bluegate010

Hey HN, I'm one of the authors on this paper. It's been making the rounds on Reddit [1] and most recently Buzzfeed [2] so I thought I'd post it here. I'm happy to answer any questions.

[1] https://www.reddit.com/r/crypto/comments/3r4q1c/why_johnny_s... [2] http://www.buzzfeed.com/josephbernstein/you-probably-cant-en...

Yeah, it's self-referencing, but it's called just before being passed into setInterval. Here's a screenshot: http://i.imgur.com/oh84ZLV.png

I've got the same problem: Version 30.0.1599.101 Chrome on Mac OS X Mavericks.

I believe the problem is your time() method on line 189 of script.js; there's no element with id "time".

That's what Mega seems to be doing in their initAll() function, although since it's being audited with Javascript, it's still insecure.

Agreed. Very sloppy code.

The Javascript for Mega looks very messy; all resources loaded via XHR, loading jQuery but using `document.getElementById` all over the place, using client-side Javascript to validate the integrity of all these XHR-loaded resources...

They say that this is their first Javascript coding; they should really get some talent on board to clean this up.