MEGApwn - Bookmarklet to recover your secret MEGA master key • Hacker News Board

Re: MEGApwn - Bookmarklet to recover your secret MEGA master key

#41

Post by icebraining » Tue, Sep 03, 2013, 11:09 AM UTC

Mindless2112 wrote: post #27

nhm wrote: post #5

Earlier quoted context omitted.

Yea, he did. I think the point is more that MEGA can read the key, and your files without permission. This contradicts their claim "Your data is encrypted by you before upload to our system and therefore we do not and cannot access that content"

Their claim is true so long as they don't snatch the key from you when you access the MEGA website.

I disagree. Can't is "we are unable to", not "we could if we just changed a couple lines of code".

They can claim they won't, but can't is misleading to the point of fraud, in my opinion.

Re: MEGApwn - Bookmarklet to recover your secret MEGA master key

#42

Post by gnur » Tue, Sep 03, 2013, 12:41 PM UTC

Not really a "pwn" (I hate that word), it is nearly impossible for any website to create encrypted data which it cannot retrieve themselves with some client side code. If you would do gpg/pgp in pure javascript someone could alter the javascript to send back the private key. Same thing with any client side software that can update itself without permission. Sure, when you first access it it could be secure, but the second time, when the code-provider is compromised you have instantly lost your "private" keys.

Re: MEGApwn - Bookmarklet to recover your secret MEGA master key

#43

Post by bug0303 » Tue, Sep 03, 2013, 7:48 PM UTC

I also submitted a bug to MEGA, haven't recieved a response yet.

The bug goes like this: https://mega.co.nz/#!your_file_here!decryption_key In Firefox when you have Javascript disabled via the option or using an add-on like NoScript it will redirect you to: https://mega.co.nz/?_escaped_fragment_=your_file_here!decryp...

So MEGA will recieve the HTTP Request with $_GET['_escaped_fragment_'] containing your decryption key. So if you send a file to a friend who happens to not have Javascript enabled for the website it will reveal the decryption key to MEGA.

To fix the issue all MEGA needs to do is add a double hash like: https://mega.co.nz/##!your_file_here!decryption_key this redirects to https://mega.co.nz/#?_escaped_fragment_=your_file_here!decry... keeping your decryption key safe even if they forget to use Javascript.

Re: MEGApwn - Bookmarklet to recover your secret MEGA master key

#44

Post by tomrod » Fri, Sep 06, 2013, 6:14 PM UTC

alcari wrote: post #30

NotHereNotThere wrote: post #28

Earlier quoted context omitted.

There's a link to MEGA's website, right at the top of the submitted story's webpage. You might enjoy reading before commenting.

Without Javascript, MEGA's website is a blank white page. Without knowing exactly what MEGA is, why should a sufficiently paranoid user allow js from it to run?

Hence my dilemma.