Live data from Hacker News

MEGApwn - Bookmarklet to recover your secret MEGA master key

nzkoz.github.io

31–40 of 44 posts

Re: MEGApwn - Bookmarklet to recover your secret MEGA master key

#31
post #18
post #16

The issue here is that MEGA presents itself as "the privacy company" and makes some very careful claims about encryption: All files stored on MEGA are encrypted. All data transfers from and to MEGA are encrypted. And while most cloud storage providers can and do claim the same, MEGA is different – unlike the industry norm where the cloud storage provider holds the decryption key, with MEGA, you control the encryption…

If the government has compromised trusted CAs to do man-in-the-middle attacks, my thought is that they are only for 'intelligence' levels of actions, at least at this point in time. The government isn't going to tip its hand to foreign adversaries even to jail a few pedophiles (or other breakers of Federal law).

Maybe you missed it, but the DEA already uses the questionable NSA secret surveillance to find drug dealers, and constructs evidence against them to hide use of the surveillance.

Re: MEGApwn - Bookmarklet to recover your secret MEGA master key

#33
post #18

Earlier quoted context omitted.

If the government has compromised trusted CAs to do man-in-the-middle attacks, my thought is that they are only for 'intelligence' levels of actions, at least at this point in time. The government isn't going to tip its hand to foreign adversaries even to jail a few pedophiles (or other breakers of Federal law).

Maybe you missed it, but the DEA already uses the questionable NSA secret surveillance to find drug dealers, and constructs evidence against them to hide use of the surveillance.

Well, that's acceptable. It is the War on Drugs after all. We have no War on Pedophilia, so we can't use it to go after the pedophiles. /s

Re: MEGApwn - Bookmarklet to recover your secret MEGA master key

#35
post #16

The issue here is that MEGA presents itself as "the privacy company" and makes some very careful claims about encryption: All files stored on MEGA are encrypted. All data transfers from and to MEGA are encrypted. And while most cloud storage providers can and do claim the same, MEGA is different – unlike the industry norm where the cloud storage provider holds the decryption key, with MEGA, you control the encryption…

That's way too much trouble.

It's much easier to compromise the user's computer and install whatever type of "utilities" they need to recover whatever data they want.

Re: MEGApwn - Bookmarklet to recover your secret MEGA master key

#37
post #26

What is MEGA?

There's a link to MEGA's website, right at the top of the submitted story's webpage. You might enjoy reading before commenting.

Even clicking that link, I had no idea what it was. There's just a big red button and a meaningless tagline about privacy. I think it's a fair question.

Re: MEGApwn - Bookmarklet to recover your secret MEGA master key

#38
post #16

The issue here is that MEGA presents itself as "the privacy company" and makes some very careful claims about encryption: All files stored on MEGA are encrypted. All data transfers from and to MEGA are encrypted. And while most cloud storage providers can and do claim the same, MEGA is different – unlike the industry norm where the cloud storage provider holds the decryption key, with MEGA, you control the encryption…

Come on, MEGA is not about secure storage but about Dotcom being able to tell any copyright enforcement party that he can't tell whether bits he store are illegal or not (and thus keep his business running).

Re: MEGApwn - Bookmarklet to recover your secret MEGA master key

#39
This bookmarklet is a type of phishing. Phishing and social engineering has been there all the time. You cannot prevent all that from a service provider point. Mega is a secure platform that operates on basis of user side encryption. The mega.co.nz javascript ui just provides a reference implementation. Browsers can be used easily to compromise user data once physical access is obtained.

If you look at Mega API and SDK, design wise it is very clean. You can build your own custom application by importing those libraries which are not prone to this kind of attacks.

Re: MEGApwn - Bookmarklet to recover your secret MEGA master key

#40
post #8
post #6

Earlier quoted context omitted.

Isn't the issue more that Mega portray that they CAN'T see what files you're storing (plausible deniability regarding pirated content) while this proves that they actually could see your file contents if they wanted to? Which in turn really means it's no more secure than, say, DropBox. At least that's the impression I have regarding why this is somewhat important.

This didn't need proving. They send you JavaScript code, which you trust to encrypt your files. Without a built-in, well-audited, static browser mechanism no web service can ever be trusted with confidential data . If the Feds decide to raid MEGA again they can simply modify their server side script to recognise your IP and serve you bad JavaScript from the MEGA domain, revealing your keys the next time you login. No…

> Without a built-in, well-audited, static browser mechanism no web service can ever be trusted with confidential data

That's why mega has a separate app: https://mega.co.nz/#chrome

Post reply on HN