Crypto Analysis and Recommendations for Mega
spideroak.com
Crypto Analysis and Recommendations for Mega
1–10 of 50 posts
Re: Crypto Analysis and Recommendations for Mega
#2One of the points not mentioned in the article is that this analysis is useful even if (like me, tptacek, and many others) you don't trust Javascript crypto.
That's because Mega is designed as simply an API that any client (including one distributed as a desktop application) could implement. However, another client implementing this same spec would have the same weaknesses. It's important that we get the design improved now. Then we can go on to build open source clients outside of the perils of the JS runtime.
Edited to add: If anyone is interested in building such a open source desktop client in Python, I could help by making our (SpiderOak's) toolchains, packagers, and installers available.
Edited again to add: Assuming a solid design and implementation is eventually produced in Javascript, you could probably re-use most of the code and avoid the JS runtime dangers by repackaging it as a desktop app with something like http://appjs.org/ Remember that of course your privacy is based not just on you using a secure client, but everyone you share data with doing likewise.
Re: Crypto Analysis and Recommendations for Mega
#3A pretty decent read, the code excerpts were pretty eye opening in context. I wonder about the mentioned follow ups, especially the convergent encryption server side. Dotcom's strategy just doesn't seem fixable with some of the flaws in design. I'm new to the concept of js crypto, so it's interesting to see how much has already been considered.
Re: Crypto Analysis and Recommendations for Mega
#4I just wonder how much Mega would have to pay to get all of those advices...
Now it gets all of them for free and likely it would use them to harden the service.
Re: Crypto Analysis and Recommendations for Mega
#5One of the points not mentioned in the article is that this analysis is useful even if (like me, tptacek, and many others) you don't trust Javascript crypto. That's because Mega is designed as simply an API that any client (including one distributed as a desktop application) could implement. However, another client implementing this same spec would have the same weaknesses. It's important that we get the design impro…
Paying customer here, thank you for a wonderful product and service!
One question I have is why SpiderOak client is not open-source? As I understand, it is Python and decompiling it for analysis is not too much trouble, but still...
Re: Crypto Analysis and Recommendations for Mega
#6I just wonder how much Mega would have to pay to get all of those advices... Now it gets all of them for free and likely it would use them to harden the service.
Release early, release often works pretty well when the whole world is waiting for you to make a mistake. They are certainly getting a lot of valuable advice for free.
It would have been better for their users, however, if they'd tried to get this right before releasing. Mega smells very much like marketing over technology.
Re: Crypto Analysis and Recommendations for Mega
#7A small point, but the title here might bear changing. "Crypto analysis" suggests a typo of "cryptanalysis", which is not what the article is about. Perhaps "Analysis and Recommendations for the Crypto in Mega" might be a better title.
Re: Crypto Analysis and Recommendations for Mega
#8One of the points not mentioned in the article is that this analysis is useful even if (like me, tptacek, and many others) you don't trust Javascript crypto. That's because Mega is designed as simply an API that any client (including one distributed as a desktop application) could implement. However, another client implementing this same spec would have the same weaknesses. It's important that we get the design impro…
[deleted]
Re: Crypto Analysis and Recommendations for Mega
#9I can't help but look at 'Mega' and get the feeling that the 'Secure and Private' part is 99% Kim trying to protect himself from further lawsuits, rather then actually ensuring the privacy and security of user data. I hope I'm wrong of course.
Re: Crypto Analysis and Recommendations for Mega
#10I can't help but look at 'Mega' and get the feeling that the 'Secure and Private' part is 99% Kim trying to protect himself from further lawsuits, rather then actually ensuring the privacy and security of user data. I hope I'm wrong of course.
Without real privacy, it doesn't protect him or his users.