Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mega has launched

mega.co.nz

Post reply on HN
Print view View original

71–80 of 272 posts

Re: Mega has launched

#71

Post by [deleted] »

dabeeeenster wrote: post #51
gjulianm wrote: post #48

I just found a weird things on they ToS [1] ... 8. Our service may automatically delete a piece of data you upload or give someone else access to where it determines that that data is an exact duplicate of original data already on our service. In that case, you will access that original data. Duplicate check, I get that. But, how do they do it? They say the files are encrypted on the browser, so if I upload file X an…

Something doesn't smell right regarding the browser-based private key encryption. What I think is happening is that they could theoretically decrypt all your content, but the fact that they dont, and would have to jump through some technical hoops to do so, is maybe enough for them to argue that they don't know what is being uploaded?

[deleted]

Re: Mega has launched

#72

Post by [deleted] »

dexter313 wrote: post #55
gjulianm wrote: post #48

I just found a weird things on they ToS [1] ... 8. Our service may automatically delete a piece of data you upload or give someone else access to where it determines that that data is an exact duplicate of original data already on our service. In that case, you will access that original data. Duplicate check, I get that. But, how do they do it? They say the files are encrypted on the browser, so if I upload file X an…

The user's javascript that encrypted the file can also make a hash send it to mega, and then they check if they already have that. EDIT: They never get to see your key or what is in the file.

[deleted]

Re: Mega has launched

#74

Post by gjulianm »

jiggy2011 wrote: post #62
gjulianm wrote: post #48

I just found a weird things on they ToS [1] ... 8. Our service may automatically delete a piece of data you upload or give someone else access to where it determines that that data is an exact duplicate of original data already on our service. In that case, you will access that original data. Duplicate check, I get that. But, how do they do it? They say the files are encrypted on the browser, so if I upload file X an…

Possibly convergent encryption, basically when you encrypt the file you use a hash of the file as the key. This key can then be encrypted with several different passwords meaning that several people can decrypt this file.

This? http://crypto.stackexchange.com/questions/729/is-convergent-... http://www.ssrc.ucsc.edu/Papers/storer-storagess08.pdf

It seems really interesting, so they can check for duplicates while keeping files secure. Thanks!

Re: Mega has launched

#75

Post by kami8845 »

csomar wrote: post #59
Kudos wrote: post #11

They're not caching any of their static resources, that might explain the amount of bandwidth use Dotcom is apparently seeing. Edit: They're not gzipping any of the 2.5MB in static resources either. I realise that probably doesn't impact their API calls that are failing, but it's still a big oversight.

If you are opening their app for the first time, it doesn't matter since you are going to download the content anyway. He has only one page, so navigation doesn't reload the content. Not using Gzip is obviously a big mistake.

>Not using Gzip is obviously a big part of his marketing plan.

I think this is the only time I would use the words "FTFY" on HN, but I do think it's obvious, that with kim's bragging about bandwidth usage, gzip has been disabled intentionally.

Re: Mega has launched

#76

Post by caw »

gjulianm wrote: post #48

I just found a weird things on they ToS [1] ... 8. Our service may automatically delete a piece of data you upload or give someone else access to where it determines that that data is an exact duplicate of original data already on our service. In that case, you will access that original data. Duplicate check, I get that. But, how do they do it? They say the files are encrypted on the browser, so if I upload file X an…

Maybe they use block deduplication on the storage arrays? Particularly looking at the "our service may automatically delete a piece of data you upload". In other words, you already uploaded it encrypted and they're just serving out the de-duplicated bits.

Re: Mega has launched

#78

Post by beala »

jiggy2011 wrote: post #67
gjulianm wrote: post #61

Earlier quoted context omitted.

Ok, so I try to upload a.exe to Mega. They make a hash, detect someone has already uploaded it. They don't upload my file, and instead they place a link in my account to that "a.exe" of some other user. How can I access it then? Because it's encrypted with a key which is not mine.

The hashing is done by the client before upload. So if all clients use the same hash algo they will generate the same hash for the same file. So it is encrypted with a key that you know because you have the original file.

Deriving the key from the plaintext + the ciphertext is called a known-plaintext attack [1]. AES isn't vulnerable to this.

[1] http://en.wikipedia.org/wiki/Known-plaintext_attack#Present_...

Re: Mega has launched

#79

Post by dexter313 »

caw wrote: post #76
gjulianm wrote: post #48

I just found a weird things on they ToS [1] ... 8. Our service may automatically delete a piece of data you upload or give someone else access to where it determines that that data is an exact duplicate of original data already on our service. In that case, you will access that original data. Duplicate check, I get that. But, how do they do it? They say the files are encrypted on the browser, so if I upload file X an…

Maybe they use block deduplication on the storage arrays? Particularly looking at the "our service may automatically delete a piece of data you upload". In other words, you already uploaded it encrypted and they're just serving out the de-duplicated bits.

Piece is the keyword here.

Re: Mega has launched

#80

Post by g_lined »

gjulianm wrote: post #61
dexter313 wrote: post #55

Earlier quoted context omitted.

The user's javascript that encrypted the file can also make a hash send it to mega, and then they check if they already have that. EDIT: They never get to see your key or what is in the file.

Ok, so I try to upload a.exe to Mega. They make a hash, detect someone has already uploaded it. They don't upload my file, and instead they place a link in my account to that "a.exe" of some other user. How can I access it then? Because it's encrypted with a key which is not mine.

Note that they are likely to use something like 4MB chunks of the file rather than whole files. This prevents things like metadata/name differences creating a different hash for the whole file.
Post reply on HN