Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mega has launched

mega.co.nz

Post reply on HN
Print view View original

231–240 of 272 posts

Re: Mega has launched

#231

Post by Sami_Lehtinen »

gjulianm wrote: post #48

I just found a weird things on they ToS [1] ... 8. Our service may automatically delete a piece of data you upload or give someone else access to where it determines that that data is an exact duplicate of original data already on our service. In that case, you will access that original data. Duplicate check, I get that. But, how do they do it? They say the files are encrypted on the browser, so if I upload file X an…

Read Freenet documentation. They encrypt everything, yet they use very efficient deduplication. I really like Freenet's design. Encryption key is based on the payload, so if you don't know what he payload is, you can't decrypt the packet. Of course decryption keys can be delivered using different encrypted tree of keys, which is used when you deliver download link.

For that reason, when ever I'm sharing anything I usually encrypt files with my recipients public keys before sending those out. Just to make sure that data is really private and keys are known only to my selected peers. In some cases when I want to make stuff even more private, I encrypt data separately with each recipients public key, so you can't even see list of public key ID's which are required to decrypt the data.

I also have 'secure work station' which is hardened and not connected to internet. That's the workstation I use to decrypt, handle and encrypt data. Only encrypted and signed data is allowed to come and go to that workstation.

Re: Mega has launched

#232

Post by jlgreco »

soup10 wrote: post #217
jlgreco wrote: post #213

Earlier quoted context omitted.

What, in the same way that manufacturing syringes that will be used to mainline illegal narcotics should not be "encouraged or tolerated"?

It takes some twisted logic to think thats a valid analogy. Dropbox is a perfectly valid filehosting service because they take reasonable measures to prevent copyright infringement. Megaupload(and mega) is not, because it's run by a person who has no real interest in preventing copyright infringement, and has shown that he's more than willing to profit off it, while he pretends that he doesn't know it's occurring or…

Twisted logic? Many organizations distribute syringes explicitly for heroin.

Re: Mega has launched

#233

Post by jlgreco »

ghshephard wrote: post #225
jlgreco wrote: post #198

Earlier quoted context omitted.

> They'll have to respond to takedown requests because the contents are known. And presumably, unless they think they can legally get away with ignoring it, they will. What they won't be able to do is respond to a request that says "Delete all copies of [Big movie of the year], and continue to delete all of our movies as they pop back up."

As long as it's the same file, they will be able to do precisely that.

> And presumably, unless they think they can legally get away with ignoring it, they will.

I feel like a goddamn broken record.

Re: Mega has launched

#234

Post by icebraining »

soup10 wrote: post #223
danenania wrote: post #222

Earlier quoted context omitted.

Define 'reasonable measures'. People use Dropbox to share copyrighted material all the time. Ditto S3, gmail, external hard drives, and any file storage method in existence. Enforcement of the standard you're promoting would require pervasive surveillance of every data storage and transfer method in the world, and backdoor access for all forms of encryption. Freedom of information and communication is orders of magni…

Arguing against piracy on the internet is a giant waste of my time because if you have it in your head that piracy is "good" or "ok" then you will rationalize bad arguments all day defending an incorrect position. To address your latest spurious post, dropbox, gmail, etc. Facilitate file sharing on a small scale. Public links to megaupload listed on public aggregating websites that list the latest 'releases' are an e…

Arguing against piracy on the internet is a giant waste of my time because if you have it in your head that piracy is "good" or "ok" then you will rationalize bad arguments all day defending an incorrect position.

Don't you have it in your head that danenania's position is incorrect and it's therefore a waste of time to argue the subject with you? It certainly seems so, specially since danenania isn't actually arguing for piracy, just that (s)he considers the steps of eliminating piracy to go against more important values.

As an analogy, the fact that I defend almost absolute free speech doesn't mean I'm in favor of all speech, it just means that eliminating said speech is worse than allowing it to exist freely.

Re: Mega has launched

#235

Post by derleth »

joering2 wrote: post #104
zalew wrote: post #57

"Warning: You are using an outdated browser, which adversely affects your file transfer performance. Please upgrade to Google Chrome." is this a joke? I'm on FF19

If you been using both browsers for a while, you could (at least IMHO) feel the increasing slowness of FF comparing to Chrome, at lest within last 2 years. Further, the site looks very much polished in Chrome and its hard to find anything to blame for. If they did benchmark testing and realized Chrome works the best for decryption/encrypting/etc, I don't blame them for giving up on other browsers.

> If you been using both browsers for a while, you could (at least IMHO) feel the increasing slowness of FF comparing to Chrome, at lest within last 2 years.

Chrome starts a lot slower for me. It seems to really hit the disk a lot more than Firefox.

Re: Mega has launched

#236

Post by icebraining »

cdr wrote: post #167
soup10 wrote: post #162

Earlier quoted context omitted.

It's pretty embarrassing that tech blogs are even covering this. Copyright law is about intent, not about technical specifics. The idea that new megaupload is ok because it encrypts illegitimate content before storing it is absurd.

Copyright law can absolutely hinge on technical specifics. Look at network DVR services being forced to store a copy of a show per user in order to be found legal in the US.

Yeah, or the fact that Aereo has one antenna per user,

Re: Mega has launched

#237

Post by [deleted] »

Hupo wrote: post #197
huhtenberg wrote: post #123

Earlier quoted context omitted.

This means that if there's a commonly available plaintext version of a file, then you can encrypt it, compute the hash of the encrypted version and then serve it to Mega along with a DMCA takedown notice. They wouldn't really want that, would they? So as clever as it is, I doubt they do it this way.

>then serve it to Mega along with a DMCA takedown notice. The thing with copyrighted content, though, is that even if the file you're checking might be infringing on copyrights in certain cases, in other cases it might as well be completely legit. I wrote about this on some earlier MU submission[1], so I won't repeat all that here, but all in all, even if you knew that file X existed on Mega's servers, it would be pr…

[deleted]

Re: Mega has launched

#238

Post by icebraining »

jpalomaki wrote: post #128
AhtiK wrote: post #103

Earlier quoted context omitted.

MEGA servers store the hash of the password, not the password itself. Unlocking a key requires a real password but the server knows only the hashed version. This way they can't capture the real password to unlock. The trick would be to make sure server always gets only the hashed password. Even at website login, the password must be hashed before sending! We used similar crypto for http://timegt.com product where eve…

As long as the logins go via normal web page hashing the passwords before sending them does not really add that much security. If the security of the server is somehow compromised, it would be trivial to put up new Javascripts that send the cleartext password to server. Users are not likely to go through the Javascript to check what it is actually doing.

In fact, they say so themselves:

  What if I don't trust you? Is it still safe for me to use MEGA?

  If you don't trust us, you cannot run any code provided by us, so opening our site
  in your browser and entering your password is off limits. If you still want to use
  MEGA, you have to do so through a client app that was written by someone you trust.

Re: Mega has launched

#239

Post by icebraining »

ditojim wrote: post #99
GowGuy47 wrote: post #86

How much storage does the free version allow is my question... Couldn't find it any where

50gb - It has been mentioned in a few articles but I did not readily find the info on the site.

It's in Help center: Account. https://mega.co.nz/#help_account

Re: Mega has launched

#240

Post by Sami_Lehtinen »

gjulianm wrote: post #74
jiggy2011 wrote: post #62

Earlier quoted context omitted.

Possibly convergent encryption, basically when you encrypt the file you use a hash of the file as the key. This key can then be encrypted with several different passwords meaning that several people can decrypt this file.

This? http://crypto.stackexchange.com/questions/729/is-convergent-... http://www.ssrc.ucsc.edu/Papers/storer-storagess08.pdf It seems really interesting, so they can check for duplicates while keeping files secure. Thanks!

Yes, there's exactly the same problem as with Freenet. Because same plaintext encrypts to same ciphertext there is huge problem with that. If I really don't anyone want to know that I got this data, that's failed scenario. It makes things easier for service provider, they don't want to know what they're storing. Just like Freenet's data cache. But if I know what I'm looking for, I can confirm if my cache contains that data or not. Therefore this approach doesn't remove need for pre-encrypting sensitive data. Otherwise it's easy to bust you for having the data.

Edit: GNUet quote:"The gnunet encryption scheme is remarkable in that it allows identical files encrypted under different keys to yield the same ciphertext, modulo a small block of metadata. These files can then be split into small blocks and distributed (and replicated if need be) across hosts in a gnunet system to balance load."

http://grothoff.org/christian/esed.pdf Efficient Sharing of Encrypted Data - Krista Bennett, Christian Grothoff, Tzvetan Horozov, Ioana Patrascu

Post reply on HN