Consider Mega.nz #496

New Issue

2018-07-23T11:44:57Z

Raviu8 commented

2018-07-23 11:44:57 +00:00

(Migrated from github.com)

Hi,
Is there any reason mega.nz is not listed?
I've search the issues and couldn't find any thing related. Some posts on reddit however mentions that it has been listed previously on your list.
It's also listed on your other repo : privacy respecting.
For what I know all their software is open source and could be found on
https://github.com/meganz
There have file sharing, chat and other very useful features, all are encrypted end-to-end - per their statement.
I am not actually promoting it but just wondering as a user. So if you have reasons against it, I'd be happy to know them to be careful.

Hi, Is there any reason mega.nz is not listed? I've search the issues and couldn't find any thing related. Some posts on reddit however mentions that it has been listed previously on your list. It's also listed on your other repo : privacy respecting. For what I know all their software is open source and could be found on https://github.com/meganz There have file sharing, chat and other very useful features, all are encrypted end-to-end - per their statement. I am not actually promoting it but just wondering as a user. So if you have reasons against it, I'd be happy to know them to be careful.

👍 3 👎 2

Strappazzon commented

2018-07-23 15:17:05 +00:00

(Migrated from github.com)

Dotcom told [...] that he no longer had any involvement in Mega, after the company suffered "a hostile takeover by a Chinese investor who is wanted in China for fraud". [...] those shares were then seized by the New Zealand government [...] "Which means the NZ government is in control. [...]

https://www.wired.co.uk/article/kim-dotcom-mega-3
https://yro.slashdot.org/story/15/07/27/200204/interviews-kim-dotcom-answers-your-questions
https://old.reddit.com/r/privacy/comments/7y26sy/is_meganz_still_secure_and_private/duehbw5/
https://old.reddit.com/r/privacy/comments/7f8pe5/how_is_meganz_in_terms_of_privacy/

> Dotcom told [...] that he no longer had any involvement in Mega, after the company suffered "**a hostile takeover by a Chinese investor** who is wanted in China for fraud". [...] those shares were then seized by the New Zealand government [...] "**Which means the NZ government is in control**. [...] https://www.wired.co.uk/article/kim-dotcom-mega-3 https://yro.slashdot.org/story/15/07/27/200204/interviews-kim-dotcom-answers-your-questions https://old.reddit.com/r/privacy/comments/7y26sy/is_meganz_still_secure_and_private/duehbw5/ https://old.reddit.com/r/privacy/comments/7f8pe5/how_is_meganz_in_terms_of_privacy/

megasteph commented

2018-07-24 09:13:33 +00:00

(Migrated from github.com)

https://mega.nz/blog_40 - April 2016
Worried about Kim Dotcom’s tweet concerning MEGA?
We don’t know why Mr Dotcom would want to make negative comments about the company he co-founded, but we do know that he is factually incorrect. MEGA has significant funding and strong support from shareholders, so its financial position is sound.

This year, MEGA has already committed 24 PB additional storage capacity to service our 40 million registered users, and we will continue that expansion. MEGA users are able to pay subscriptions through a variety of methods, depending on their country of residence.

MEGA continues to experience strong growth, which illustrates global appreciation of the quality of its services.

Mr Dotcom resigned as a director of MEGA in August 2013 so he could pursue his political ambitions with the Internet Party. That endeavour badly damaged his credibility with the New Zealand public.

His family trust sold a significant proportion of its original shareholding in MEGA, releasing many millions of dollars. In 2015 the family trust twice subscribed for new shares in MEGA. In December 2015 Mr Dotcom applied to the New Zealand Court for approval to personally borrow $0.7 million for his family trust to subscribe for further shares in MEGA. The Court declined approval. Since then he has made negative comments about MEGA that have no factual basis.

It is good practice to have a backup of your files but we strongly disagree with Dotcom's scaremongering. If you follow his tweets about ‘MegaNet’ you may have less confidence in his predictions:
January 2014: “Coming in 2014”
July 2014: ‘MegaNet’ is coming in 2015
December 2014 Launching in 2016
June 2015: ‘MegaNet’ details will be revealed and equity will be available via crowd funding on 20 Jan 2016

https://mega.nz/blog_40 - April 2016 _Worried about Kim Dotcom’s tweet concerning MEGA?_ We don’t know why Mr Dotcom would want to make negative comments about the company he co-founded, but we do know that he is factually incorrect. MEGA has significant funding and strong support from shareholders, so its financial position is sound. This year, MEGA has already committed 24 PB additional storage capacity to service our 40 million registered users, and we will continue that expansion. MEGA users are able to pay subscriptions through a variety of methods, depending on their country of residence. MEGA continues to experience strong growth, which illustrates global appreciation of the quality of its services. Mr Dotcom resigned as a director of MEGA in August 2013 so he could pursue his political ambitions with the Internet Party. That endeavour badly damaged his credibility with the New Zealand public. His family trust sold a significant proportion of its original shareholding in MEGA, releasing many millions of dollars. In 2015 the family trust twice subscribed for new shares in MEGA. In December 2015 Mr Dotcom applied to the New Zealand Court for approval to personally borrow $0.7 million for his family trust to subscribe for further shares in MEGA. The Court declined approval. Since then he has made negative comments about MEGA that have no factual basis. It is good practice to have a backup of your files but we strongly disagree with Dotcom's scaremongering. If you follow his tweets about ‘MegaNet’ you may have less confidence in his predictions: January 2014: “Coming in 2014” July 2014: ‘MegaNet’ is coming in 2015 December 2014 Launching in 2016 June 2015: ‘MegaNet’ details will be revealed and equity will be available via crowd funding on 20 Jan 2016

megasteph commented

2018-07-24 09:15:09 +00:00

(Migrated from github.com)

https://mega.nz/blog_46 - January 2018
1,826 days, 100 million registered users, 40 billion encrypted files. A lot has changed in the 5 years since MEGA first booted on 20 January 2013, offering users 50 GB of free storage and a breakthrough encryption system. While encryption has been widely available for many years, most systems remain complex and difficult to use. MEGA’s simple implementation, where files are encrypted and decrypted within the user’s browser, is still unique 5 years later.

https://mega.nz/blog_46 - January 2018 1,826 days, 100 million registered users, 40 billion encrypted files. A lot has changed in the 5 years since MEGA first booted on 20 January 2013, offering users 50 GB of free storage and a breakthrough encryption system. While encryption has been widely available for many years, most systems remain complex and difficult to use. MEGA’s simple implementation, where files are encrypted and decrypted within the user’s browser, is still unique 5 years later.

Raviu8 commented

2018-07-24 09:19:38 +00:00

(Migrated from github.com)

@megasteph Has mega.nz software been independently audited?
Actually, I don't reject the huge user base of mega - and growing. But remember google has too much more.
Security and privacy should be supported by technical facts, not by market share.

@megasteph Has mega.nz software been independently audited? Actually, I don't reject the huge user base of mega - and growing. But remember google has too much more. Security and privacy should be supported by technical facts, not by market share.

👍 1

Raviu8 commented

2018-07-24 09:26:24 +00:00

(Migrated from github.com)

Are all types of data & communications on mega encrypted in way that even mega cannot access?
Or just the files?
I mean data like sessions, shares, contacts, chat data and meta data, audio and video communication?
"Whom, when, how and what?" Are all those pieces of info. encrypted that even mega cannot spy on?

Are all types of data & communications on mega encrypted in way that even mega cannot access? Or just the files? I mean data like sessions, shares, contacts, chat data and meta data, audio and video communication? "Whom, when, how and what?" Are all those pieces of info. encrypted that even mega cannot spy on?

ghost commented

2018-07-24 09:29:26 +00:00

(Migrated from github.com)

You can't even know the files are encrypted, but that's with any provider. So you either have to self-host or trust some company. The question is whether MEGA is trustworthy.

👍 1

Raviu8 commented

2018-07-24 09:33:23 +00:00

(Migrated from github.com)

@Shifterovich I think as they say that data is encrypted client side, and the client software is open source, you can know that files are encrypted, not you?

ghost commented

2018-07-24 11:00:54 +00:00

(Migrated from github.com)

Well, true. You can know that you sent the files to the server in an encrypted form. But stealing your key isn't hard, especially in a browser. And if we talked about receiving encrypted files, just because your open source client receives encrypted files doesn't mean they are stored encrypted.

megasteph commented

2018-07-25 08:17:08 +00:00

(Migrated from github.com)

The files are sent to Mega in encrypted form, and the code is public so we can see that they aren't stealing the key, SO Mega can't decrypt. The files are certainly received and stored in encrypted state.

megasteph commented

2018-07-25 08:24:43 +00:00

(Migrated from github.com)

Raviu8:
Some data must be stored without user encryption so Mega can operate functions such as shares, chat, email comms etc.
Mega's Privacy Policy is being updated shortly. It will specify that the following account data is stored without user encryption. The reason is obvious when you consider the type of data:
"- browser type and operating system of the devices from which you have logged in to Mega;

IP address and port information for logins, API usage, file uploads, folder creations and link exports;
The country that we expect you are accessing our services from (inferred by matching your IP address to a public IP address database);
File sizes, versioning order, timestamps and parent-child file relationships;
Deletion timestamps;
The email address of anyone you have specifically made a contact using Mega's systems. Note that your files and folders can be shared privately by invitation to specified email addresses or shared more generally by creating a file or folder link and decryption key;
Contact email addresses of chat participants, chat commencement time and chat duration, and moderation activity
Takedowns and account suspensions;
Our communications with you;
Your personal account settings, including any avatar picture."

Raviu8: Some data must be stored without user encryption so Mega can operate functions such as shares, chat, email comms etc. Mega's Privacy Policy is being updated shortly. It will specify that the following account data is stored without user encryption. The reason is obvious when you consider the type of data: "- browser type and operating system of the devices from which you have logged in to Mega; - IP address and port information for logins, API usage, file uploads, folder creations and link exports; - The country that we expect you are accessing our services from (inferred by matching your IP address to a public IP address database); - File sizes, versioning order, timestamps and parent-child file relationships; - Deletion timestamps; - The email address of anyone you have specifically made a contact using Mega's systems. Note that your files and folders can be shared privately by invitation to specified email addresses or shared more generally by creating a file or folder link and decryption key; - Contact email addresses of chat participants, chat commencement time and chat duration, and moderation activity - Takedowns and account suspensions; - Our communications with you; - Your personal account settings, including any avatar picture."

megasteph commented

2018-07-25 08:35:03 +00:00

(Migrated from github.com)

Raviu8:
Agree - market share is interesting but not indicative of security. Mega is proud of both!
January 2017 Mega reported:
"MEGA supports the safety and security of individuals, companies and governments by providing tools, technologies and services relying on the inherent integrity and security of correctly implemented user-controlled end-to-end encryption. To provide full assurance of that integrity and correctness, we are disclosing the source code of all relevant components. We welcome reviews by independent security researchers to confirm that there are no backdoors in the MEGA systems and that the cryptographic processes are appropriate and reliable. We also invite security researchers to verify that the binaries that can be downloaded from our website and from app stores are built from our published source code with no alterations.
SDK code has been posted on GitHub since 2014, web client code, Firefox and Chrome extension code and MEGAsync code since 2016. Now we have published the code for Android, iOS and Windows Phone apps. Please send comments to crypto@mega.nz "

Mega software has been independently reviewed by many security experts who have reviewed the public code and tried to find vulnerabilities.

As reported in https://mega.nz/blog_46 "MEGA offers a vulnerability bounty and paid out a total of
EUR 15,000 for some minor vulnerabilities that were reported between 2013 and 2016. However, MEGA’s brute-force challenge, issued in February 2013, hasn’t been claimed and we are confident it never will be!"

Raviu8: Agree - market share is interesting but not indicative of security. Mega is proud of both! January 2017 Mega reported: "MEGA supports the safety and security of individuals, companies and governments by providing tools, technologies and services relying on the inherent integrity and security of correctly implemented user-controlled end-to-end encryption. To provide full assurance of that integrity and correctness, we are disclosing the source code of all relevant components. We welcome reviews by independent security researchers to confirm that there are no backdoors in the MEGA systems and that the cryptographic processes are appropriate and reliable. We also invite security researchers to verify that the binaries that can be downloaded from our website and from app stores are built from our published source code with no alterations. SDK code has been posted on GitHub since 2014, web client code, Firefox and Chrome extension code and MEGAsync code since 2016. Now we have published the code for Android, iOS and Windows Phone apps. Please send comments to crypto@mega.nz " Mega software has been independently reviewed by many security experts who have reviewed the public code and tried to find vulnerabilities. As reported in https://mega.nz/blog_46 "MEGA offers a vulnerability bounty and paid out a total of EUR 15,000 for some minor vulnerabilities that were reported between 2013 and 2016. However, MEGA’s brute-force challenge, issued in February 2013, hasn’t been claimed and we are confident it never will be!"

ghost commented

2018-07-25 13:29:52 +00:00

(Migrated from github.com)

SO Mega can't decrypt

If it's in browser, they can just send you JS that makes your browser hand the key over to them.

Using a desktop version that you trust with restricted updates works.

> SO Mega can't decrypt If it's in browser, they can just send you JS that makes your browser hand the key over to them. Using a desktop version that you trust with restricted updates works.

Raviu8 commented

2018-07-25 20:23:14 +00:00

(Migrated from github.com)

@megasteph Fair enough. Thanks

Raviu8 commented

2018-07-25 20:30:15 +00:00

(Migrated from github.com)

@megasteph So does mega save session history information including IP address and other identifying info.? Or just for the current active sessions?

megasteph commented

2018-07-26 00:35:27 +00:00

(Migrated from github.com)

Session history is stored

👍 1

hiragashi commented

2018-07-27 20:58:06 +00:00

(Migrated from github.com)

just google Zhao Wu Shen and figure out why you want to stay far away from MEGA. 5th most wanted Chinese fraudster https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=11340807

megasteph commented

2018-07-30 00:23:40 +00:00

(Migrated from github.com)

Shen has no involvement with Mega.
Yan has settled his issues with the NZ and Chinese government.
Mega is backed by 16 private investors so hiragashi 's comment is irrelevant.

Shen has no involvement with Mega. Yan has settled his issues with the NZ and Chinese government. Mega is backed by 16 private investors so hiragashi 's comment is irrelevant.

Mikaela commented

2019-04-15 10:52:45 +00:00

(Migrated from github.com)

I guess this can be closed as there wasn't clear concencus that it should be recommended and there haven't been comments in a long time.

This repo is archived. You cannot comment on issues.