[Dismas]

MEGA is able to decrypt your files. Wouldn't have assumed otherwise.

Research published on Tuesday shows there's no truth to the claim that Mega, or an entity with control over Mega's infrastructure, is unable to access data stored on the service. The authors say that the architecture Mega uses to encrypt files is riddled with fundamental cryptography flaws that make it trivial for anyone with control of the platform to perform a full key recovery attack on users once they have logged in a sufficient number of times. With that, the malicious party can decipher stored files or even upload incriminating or otherwise malicious files to an account; these files look indistinguishable from genuinely uploaded data.

"We show that MEGA's system does not protect its users against a malicious server and present five distinct attacks, which together allow for a full compromise of the confidentiality of user files," the researchers wrote on a website. "Additionally, the integrity of user data is damaged to the extent that an attacker can insert malicious files of their choice which pass all authenticity checks of the client. We built proof-of-concept versions of all the attacks, showcasing their practicality and exploitability."

Read More: https://arstechnica.com/information-tech...otherwise/

[mothered]

Why am I not surprised?

This Is a prime example of why you should never trust cloud storage - you don't know what happens behind closed doors.

[Bro587]

That’s cool lowkey and fairly interesting

[Boudica]

Why am I not surprised?

This Is a prime example of why you should never trust cloud storage - you don't know what happens behind closed doors.

No form of data storage is without it's risks one way or another. It would be best to consider those risks before using any services.

[Dismas]

Why am I not surprised?

This Is a prime example of why you should never trust cloud storage - you don't know what happens behind closed doors.

I'd argue the same goes for any service. A service can advertise itself as "logless" or "encrypted", but there's plenty of cases where services have lied.

[mothered]

I'd argue the same goes for any service.

Absolutely.

I've always remained firm to never trust a VPN provider that claims to have a no log policy. IPVanish Is certainly guilty of storing and handing over logs to the authorities.

IPVanish is a well-regarded US-based VPN company that has always claimed to have a strict no logs policy. It seems this was a lie. It's evident that IPVanish were keeping logs although they claimed to have a"zero logs” policy.

[sn1ph3r]

mega can certainly decrypt the files on their premise. the next question is how long will it take for them (mega) to decrypt the files hosted on their resources.

[porcaddio]

Why am I not surprised?

This Is a prime example of why you should never trust cloud storage - you don't know what happens behind closed doors.

I'm not surprised either.

Cloud = files will never be "yours"

[wtf3421]

I never trusted the mega brand again after the pressure on kim....

[richbuttface1263]

I would certainly be encrypting my files locally before uploading them to mega for sharing.