I wonder how long it will take countries to block Mega in the same way that torrent sites (TBP) are blocked, and what steps Mega has taken in anticipation of this...
His lawyers probably told him he might as well not bother if it's for piracy - arguing that they don't (not can't) save the key in this URL doesn't sound like much of a defense if Mega's targeting illicit file sharing again.
He had A-list endorsements coming through with the previous product, when it becomes that high-profile and main stream the U$A won't be able to just steal the domain without public due-process.. They had their chance, but they may still find a way..
not what the OP said.
TPB is very much high profile but you can't access it in some countries because it is banned at the ISP level (with a reasonably public legal process).
Yes, exactly this. TPB's IP addresses are blocked at ISP level, and the response has been to set up many reflector sites (e.g. malaysiabay.org), and mirrors.
A complicated interactive site is of course much harder to mirror than a bunch of magnet links.
That's an important clarification. The article is eager to make a sensational statement, offering a clever bait-and-switch claim in the first paragraph. It starts out mentioning signups...
"If the launch day signups and traffic were something to shout home about, after the surge of media attention that Mega garnered over the next few days from sites like ourselves,"
...but ends up supporting its claims with Alexa traffic ratings...
"it only got stronger and now we’re at a stage where Mega has almost broken into the top 100 sites in the world."
The system they use for metrics is biased. They track the visits of the users who have installed the Alexa toolbar in their browsers. It's really hard to get a decent sample of Internet users using that data collecting method.
Alexa now does direct tracking, in a somewhat similar manner to Quantcast. I don't think very much of their data is yet represented in that manner however.
"We welcome the ongoing #Mega security debate & will offer a cash prize encryption challenge soon. Let's see what you got ;-)"
I can't think of a better way to get someone with real crypto cojones to fix their crypto missteps. Power to Kim and what he´s doing. 50GB for free is amazing.
Hiring a competent and qualified security consultant/company to evaluate their services/processes, maybe?
The really good hackers are likely out getting paid good money for their work, and won't necessarily have time to poke at this for uncertain reward. There might be sufficient value in the publicity associated with finding flaws (especially while it's getting lots of media attention right now), but a competition/challenge is rarely a good economic choice for the potential entrants.
A bug bounty programme might be useful as a supplement to a rigorous security audit, but the issues discovered so far seem to be things that could have been identified by reasonably competent netsec people, indicating that such an audit either didn't happen, or wasn't acted upon.
What about Google? They hire plenty of competent netsec people, and yet the Chrome bug bounties yielded discovery of bugs that even those folks couldn't find.
I don't think the really good hackers evaluate how they spend their time based on purely economic concerns (eg "Can I get good press out of this for my personal brand?")
With the amount of publicity it has generated thanks to the incompetence of US and NZ authorities it is wonder it has not overtaken twitter yet.
But there is the thing - mega is not a good service - too much false promises. Seems like a honeytrap for infringers. There are ways to design it better with better guarantees for user privacy.
Can you explain further? As far as I can tell, there does not appear to be any better possible option given the requirements (usable from a browser, legally defensible, anonymous usage with proxies, resistant to DCMA takedowns, etc)
Well ... I had this idea few years back. I am no encryption specialist.
1. I will get as many backblaze pods as I can.
2. Client will mostly be the same with few differences - the encryption will be symmetrical (AES probably), with randomly generated key from high quality entropy. This key will never leave the client. File names will be encrypted too. It will be bundled with the file and uploaded in some blob For directories - they can be tared first before encrypted.
So the only thing that I will see as a host is file size.
3. There will be some more keys that will be generated and uploaded - keep alive and kill switch. keep alive must be given on regular intervals or content expires. The kill key will delete the file on the server and as many of the logs as legally possible, end of story.
4. The server returns the unique url.
5. You get some text on your screen that will give 3 urls
- kill url
- keep alive url
- decrypt key
- safe download url (http://something/url) will be asked by the page to give key. Decrypt will be on the client too.
- unsafe download url (http://something/url#key)the javascript will begin decryption immediately but if someone intercepts the url - he will have the key.
5. Premium accounts will be given on scratch cards or bought with bitcoins. Donations will be accepted anyway but won't give benefits.
6. .onion address for upload
7. Outgoing bandwidth - the speed of the downloads for all but premium accounts will be function of the donations received the previous day.
8. Everything will be open , and the community will be allowed to audit the systems.
Users won't be happy with 1kb/s uploads via Tor. If you're going trough that bottleneck, this offers no advantages over a a standard file-sharing service hosted at a .onion node.
Is traffic to Dropbox.com indicative of anything? I've been a Dropbox user for years (yo-yoing between paid and unpaid plans based on my need - the ability to do so is something I hugely appreciate) but never visit the site.
Is this not the equivalent of judging Windows usage based on visits to microsoft.com?
> I've been a Dropbox user for years [...] but never visit the site.
I created a Dropbox account (which I do use) a couple years ago, and last week I visited the site for the first time in almost as long as I've had the account.
A word of warning to you, since you don't access the site often: your password expires, and you'll need access to your email account when it does.
My laptop semi-died last week (it's not actually dead, but I couldn't get it to boot at the time), so I used my girlfriend's to order a new one.
I keep my KeePass database in my DropBox for just such occasions, so I tried to log into Dropbox's web interface to retrieve it and access my account on the computer retailer's website. Dropbox accepted my password, but told me I couldn't continue until I changed my password, which required clicking a link they had sent to my email account.
Unfortunately, the password to my gmail account is also in KeePass, and is an incomprehensible mess of generated gibberish that I don't know, so I couldn't get in. I had to reset my Google password using an email account that is apparently on file with Google, in order to reset my password with DropBox, in order to access my retail account with the laptop vendor.
I don't know if this would have been easier had I known about DropBox's two-factor authentication before this, or if maybe I could have installed DropBox on my girlfriend's laptop and got in that way without needing to reset anything, but I ended up burning half an hour on this because I didn't know I had to keep my password constantly up to date on their website.
It seems like an obvious thing to do, but for something like Dropbox which is just "always there" on your local machine, it's an easy thing to forget.
Yes, your password DB should be backed up in a couple of places, and of course, keep the master password offline securely as well. I don't use a ready made solution, but something similar with GPG
And don't forget to test the backups periodically, and check the master password
I know my DropBox password, and I know my KeePass password. I honestly thought that was enough, under the assumption that a) if my DropBox account was inaccessible, those files would still be on my hard drive, and b) if my laptop were lost or destroyed, I could still log into the web interface and grab the files from there.
I've always kind of worried about scenarios like this given my dependence on 1Password. To mitigate, I ended up getting 1Password for my phone so that I can access my passwords, even if my computer falls in a lake. I also try to avoid treating Dropbox like a backup. It's great for syncing, and I know they keep revisions, but I have a local TimeMachine backup, as well as an offsite backup through Backblaze (still need a password from my database for this). I could always recover my passwords from the TimeMachine backup if all my devices were to disappear at once.
You can also save the 1Password.html file where ever you want and access your passwords via any web browser with out the need for any 1Password app. It is a fully self-contained html app with all of the css, js and images (as data url's) included.
Dropbox doesn't make you "constantly" update your password. Six months ago, they had a security breach, and required all users to update their password.
While I'll admit that I was a bit embarrassed when I read your comment, I didn't think you intended to make me look foolish - nor do I really think I did look foolish, just uninformed.
My reply was merely a "mea culpa", and the note about removing the previous comment was more about removing inaccurate information than about saving face.
I suppose they take into account both those kind of direct visits to their website and the synchronization to their servers when you update some file in your local dropbox folder. I am not sure but it would make more sense.
I don't know... it seems like people are just curious about it, but it couldn't really be used properly (at least for me... I wasn't even able to download my files).
46 comments
[ 825 ms ] story [ 239 ms ] threadhttps://mega.co.nz/#!jFlzGQiZ!CL2dMi5IAYLUp3ZQ5JS7nmW0sYtudf...
A complicated interactive site is of course much harder to mirror than a bunch of magnet links.
"If the launch day signups and traffic were something to shout home about, after the surge of media attention that Mega garnered over the next few days from sites like ourselves,"
...but ends up supporting its claims with Alexa traffic ratings...
"it only got stronger and now we’re at a stage where Mega has almost broken into the top 100 sites in the world."
I can't think of a better way to get someone with real crypto cojones to fix their crypto missteps. Power to Kim and what he´s doing. 50GB for free is amazing.
The really good hackers are likely out getting paid good money for their work, and won't necessarily have time to poke at this for uncertain reward. There might be sufficient value in the publicity associated with finding flaws (especially while it's getting lots of media attention right now), but a competition/challenge is rarely a good economic choice for the potential entrants.
A bug bounty programme might be useful as a supplement to a rigorous security audit, but the issues discovered so far seem to be things that could have been identified by reasonably competent netsec people, indicating that such an audit either didn't happen, or wasn't acted upon.
But there is the thing - mega is not a good service - too much false promises. Seems like a honeytrap for infringers. There are ways to design it better with better guarantees for user privacy.
1. I will get as many backblaze pods as I can.
2. Client will mostly be the same with few differences - the encryption will be symmetrical (AES probably), with randomly generated key from high quality entropy. This key will never leave the client. File names will be encrypted too. It will be bundled with the file and uploaded in some blob For directories - they can be tared first before encrypted. So the only thing that I will see as a host is file size.
3. There will be some more keys that will be generated and uploaded - keep alive and kill switch. keep alive must be given on regular intervals or content expires. The kill key will delete the file on the server and as many of the logs as legally possible, end of story.
4. The server returns the unique url.
5. You get some text on your screen that will give 3 urls - kill url - keep alive url - decrypt key - safe download url (http://something/url) will be asked by the page to give key. Decrypt will be on the client too. - unsafe download url (http://something/url#key)the javascript will begin decryption immediately but if someone intercepts the url - he will have the key.
5. Premium accounts will be given on scratch cards or bought with bitcoins. Donations will be accepted anyway but won't give benefits.
6. .onion address for upload
7. Outgoing bandwidth - the speed of the downloads for all but premium accounts will be function of the donations received the previous day.
8. Everything will be open , and the community will be allowed to audit the systems.
That is in general details.
Is this not the equivalent of judging Windows usage based on visits to microsoft.com?
I created a Dropbox account (which I do use) a couple years ago, and last week I visited the site for the first time in almost as long as I've had the account.
A word of warning to you, since you don't access the site often: your password expires, and you'll need access to your email account when it does.
My laptop semi-died last week (it's not actually dead, but I couldn't get it to boot at the time), so I used my girlfriend's to order a new one.
I keep my KeePass database in my DropBox for just such occasions, so I tried to log into Dropbox's web interface to retrieve it and access my account on the computer retailer's website. Dropbox accepted my password, but told me I couldn't continue until I changed my password, which required clicking a link they had sent to my email account.
Unfortunately, the password to my gmail account is also in KeePass, and is an incomprehensible mess of generated gibberish that I don't know, so I couldn't get in. I had to reset my Google password using an email account that is apparently on file with Google, in order to reset my password with DropBox, in order to access my retail account with the laptop vendor.
I don't know if this would have been easier had I known about DropBox's two-factor authentication before this, or if maybe I could have installed DropBox on my girlfriend's laptop and got in that way without needing to reset anything, but I ended up burning half an hour on this because I didn't know I had to keep my password constantly up to date on their website.
It seems like an obvious thing to do, but for something like Dropbox which is just "always there" on your local machine, it's an easy thing to forget.
Some people rely too much on "one password" solutions, because of security, etc
But it's very easy to lock yourself out of everything. Very easy.
The best place for keeping important passwords is still my head.
Sure, you can use password management solutions, just keep a backup (piece of paper, secondary means of logging, etc)
I think that a software password manager (regularly backed up) with a master password stored in a secure (offline) location is the best solution.
And don't forget to test the backups periodically, and check the master password
I've corrected that assumption now.
http://help.agilebits.com/1Password3/1passwordanywhere.html
https://krebsonsecurity.com/2012/07/dropbox-password-breach-...
I'd delete my comment now, if I were still able to.
Personally, I don't think I've been back to the Dropbox website since I reset my password!
My reply was merely a "mea culpa", and the note about removing the previous comment was more about removing inaccurate information than about saving face.
http://cl.ly/image/0q2e462p1V2Y
Dropbox is used primarily via client apps, those figures must be less than 10% of it's actual usage.
Let's give it a few days and then we will see.