Why Mega will change the status quo

filosottile.github.com

47 points·FiloSottile··7 comments

It seems like all of our personal communications should be encrypted so that only the intended receiver(s) would be able to read the message or file.

Sometimes I wonder why services like Gmail don't bake encryption into their product and I can only assume that is because of the need to power contextual ads and to service government inquiries.

Perhaps Mega will change the standard and make more people think "why isn't my email sent and stored in an encrypted fashion out-of-box?"

Spam filtering and search are less cynical reasons for allowing Gmail to see the plaintext of your messages.

Search could work just fine with a client-side generated (Google hosted) encrypted index.

Spam Filtering is a big one though.

Most people don't realize that 98% of emails are spam. The spam that finds its way to your spam folder is only a tiny tiny fraction of the spam that was sent to you. The only reason that spam got through is because of the off chance that it might not be spam.

Hushmail does so, but, beyond the issues you cited, there is the issue of crypto-code-served-by-your-host. They can be forced to backdoor the client JS code and you wouldn't notice (this, btw, happened with Hushmail).

The crypto is even stronger than the author states: the linked "JavaScript Crypto is Doomed" article only refers to JavaScript delivered over HTTP. Mega appears to be entirely HTTPS, which is (relatively) secure.

More secure, surely, but one can (and should) distrust CAs, and there are other caveats explained in that article.

However, I think that none of these issues apply to the piracy fighting threat model.

What they're doing is actually pretty clever. It might not be such a sensational title after all.

Reply on news.ycombinator.com