Quote:Research published on Tuesday shows there's no truth to the claim that Mega, or an entity with control over Mega's infrastructure, is unable to access data stored on the service. The authors say that the architecture Mega uses to encrypt files is riddled with fundamental cryptography flaws that make it trivial for anyone with control of the platform to perform a full key recovery attack on users once they have logged in a sufficient number of times. With that, the malicious party can decipher stored files or even upload incriminating or otherwise malicious files to an account; these files look indistinguishable from genuinely uploaded data.

"We show that MEGA's system does not protect its users against a malicious server and present five distinct attacks, which together allow for a full compromise of the confidentiality of user files," the researchers wrote on a website. "Additionally, the integrity of user data is damaged to the extent that an attacker can insert malicious files of their choice which pass all authenticity checks of the client. We built proof-of-concept versions of all the attacks, showcasing their practicality and exploitability."

(06-23-2022, 10:06 AM)mothered Wrote: Why am I not surprised?

This Is a prime example of why you should never trust cloud storage - you don't know what happens behind closed doors.

(06-23-2022, 10:06 AM)mothered Wrote: Why am I not surprised?

This Is a prime example of why you should never trust cloud storage - you don't know what happens behind closed doors.

(06-26-2022, 04:42 AM)Dismas Wrote: I'd argue the same goes for any service.

Quote:IPVanish is a well-regarded US-based VPN company that has always claimed to have a strict no logs policy. It seems this was a lie. It's evident that IPVanish were keeping logs although they claimed to have a"zero logs” policy.

(06-23-2022, 10:06 AM)mothered Wrote: Why am I not surprised?

This Is a prime example of why you should never trust cloud storage - you don't know what happens behind closed doors.