Hacker News Reader

Comment by max_ | Hacker News Reader

I have always used Mega[0]. It's real end to end encryption. I would argue it also has a superior user experience across all the others.

[0] https://mega.nz/

View on HN

I remember meeting with KimDotCom lawyer a few years ago in SF. A very flamboyant-person. One of those guys who makes a big impression on you from the first sight.

While KimDotCom is an impressive hacker, I am not sure that I would love to be the target of the FEDs around the world as he is still in the eye of the US.

Fun story about MegaUpload.

I once lived in Argentina back in the MegaUpload days. At the time, piracy was the norm (not only in Argentina), the gov didn't care, and people where selling pirated, burned DVD on the streets. This was a downtown, a high transited area.

Then MegaUpload started to grow like fire, and I remember that starting at 4 pm, the internet would get awfully slow. As people get off their jobs to download the latest movie or episode out there. Then PopcornTime, and things got even worst. Cant find the stat, but I remember something along the line of 60% of Buenos Aires traffic being MegaUpload's at peak time (4-10pm), which caused a lot of controversy at the time.

Old days...

> Old days…

Here in New Zealand we are only just finishing tidying up the fallout from the Dotcom fiasco now. Shame on us.

https://en.m.wikipedia.org/wiki/Kim_Dotcom

Mega and Stingle are the only options I'm aware of that are "truly" private, and every other major cloud storage provider will scan your files for CSAM. The best way forward for truly privacy conscious people would be to roll their own NextCloud instance, because any public service that allows you to store E2EE images will get hunted by the Government for allowing CSAM if they reach any significant userbase. Case in point, even good ol' MegaUpload scanned for CSAM, because that's a bigger risk than getting sued by the MPAA.

Dumb question but would an S3 bucket be scanned by CSAM?

Ehh idk seems like a dumb concern/losing battle. My thing is about IP. I picked up this e-ink tablet and it syncs to their cloud service for example. Which you can stop but still... Ahh. Just feels like going in circles, ISP knows your content, VPN, is your device actually secure, etc... Do you have anything to hide anyway.

I'm probably just paranoid ha I question using Trello putting "new IP" into it which they say is encrypted at rest so yeah. Gmail too like everything goes through that.

Anyway I'm average intelligence not developing cold fusion or something on my spare time so I don't really have IP anyway.

Here's an idea, a piece of paper and a pencil.

An s3 bucket will give you back an ETAG header for each file it holds, which is more or less the MD5 of a set of chunks that make up the file.

You can use that to identify files.

Only if the file is not uploaded via a multipart upload, which all SDKs do for any files larger than a megabyte.

If the object is encrypted with KMS, which almost everything is, then the hash is the encrypted contents and not the original contents.

> Dumb question but would an S3 bucket be scanned by CSAM?

Maybe, but if you E2EE it can't detect anything, anyway. (Please don't take this as an endorsement of child porn) NextCloud has preliminary E2EE support built in, but not for photos - yet.

Tresorit? Excellent app, speed, features, and Switzerland zero knowledge encryption. Also supports camera uploads as key feature for mobile.

> I have always used Mega[0]. It's real end to end encryption. I would argue it also has a superior user experience across all the others.

I'm still waiting for it to suffer the same fate as MegaUpload. The reputation has the service tarnished. I don't care that everything's encrypted with Mega - They could still sneak in backdoors or skeleton keys. Plus it needs Javascript to work, which is a privacy nightmare.

Thanks for mentioning this! It turns out that that I have an account from 2014 that has 50GB instead of the 20GB offered now in the free tier. To those interested in very basic photo viewing: the Mega apps are more than capable of sorting by the actual date when the photos were taken, which is all that I was really interested in. The web interface doesn't seem to have this at a glance.

What we need is transparent encryption at rest, where only you have the keys.

By the way, do they scan for CSAM?

They couldn't even if they wanted. Due to the encryption

They could on device.

except if the key to its encrypted-at-rest hard drive is not used to do encrypting/decrypting on same CPU as it’s hard drive (that being, done remotely)

Reply on news.ycombinator.com