Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kim Dotcom resigns as Mega director

couriermail.com.au

Post reply on HN
Print view View original

31–38 of 38 posts

Re: Kim Dotcom resigns as Mega director

#31

Post by nwh »

mschuster91 wrote: post #30
nwh wrote: post #14

Earlier quoted context omitted.

Australian website, there's nothing forcing them to do anything.

Aren't Australia and Great Britain "connected" by that Commonwealth stuff? I'm not an expert in international politics, but in case that Australia is bound to that cookie law in GB, that'd explain it.

We are, but their privacy laws have absolutely no bearing on Australia. At the moment the only control the queen has is the ability to indirectly act through a Govener General who can disband the current government at will. That's never happened and probably never will though.

The whole cookie thing is just people flying off the handle anyway. One person put a warning so now everybody else does too.

Re: Kim Dotcom resigns as Mega director

#32

Post by gurkendoktor »

mahyarm wrote: post #26
simias wrote: post #21

Earlier quoted context omitted.

It's not js that's the issue, it's the fact that the server can change the code at any time without the user being notified. So mega can backdoor its own encryption code at any time to retrieve your keys. It's broken by design, it's not a flaw of js per se.

Your mobile & desktop OSes etc all have a silent automatic update mechanism. Installed programs can start services silently and download executable code in the background and use it as they want. And governments take advantage of these facts regularly. That's why they created the browser extension. It might even come signed. At least you can read the source in plain text, unlike a compiled binary.

Which mobile & desktop OSes do that? The only software that automatically installs updates on my Apple gadgetry seems to be Google Chrome.

Re: Kim Dotcom resigns as Mega director

#33

Post by mahyarm »

gurkendoktor wrote: post #32
mahyarm wrote: post #26

Earlier quoted context omitted.

Your mobile & desktop OSes etc all have a silent automatic update mechanism. Installed programs can start services silently and download executable code in the background and use it as they want. And governments take advantage of these facts regularly. That's why they created the browser extension. It might even come signed. At least you can read the source in plain text, unlike a compiled binary.

Which mobile & desktop OSes do that? The only software that automatically installs updates on my Apple gadgetry seems to be Google Chrome.

Google play services is one example. Any app can download executable code in the background without you realizing what is happening. Apple has some mechanisms of their own coded in if necessary.

Re: Kim Dotcom resigns as Mega director

#34

Post by lemonade »

kamjam wrote: post #29
rcxdude wrote: post #28

Earlier quoted context omitted.

But with SSL your root certificates change rarely and you can control them, as well as freeze certificates for specific websites. With Javascript code you don't have that kind of control and if you did it would require a massive change in the approach of creating a webapp in order to be managable. It's not an insurmountable problem though, I would like to see an attempt at solving it (a browser extension would be req…

Fair point, and a browser extension that would detect changes in he script would be easy enough to build. The point is, for the vast majority of users, freezing certs and such is not common (I didn't know you could do that for example) and they would rely on the site to specify the cert to use.

This is called certificate pinning (a.k.a. Trust On First Use or TOFU). If you use Firefox, just install Certificate Patrol.

If you are interested in the rationale, and how you can use technologies like DANE to make it even better, read the paper by Gabor Toth and Tjebbe Vlieg (http://staff.science.uva.nl/~delaat/rp/2012-2013/p56/report....).

Re: Kim Dotcom resigns as Mega director

#35

Post by lemonade »

simias wrote: post #10
BuildTheRobots wrote: post #6

Earlier quoted context omitted.

except for a couple of days ago when MegaPWN[1] came to light [1] http://nzkoz.github.io/MegaPWN/

I think by now everybody's already convinced that any javascript-based crypto is a joke.

With a small caveat for HTML5 apps where you can install a verified version of specific code you trust in your browser or your phone. And Node.js applications which run on the server side in a controllable version.

But above is just a nuance. I agree on the basic idea when it comes to Javascript you run in the browser, it is a lost battle - unless I get a SHA256 of every version of every javascript library and compare to that, and disallow other unreadable (random emscripten junk) scripts on random pages you visit while browsing. That is why I have NoScript installed, and only allow handpicked sites to run javascript in the browser.

If only we would have had the declarative approach (I still am a little grumpy that the browser makers abandoned W3C and the far better designed declarative technology XHTML2 + XForms to pursue what is now HTML5).

Re: Kim Dotcom resigns as Mega director

#37

Post by gurkendoktor »

mahyarm wrote: post #33
gurkendoktor wrote: post #32

Earlier quoted context omitted.

Which mobile & desktop OSes do that? The only software that automatically installs updates on my Apple gadgetry seems to be Google Chrome.

Google play services is one example. Any app can download executable code in the background without you realizing what is happening. Apple has some mechanisms of their own coded in if necessary.

Do you have more information on Apple's mechanisms? I can't find anything (and I'd like to turn them off :)).

Re: Kim Dotcom resigns as Mega director

#38

Post by mahyarm »

gurkendoktor wrote: post #37
mahyarm wrote: post #33

Earlier quoted context omitted.

Google play services is one example. Any app can download executable code in the background without you realizing what is happening. Apple has some mechanisms of their own coded in if necessary.

Do you have more information on Apple's mechanisms? I can't find anything (and I'd like to turn them off :)).

You can't turn them off without jailbreaking, then you can download tweaks to turn them off. One I remember from years ago was the 'app blacklist' disabler.
Post reply on HN