The issue here is that MEGA presents itself as "the privacy company" and makes some very careful claims about encryption: All files stored on MEGA are encrypted. All data transfers from and to MEGA are encrypted. And while most cloud storage providers can and do claim the same, MEGA is different – unlike the industry norm where the cloud storage provider holds the decryption key, with MEGA, you control the encryption…
If the government has compromised trusted CAs to do man-in-the-middle attacks, my thought is that they are only for 'intelligence' levels of actions, at least at this point in time. The government isn't going to tip its hand to foreign adversaries even to jail a few pedophiles (or other breakers of Federal law).
MEGApwn - Bookmarklet to recover your secret MEGA master key
31–40 of 44 posts
Re: MEGApwn - Bookmarklet to recover your secret MEGA master key
#32Re: MEGApwn - Bookmarklet to recover your secret MEGA master key
#33Earlier quoted context omitted.
If the government has compromised trusted CAs to do man-in-the-middle attacks, my thought is that they are only for 'intelligence' levels of actions, at least at this point in time. The government isn't going to tip its hand to foreign adversaries even to jail a few pedophiles (or other breakers of Federal law).
Maybe you missed it, but the DEA already uses the questionable NSA secret surveillance to find drug dealers, and constructs evidence against them to hide use of the surveillance.
Re: MEGApwn - Bookmarklet to recover your secret MEGA master key
#34[edit] formatting was removed, so this is more readable:
Doesn't work in chrome though.
[edit2] Lol; I just noticed the article actually shows the .js :P I never got past the button and checking what it did :P
Re: MEGApwn - Bookmarklet to recover your secret MEGA master key
#35The issue here is that MEGA presents itself as "the privacy company" and makes some very careful claims about encryption: All files stored on MEGA are encrypted. All data transfers from and to MEGA are encrypted. And while most cloud storage providers can and do claim the same, MEGA is different – unlike the industry norm where the cloud storage provider holds the decryption key, with MEGA, you control the encryption…
It's much easier to compromise the user's computer and install whatever type of "utilities" they need to recover whatever data they want.
Re: MEGApwn - Bookmarklet to recover your secret MEGA master key
#36What is MEGA?
Re: MEGApwn - Bookmarklet to recover your secret MEGA master key
#37What is MEGA?
There's a link to MEGA's website, right at the top of the submitted story's webpage. You might enjoy reading before commenting.
Re: MEGApwn - Bookmarklet to recover your secret MEGA master key
#38The issue here is that MEGA presents itself as "the privacy company" and makes some very careful claims about encryption: All files stored on MEGA are encrypted. All data transfers from and to MEGA are encrypted. And while most cloud storage providers can and do claim the same, MEGA is different – unlike the industry norm where the cloud storage provider holds the decryption key, with MEGA, you control the encryption…
Re: MEGApwn - Bookmarklet to recover your secret MEGA master key
#39If you look at Mega API and SDK, design wise it is very clean. You can build your own custom application by importing those libraries which are not prone to this kind of attacks.
Re: MEGApwn - Bookmarklet to recover your secret MEGA master key
#40Earlier quoted context omitted.
Isn't the issue more that Mega portray that they CAN'T see what files you're storing (plausible deniability regarding pirated content) while this proves that they actually could see your file contents if they wanted to? Which in turn really means it's no more secure than, say, DropBox. At least that's the impression I have regarding why this is somewhat important.
This didn't need proving. They send you JavaScript code, which you trust to encrypt your files. Without a built-in, well-audited, static browser mechanism no web service can ever be trusted with confidential data . If the Feds decide to raid MEGA again they can simply modify their server side script to recognise your IP and serve you bad JavaScript from the MEGA domain, revealing your keys the next time you login. No…
That's why mega has a separate app: https://mega.co.nz/#chrome