Hacker News Reader

Comment by politician | Hacker News Reader

"A node token ("magic cookie") grants access to a subtree of the issuing user's filesystem. An associated symmetric key is required to decrypt and/or store decryptable data."

https://mega.co.nz/#developers

Apparently, they use unsalted symmetric key encryption which allows them to discover [hash(file), password] duplicates. By comparison, the old Megaupload would apparently deduplicate based on [hash(file)] matches.

Suppose Alice and Bob have files [D, E, F] and [F, G, H], respectively. If MEGA discovers that Alice and Bob share a duplicate file F and Alice to reveals her password (through password frequency analysis or to the Government), then all of Bob's files are compromised.

I would personally feel unsafe storing private documents on Mega due to the lack of public/private key encryption, but that's me.

View on HN

> I would personally feel unsafe storing private documents on Mega due to the lack of public/private key encryption, but that's me.

It is probably worth pointing out that all of this encryption stuff is only for them. Nomatter how they brand it, the purpose is to give them plausible deniability, which they lacked with the previous Mega.

If you want encryption meant for you, then you should probably just encrypt your files yourself before you let Mega touch them.

It's pretty embarrassing that tech blogs are even covering this. Copyright law is about intent, not about technical specifics. The idea that new megaupload is ok because it encrypts illegitimate content before storing it is absurd.

What do you mean by "ok"?

Morally ok? That is subject to opinion. I don't have a problem with them now, and I never did.

Legally immune? They very well could be. Certainly any action against them is going to be much harder this time, if only because a bunch of people in New Zealand are still pissed about what happened last time without the revisions that were made. If their system works as they claim, and renders them unable to govern content, then how could they be considered culpable for content? If I start posting nasty stuff encrypted with PGP to HN, would HN be to blame for failing to recognize the nasty stuff and remove it?

As soon as a file goes public and anybody can get it, then it seems to me irrelevant that its encrypted on mega servers. They'll have to respond to takedown requests because the contents are known.

And if mega is de-duping content then that could technically eliminate "whack a mole" for the copyright holders (except for people re-encoding the file and re-uploading). I had heard in the past that mega would only take down one link.

> They'll have to respond to takedown requests because the contents are known.

And presumably, unless they think they can legally get away with ignoring it, they will.

What they won't be able to do is respond to a request that says "Delete all copies of [Big movie of the year], and continue to delete all of our movies as they pop back up."

As long as it's the same file, they will be able to do precisely that.

> And presumably, unless they think they can legally get away with ignoring it, they will.

I feel like a goddamn broken record.

If they did it correctly then they would keep a reference count to that the stuff only gets deleted when the last reference to it gets deleted.

It would kind of function like hard links on linux file systems.

> As soon as a file goes public

This is the important bit. Files can be shared between private groups, using Mega as an intermediary, without them ever becoming indexed on the public web. Previously, files shared in this manner could still be a target of a takedown, because Megaupload would know they had them, even if nobody else did. Now Mega can make a stronger guarantee about keeping this kind of sharing "safe", because they have no idea whether they're hosting this kind of file or not.

I would think this type of sharing would not be as much of a concern for copyright holders since a private group is not really mass distribution.

As soon as the sharing group got big enough to notice, then there could be agents in the group reporting infringement.

Tell that to the valid copyright holders hosting their content on MegaUpload. Regardless of whether the system is used for legal or infringing purposes, the reality is that distribution companies have the ability to take down both when they claim some are using it to infringe. The concern for copyright holders is not the encryption per say, but the ability for big business to NOT be able to take down their legal content under the guise of a moral cause.

I dont think the content can be accessed by mega without the full URL. The URL probably contains the information about the location of the data plus a passphrase to unlock the key to decrypt the data. In this way mega could hold the data without knowing the URL to access and decrypt it. The full URL would only be retrievable through the user interface, which mega would not have access to unless their servers are storing your login password. Which I assume they are not for legal reasons. I am making assumptions here.

However you feel about copyright, profitting off of the distribution of other peoples work, without their permission, is not something that should be encouraged or tolerated.

Roughly speaking I agree with you, but where do you draw the line? If I download a movie illegally right now then chances are Google and Firefox are immediately benefiting from it, and then even further away are Microsoft (OS), hardware manufacturers, etc. who profited off enabling me to do this.

Is the line about intent rather than technicality? For example how driving a bus that a drug dealer is on is not illegal, but driving the getaway car from a robbery is? If it is, then how does one prove that Dotcom wants to support copyright violation, rather than his official stance of just believing that there is a level past which he can not be expected to police his customers?

What, in the same way that manufacturing syringes that will be used to mainline illegal narcotics should not be "encouraged or tolerated"?

It takes some twisted logic to think thats a valid analogy. Dropbox is a perfectly valid filehosting service because they take reasonable measures to prevent copyright infringement. Megaupload(and mega) is not, because it's run by a person who has no real interest in preventing copyright infringement, and has shown that he's more than willing to profit off it, while he pretends that he doesn't know it's occurring or can't prevent it.

Define 'reasonable measures'. People use Dropbox to share copyrighted material all the time. Ditto S3, gmail, external hard drives, and any file storage method in existence.

Enforcement of the standard you're promoting would require pervasive surveillance of every data storage and transfer method in the world, and backdoor access for all forms of encryption.

Freedom of information and communication is orders of magnitude more important for a healthy and free society than copyright of digital goods, and you can't have both--they are fundamentally incompatible.

Arguing against piracy on the internet is a giant waste of my time because if you have it in your head that piracy is "good" or "ok" then you will rationalize bad arguments all day defending an incorrect position.

To address your latest spurious post, dropbox, gmail, etc. Facilitate file sharing on a small scale. Public links to megaupload listed on public aggregating websites that list the latest 'releases' are an entirely different matter. You obviously know that but are willfully blind to it to make stupid arguments.

No, you are taking a childish view of the defenders of piracy.

Let's say you are right. Explain to me how you would justify the pricing scheme we have for digital media to the average person on this planet, who most likely is Indian/Chinese/Nigerian and makes less that $5 a day.

How much should we charge this individual? Do you think they have the same right as westerners to challenging themselves and experiencing other cultures?

No, you assume that piracy is only white people that don't have a large allowance, which is a childish view perpetuated by the media. Most people don't have a computer, and if they are lucky enough to get one they should be able to have access to a large variety of the same digital goods.

tl;dr show some goddamn empathy.

Don't you have it in your head that danenania's position is incorrect and it's therefore a waste of time to argue the subject with you? It certainly seems so, specially since danenania isn't actually arguing for piracy, just that (s)he considers the steps of eliminating piracy to go against more important values.

As an analogy, the fact that I defend almost absolute free speech doesn't mean I'm in favor of all speech, it just means that eliminating said speech is worse than allowing it to exist freely.

First of all, MegaUpload did take preventative measures, at least that is what they argue. It's clear you don't understand how dangerous it is to take down the provider for a users actions.

Twisted logic? Many organizations distribute syringes explicitly for heroin.

Next you're going to be telling me they make pipes for smoking marijuana. Call me when you start making sense.

> However you feel about copyright

Hm. This makes it sound like your point stands regardless of personal ethics; as though

> profitting off of the distribution of other peoples work, without their permission, is not something that should be encouraged or tolerated

is a provable, obvious, non-debatable stance. I don't think it is.

I don't think profiting off it changes the basic ethics; if something is morally okay to do as a hobby, it should generally be morally okay to do as a business until proven otherwise.

I wouldn't agree you always need the permission of someone upstream to share ideas or content. That's something we can discuss. Don't make it sound like you have the answer sheet in front of you.

Congratulations, you've just made criminals of Google.

Because clearly they profit off the distribution of other peoples work without their permission every day.

Gmail shows me ads related to the content of my email. Worse, it shows ads related to the content of emails sent by my friends and family.Some of which have no relationship or agreement with Google. Google does this to maximize advertising revenue. Google is profiting off the original works of my friends and family without their permission and provides them absolutely nothing in return. Now you may complain about the moral and ethical practice of distribution rights. But sharing with people you know is not distribution. Most countries have different laws for sharing then distribution. In my country it is naturally legal to share music and other recorded content. Your country may convince you that this immoral, but in the natural sense, sharing is never immoral. In fact it is compassion.

No artist is ever paid when Vevo displays an artists music video on Vevo. Yet, google pays artists who post their own work. That means Gangnam Style has probably make over a million dollars from advertising on Youtube. So who is stealing more? The distributors or Google. The answer is: they are all stealing. The largest portion always goes to the content manager. Pulling distribution from the hands of companies and putting it back into the artist control will see a much fairer distribution of wealth. Thus the conflict and artificial moral discussions we see pushed from media about this. Sharing is a moral act.

> However you feel about copyright

What do you have to say to those of us who disagree completely and fully with the entire concept of intelectual property?

With the way I feel about copyright, I believe distribution of other peoples work, with permission or otherwise is something that should be actively encouraged and praised.

Whether they profit off of it or not is completely irrelevant.

Copyright law can absolutely hinge on technical specifics. Look at network DVR services being forced to store a copy of a show per user in order to be found legal in the US.

Yeah, or the fact that Aereo has one antenna per user,

In order to maintain the plausible deniability, Mega cannot store an decryption passphrase. Meaning they will not have the links to the unencrypted files. As the URL will contain the passphrase within it. The only thing required to make this private is to plug a Tor hidden service onto the front end. That way the direct link to the data is not known by the download user and Mega will not store this link without losing plausible deniability. Win win. Bad part is that all downloads now have to go through Tor (slow).

I'm not entirely sure what they mean by a "magic cookie" here.

The document does say it uses public/private keys for data transfer. You would not usually use public/private for data storage because of the huge keysizes required.

I think the cookie bit is just an authorization credential.

If they use asymmetric encryption for data transfer, then how does that work as part of a convergent encryption scheme? Wouldn't all of the file hashes be different at that point?

I would assume the asymmetric crypto is just for the transfer. In other words you encrypt the data and then send it wrapped in another layer of public/private crypto. Not entirely sure though.

To be fair, if there's any chance that your password is the same as someone else's, then you have a terrible password.

Unfortunately for a lot of mundane (non hacker) users, this is very likely.

Reply on news.ycombinator.com