›
This forum is in permanent archive mode. Our new active community can be found here.

MegaUpload is back!

DaikunDaikun
edited November 2012 in Technology
Remember the FBI's takedown of MegaUpload earlier this year?

Well, the creator is back with the website's successor, simply titled MEGA.
«1

Comments

  • Not nineNot nine
    Misleading title. Reported to the authorities.
  • AriaAria
    The commercial/information site thing is pretty. I like it =)
  • AprecheApreche
    A few weeks ago I read about the technology behind this. Here's how it will work in the least technological way I can explain it.

    You upload a file. Your browser will automatically create an encryption key and encrypt the file before uploading it. You have to write down the key or save it somewhere, because it is created in your browser on your computer and is never sent to MEGA. If you visit the link to download the file, you will need the key to decrypt the file. So when you want someone else to download a file you have to give them the link and the key.

    Meanwhile MEGA only has encrypted data. They will have no idea if that data is child porn, the latest Hollywood Blockbuster, or your homework. If someone uploads the same file twice, it will be encrypted with a different key each time, so it will be impossible for them to know that both of those files are the same file, except maybe they will be very similar in size.

    Thus, the only way they can get a DMCA takedown notice is if the MPAA/RIAA finds both the URL and the key. Even that kind of notice is going to be tough to get through. It's basically what we've always asked for. Why doesn't someone make encryption easy to bring power to the people? Well, it's happening.
  • 2bfree2bfree
    If this takes off, the 3rd party tracking companies the MPAA uses will create a web spider to find published keys and links. While it will require more effort on their part, I think people overestimate the difference this will make for pirating activities.

    The real question is, will the government be able to convince judges that services like these are essentially secure dropboxes for criminal activity. If so, the services won't survive long.
  • AxelAxel
    People will just have to share keys more intelligently rather than distributing them directly.
  • lackofcheeselackofcheese
    edited November 2012
    Oh, the keys for quite a lot of files will effectively be in the public domain, but that's not the primary issue at stake. It's not about avoiding takedown requests, it's about having legal grounding for the website itself.

    The major point is that if MEGA doesn't store the keys itself, it's much, much harder to hold them responsible for the content. Unless courts were to make the ludicrous ruling that MEGA itself is required to attempt to trawl the Internet looking for keys to decrypt the data they're storing, it seems like they're in a decent legal position.

    Sure, they will have to allow and respond to takedown requests, but as long as they comply with those requests things should work out.
    Post edited by lackofcheese on
  • johndisjohndis
    Biggies back image
  • WindUpBirdWindUpBird
    Kim Dotcom changed the rap game forever.
  • AprecheApreche
    Oppa DotCom Style
  • AprecheApreche
    edited January 2013
    I'm trying out MEGA. It doesn't work yet. Uploading a small text file to test. Just says "pending" and never uploads. The UI is great, though.
    Post edited by Apreche on
  • NeitoNeito
    I'm trying out MEGA. It doesn't work yet. Uploading a small text file to test. Just says "pending" and never uploads. The UI is great, though.
    Considering they got the DDoS of Love, I'm not terribly surprised it's not working.
  • iruuliruul
    By requiring a key for others to decrypt, what does this mean? A string of characters, a program, a text file, a physical object? How will this effect the ability to distribute files to random people?
  • JasonJason
    Are storage locker companies required to monitor what you store inside?
  • ChurbaChurba
    Are storage locker companies required to monitor what you store inside?
    Not as far as I know, though if they think you're doing something really hinky, they'll take a look. I think they are obligated to report anything illegal to the cops, though, if they find it.

  • BronzdragonBronzdragon
    Are storage locker companies required to monitor what you store inside?
    Not as far as I know, though if they think you're doing something really hinky, they'll take a look. I think they are obligated to report anything illegal to the cops, though, if they find it.
    If I understand correctly, they are not allowed to look in said storage lockers if the client pays. There are laws protecting the owner of the storage locker. If suspicious activity goes on outside the locker, obviously the cops still need to be brought in.

    I got this information anecdotally via hearing people describe and talk about Storage Wars in depth. (A TV show on auctioneers bidding on items in storage lockers that people got behind on their payments on).
  • AprecheApreche
    Seems like it is working now. Here's how it works. You upload the file. They encrypt it, but they know the file name and size. That really hurts their case for not knowing what the files are.

    Then you can get a link to the file like this and the downloader needs the encryption key to actually decrypt the file.

    https://mega.co.nz/#!phBm1RBZ

    However, they also allow URLs like this.

    https://mega.co.nz/#!phBm1RBZ!UQFuo3QRT77LODK9W1wBtndZf_BO3yhjypyADkLEE0Q

    With the key included, so what the fuck is the point of the encryption anyway? Not only is the key in the URL sent to MEGA every time the URL is visited, but you can actually retrieve the key URL from MEGA itself. There is no way they can claim to not know what is in the files.

    The way it is supposed to work is that the encryption and decryption are 100% client side. That is the keys are generated in your browser, the file is encrypted locally. The encrypted file is uploaded, and MEGA has no idea what is in it. It's up to you to save the keys because they will be lost otherwise. Then the key can never be sent to MEGA in a URL or otherwise.

    They fucked it the fuck up, and they were so close.
  • trogdor9trogdor9
    Scott, anything after the hashbang (#!) isn't sent to the server, it's only accessed from JS.

    http://stackoverflow.com/questions/940905/can-php-read-the-hash-portion-of-the-url

    I can't get it to work myself, but from what I can tell, it stores your private key in your browser's HTML5 localStorage for your convenience, so that's not stored on the server either.
  • AprecheApreche
    Scott, anything after the hashbang (#!) isn't sent to the server, it's only accessed from JS.

    http://stackoverflow.com/questions/940905/can-php-read-the-hash-portion-of-the-url

    I can't get it to work myself, but from what I can tell, it stores your private key in your browser's HTML5 localStorage for your convenience, so that's not stored on the server either.
    I didn't even notice that # there because it actually comes before the file ID instead of just coming before the private key. How does the server know what file to send you if the ID isn't sent to the server? I guess the request for the file is made via JS.

    Going to see what happens if I login from another computer and if the key is there.
  • AprecheApreche
    edited January 2013
    Logged in from another computer and the file manager was empty! Does that mean EVERYTHING is 100% client side except for the actual file storage and the JS app and UI? That's not good. It means if you lose your cookies and such, you lose all the files. They need to have some sort of way to save/load your file IDs and encryption keys to a file that you can put on a USB stick and load/unload.

    EDIT: Or maybe the file list was empty because they are not 100% working properly.
    Post edited by Apreche on
  • AlexAlex
    This Ars article also suggests some pretty fundamental questions about their encryption:

    http://arstechnica.com/business/2013/01/megabad-a-quick-look-at-the-state-of-megas-encryption/

    Short version of the biggest issue: they claim to keep only one copy of identical data shared by multiple users ("deduplication") for storage optimization purposes, which strongly suggests they are both able to decrypt stored data and to associate it with specific users.
  • RymRym
    Heh.. Dedupes really don't work on encrypted data, since said data should be pretty statistically similar to noise anyway...
  • AprecheApreche
    This Ars article also suggests some pretty fundamental questions about their encryption:

    http://arstechnica.com/business/2013/01/megabad-a-quick-look-at-the-state-of-megas-encryption/

    Short version of the biggest issue: they claim to keep only one copy of identical data shared by multiple users ("deduplication") for storage optimization purposes, which strongly suggests they are both able to decrypt stored data and to associate it with specific users.
    Yeah, the old Megaupload deduped. I as under the impression that the new one did not.
  • AlexAlex
    edited January 2013
    The entire dedupe issue derives from the fact that their (new) terms of service say they do. Could be real, or that someone just forgot to update that copy (which still wouldn't bode well for their QA process...)
    Post edited by Alex on
  • Luke BurrageLuke Burrage
    I think there's a way that you could de-duplicate data after it was encrypted, it just means that the same file must have the same decryption key... and MegaUpload doesn't have that key. Two users will have the same key to the same data file, but that would be fine, right?
  • trogdor9trogdor9
    I think there's a way that you could de-duplicate data after it was encrypted, it just means that the same file must have the same decryption key... and MegaUpload doesn't have that key. Two users will have the same key to the same data file, but that would be fine, right?
    How would Mega know to give both users the same private key? All encryption and decryption is done by the client.
  • Luke BurrageLuke Burrage
    I think there's a way that you could de-duplicate data after it was encrypted, it just means that the same file must have the same decryption key... and MegaUpload doesn't have that key. Two users will have the same key to the same data file, but that would be fine, right?
    How would Mega know to give both users the same private key? All encryption and decryption is done by the client.
    I can think of many ways that could be done, but none of them would be good practice, or at least not off the top of my head.
  • Dragonmaster LouDragonmaster Lou
    edited January 2013
    The fact that it would require identical files is iffy too at best. Identical file deduplication really isn't that hot. What you really want is some sort of sub-file deduplication, like at the byte or block level. Otherwise just a one byte difference could theoreticaly break your entire deduplication algorithm (though one could conceive of an algorithm that does allow for small deltas between files without being a total byte-level deduplication algorithm).

    FYI, I work in deduplication, so I have some familiarity with the subject.
    Post edited by Dragonmaster Lou on
  • HMTKSteveHMTKSteve
    Maybe they are using real small blocks?
  • AprecheApreche
    edited January 2013
    Maybe they are using real small blocks?
    That's incredibly inefficient because the cost of storage is much lower than the cost of CPU and memory. There's really no reason to give them the benefit of the doubt. The odds of them fucking up are much greater than the odds of them being intelligent cryptologists.
    Post edited by Apreche on
  • Luke BurrageLuke Burrage
    Like I said, none of the ways it could be done in a practical way without MegaUpload having access to the decrypt keys, which I thought was the point of this new version.
Sign In or Register to comment.