical, pre-dates Daft Punk.

You know, you could've just told us instead of making us look it up :)

>The Olympic motto is "Citius, Altius, Fortius." These three Latin words mean "Swifter, Higher, Stronger."

Re: Mega has launched

#126
post #58

Earlier quoted context omitted.

Separate from the realm of rights, witholding credit is a dick move. I mean, the guy can afford a dozen cars and a helicopter, but he won't hire a decent copywriter? Fucker.

Everyone knows that it's Daft Punk. Credit isn't needed. What do you want? "Bigger. Better. Faster. Stronger. Safer. Thanks Daft Punk for all the music!" Daft Punk sold out by their second album anyway, they're hardly underground geniuses in want of credit now. Nonetheless, I think it's just more grandiosity and find it irritating that he riffed on the chorus at all.

[deleted]

Re: Mega has launched

#127

I just found a weird things on they ToS [1] ... 8. Our service may automatically delete a piece of data you upload or give someone else access to where it determines that that data is an exact duplicate of original data already on our service. In that case, you will access that original data. Duplicate check, I get that. But, how do they do it? They say the files are encrypted on the browser, so if I upload file X an…

"Each file and each folder node uses its own randomly generated 128 bit key. File nodes use the same key for the attribute block and the file data, plus a 64 bit random counter start value and a 64 bit meta MAC to verify the file's integrity." Not sure I understand this, how can you deduplicate if every file is encrypted via a random key?

Maybe on file upload, they encrypt it with the file hash then chunk those encrypted files and store those with dedup.

Then, on the user side, they store an per-user encrypted index (random, counter, MAC) to those individual chunks to represent the file.

That way, they can only see giant encrypted blocks of data, and per-user encrypted indexes to data. But it is all encrypted.

They would need to hack into accounts by keylogging passwords to decrypt the indexes and see what files users can actually access.

Public links could be shared by giving out a key in the URL that is a file containing indexes to other blocks. So whoever knows the URL, knows the index, and can get the data.

That is the way I'd design it, at least... :)

edit:typo

Re: Mega has launched

#128
post #103
post #84

Earlier quoted context omitted.

| Each user account uses a symmetric master key to ECB- | encrypt all keys of the nodes it keeps in its own trees. | This master key is stored on MEGA's servers, encrypted | with a hash derived from the user's login password. The key is stored encrypted on their servers, but is unlocked with your password. Technically they could capture your password and unlock the key, gaining access to the files.

MEGA servers store the hash of the password, not the password itself. Unlocking a key requires a real password but the server knows only the hashed version. This way they can't capture the real password to unlock. The trick would be to make sure server always gets only the hashed password. Even at website login, the password must be hashed before sending! We used similar crypto for http://timegt.com product where eve…

As long as the logins go via normal web page hashing the passwords before sending them does not really add that much security. If the security of the server is somehow compromised, it would be trivial to put up new Javascripts that send the cleartext password to server. Users are not likely to go through the Javascript to check what it is actually doing.

Re: Mega has launched

#129
post #127

Earlier quoted context omitted.

"Each file and each folder node uses its own randomly generated 128 bit key. File nodes use the same key for the attribute block and the file data, plus a 64 bit random counter start value and a 64 bit meta MAC to verify the file's integrity." Not sure I understand this, how can you deduplicate if every file is encrypted via a random key?

Maybe on file upload, they encrypt it with the file hash then chunk those encrypted files and store those with dedup. Then, on the user side, they store an per-user encrypted index (random, counter, MAC) to those individual chunks to represent the file. That way, they can only see giant encrypted blocks of data, and per-user encrypted indexes to data. But it is all encrypted. They would need to hack into accounts by…

Not sure, it doesn't seem to say anything about encrypting with the file hash and implies that metadata and actual data use the same key.
Post reply on HN