Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mega has launched

mega.co.nz

Post reply on HN
Print view View original

191–200 of 272 posts

Re: Mega has launched

#191

Post by freshhawk »

jpalomaki wrote: post #128
AhtiK wrote: post #103

Earlier quoted context omitted.

MEGA servers store the hash of the password, not the password itself. Unlocking a key requires a real password but the server knows only the hashed version. This way they can't capture the real password to unlock. The trick would be to make sure server always gets only the hashed password. Even at website login, the password must be hashed before sending! We used similar crypto for http://timegt.com product where eve…

As long as the logins go via normal web page hashing the passwords before sending them does not really add that much security. If the security of the server is somehow compromised, it would be trivial to put up new Javascripts that send the cleartext password to server. Users are not likely to go through the Javascript to check what it is actually doing.

This is how similar services have responded to warrants. They voluntarily alter javascript for some ip addresses in order to capture passwords to use for decryption of the user's files.

It would probably be easy to write your own login page or a browser toolbar that would either do the hashing on a page you control or check that the javascript was what it should be.

At that level of distrust however you might as well encrypt the stuff yourself (and send the decryption keys to the people you want to share with in some other, more annoying but secure, way)

Re: Mega has launched

#192

Post by orionblastar »

SSL Poor error, cannot connect to server.

Is it down, or is my ISP blocking the SSL certificates so I cannot use it?

I am using Google Chrome.

I assume the site was DDOS'ed or failed under heavy bandwidth.

Re: Mega has launched

#193

Post by freshhawk »

georgeorwell wrote: post #105

I see Kim Dotcom as a stereotypical gangster who makes money by delivering illegal products. He has the narcissistic personality and lifestyle trappings to go with it. He even wants to buy protection from New Zealand itself by bringing free fibre optic cable to the island! It's just hard for me to respect the man, because he's not fighting for information freedom, he's fighting for as much cash, status, and power as…

Don't have to respect him (I would have a lot of questions for someone who did) to mostly take his side in the whole mega upload situation.

Re: Mega has launched

#194

Post by doublec »

zalew wrote: post #57

"Warning: You are using an outdated browser, which adversely affects your file transfer performance. Please upgrade to Google Chrome." is this a joke? I'm on FF19

Mega uses features from a draft W3C spec called "file-system-api": http://www.w3.org/TR/file-system-api/

Chrome supports this, Firefox does not. See my comments in the Mozilla bugzilla bug about this:

https://bugzilla.mozilla.org/show_bug.cgi?id=704128#c22

Re: Mega has launched

#195

Post by rplnt »

guessWhy wrote: post #182
rplnt wrote: post #144

Horrible site. Ignoring the fact it doesn't work in older versions of Opera, it's like early 00's and full-flash sites all over again.

It looks fine to me ?! Flash is not used at all and the design shows some taste.

It's not "not nice", I like the design. What I didn't like was the loading and that reminded me the era of full-flash sites. Maybe the loading took much longer because the site is overloaded and it will be OK later.

Re: Mega has launched

#196

Post by georgeorwell »

zxcdw wrote: post #180
georgeorwell wrote: post #146

Earlier quoted context omitted.

For what it's worth, I also have a much bigger problem with commercial copyright infringement than non-commercial copyright infringement. https://news.ycombinator.com/item?id=5084439 I can see how the Daft Punk thing would get on your nerves. It seems like all this man does is use people.

"Uses" people by creating products other people are willing to pay for. Just like your local pig farm "uses" the animals to provide you food you are willing to pay for. Mega is just being a midleman here. What's so wrong about it, really? If an industry goes down because it can't compete with "free", then maybe it should go down because technology makes the business model unprofitable? Big players go down and small o…

He doesn't create the products he is selling access to and he doesn't have a license to be a middleman. I agree that the creators have a broken business model, but his business model of exploiting that brokenness is not a replacement for it. In fact, it depends on it.

I don't believe that machines will replace artists either, because I believe art is the expression of personal human experience.

Re: Mega has launched

#197

Post by Hupo »

huhtenberg wrote: post #123
jiggy2011 wrote: post #62

Earlier quoted context omitted.

Possibly convergent encryption, basically when you encrypt the file you use a hash of the file as the key. This key can then be encrypted with several different passwords meaning that several people can decrypt this file.

This means that if there's a commonly available plaintext version of a file, then you can encrypt it, compute the hash of the encrypted version and then serve it to Mega along with a DMCA takedown notice. They wouldn't really want that, would they? So as clever as it is, I doubt they do it this way.

>then serve it to Mega along with a DMCA takedown notice.

The thing with copyrighted content, though, is that even if the file you're checking might be infringing on copyrights in certain cases, in other cases it might as well be completely legit. I wrote about this on some earlier MU submission[1], so I won't repeat all that here, but all in all, even if you knew that file X existed on Mega's servers, it would be pretty damn haphazard to just outright delete it, because you might be hurting many legitimate users by doing so.

Anyway, I think Mega could secure user's files simply by encrypting the locator keys they have with the user's own key, and this data only gets decrypted and parsed client-side when the user uses Mega with the user's own key. This way you could only prove that a file exists on Mega's servers, but had no way to check which user(s) it belongs to without cracking the individual user data one by one. And of course, if you don't have any exact files to check against Mega, then you wouldn't be able to even figure out whether "content X" is hosted there somewhere, and neither could Mega (since they'd naturally only store locator hashes and encrypted data itself).

[1] http://news.ycombinator.com/item?id=4824986

Re: Mega has launched

#198

Post by jlgreco »

jakejake wrote: post #183
jlgreco wrote: post #164

Earlier quoted context omitted.

What do you mean by "ok"? Morally ok? That is subject to opinion. I don't have a problem with them now, and I never did. Legally immune? They very well could be. Certainly any action against them is going to be much harder this time, if only because a bunch of people in New Zealand are still pissed about what happened last time without the revisions that were made. If their system works as they claim, and renders the…

As soon as a file goes public and anybody can get it, then it seems to me irrelevant that its encrypted on mega servers. They'll have to respond to takedown requests because the contents are known. And if mega is de-duping content then that could technically eliminate "whack a mole" for the copyright holders (except for people re-encoding the file and re-uploading). I had heard in the past that mega would only take d…

> They'll have to respond to takedown requests because the contents are known.

And presumably, unless they think they can legally get away with ignoring it, they will.

What they won't be able to do is respond to a request that says "Delete all copies of [Big movie of the year], and continue to delete all of our movies as they pop back up."

Re: Mega has launched

#200

Post by Giszmo »

gjulianm wrote: post #48

I just found a weird things on they ToS [1] ... 8. Our service may automatically delete a piece of data you upload or give someone else access to where it determines that that data is an exact duplicate of original data already on our service. In that case, you will access that original data. Duplicate check, I get that. But, how do they do it? They say the files are encrypted on the browser, so if I upload file X an…

maybe they store a hash along your strongly encrypted file. this way they could go after copy-righted files accross the system once reported at the cost of quasi-decrypting some of your files. your really unique files would still be save although you might not want them to be able to timestamp proof your possession of these neither.
Post reply on HN