MEGA may have MEGA security issues??????

For those of you who are living under a rock, Kim Dotcom launched his new file-sharing website this past weekend called MEGA. It supposedly provides 50GB of FREE online storage with encryption capabilites.

The encryption "is less then ideal", according to Allan Woodward, from the Department of Computing at the University of Surrey. It's because it is all done through Javascript within a web-browser, which means that anyone who can break the SSL encryption on Mega could get a hold of the keys. The SSL encryption being used is only 1024-bit encryption, which can be broken easier then say 2048-encryption which is viewed as best-practice amoungst security experts.

Deduplication is another area of a possible security vulnerability. Deduplicaion of encrytped data requires that information to be decrypted, repackaged and then encrytped again. Basically this means that the files have the opportunity to be seen by someone if there was a man in the middle at which point the data was in the process of being decrypted and then repackaged and encrypted again.

Mega also uses Javascript's pseudorandom-number generator to produce keys which is also an issue as it is a method known to be predictable.

Last but not least is that currently a user has no way to recover their account if they forget their password. Mega has promised to let users reset passwords soon. So if you lose or forget your password, say goodbye to your files regardless of the level of encryption.

Keeping in mind all the security issues I have listed above, will you still use Mega to house your files? I am still undecided on whether I want to use the service and if I do, what files I may store there.

-Ubu out

Kim Dotcom's launches new file-sharing site, MEGA

A year ago today the popular file sharing website Megaupload.com was shutdown by the United States  Department of Justice following the indictment and arrests of the owners for allegedly operating as an organization dedicated to copyright infringement.

Today Kim Dotcom, legal name being Kim Schmitz, has launched a new file-sharing site, called Mega. It's located HERE but currently I couldn't access it as it's being pounded by users. He tweeted out that he has already had 100,000 new user accounts created within the first hour.

It will provide a cloud file system, including cross-account folder sharing for easy online collaboration. The Mega service encrypts and decrypts you data transparently in your browser, on the fly. High speed parallel batch uploading and downloading with resume capability are key features of the site. Thanks to encryption, Mega can connect a large number of hosting partners around the world without worrying about privacy breaches. Everyone can go to Mega to sign up and use the service, with a basic, free offering of 50GB of storage, plus three pricing tiers with additional storage and bandwidth capacity.

I myself don't condone using pirated software, movies, or music but that's not the only use of a site like this. Will you create an account and use this new service?

-Ubu out