News for hackers. Stuff that matters.

A comment on Even when told not to, Windows 10 doesn't stop talking to Microsoft. Parent comment

Re:Even when told not to, Windows 10 doesn't stop talking to... by kuschku on Friday August 14, 2015 @10:19AM (#10060211)
As you’ve probably seen with MEGA, this does not protect the site at all.

Take Megaupload (not MEGA), they had unencrypted data, but complied fully with DMCA and operated fully legally.

Take MEGA, they have to comply with DMCA, too, even though everything is encrypted and they never can decrypt the data, either (MEGA does literally the same as up1.ca)

Additionally, Certificate pinning only works if I visited the site before the MitM started. And some carriers like T-Mobile just strip every Certificate Pinning header anyway, as they use proxies to compress data. (Chrome’s Turbo mode does the same).

Essentially, the site uses JavaScript for showing images without providing any advantage to either the user or the site.

[ Parent | on HN ]
Re:Even when told not to, Windows 10 doesn't stop talking to... by ultramancool on Friday August 14, 2015 @12:08PM (#10060904)
It actually works quite well for MEGA.

MEGA is only able to comply with the DMCA when the link is provided with the full hash.

MEGA is technically unable to remove similar or matching files based on content.

> And some carriers like T-Mobile just strip every Certificate Pinning header anyway, as they use proxies to compress data.

I question the t-mobile thing, unless they're installing certificates on end-user's phones that should not be possible. This is SSL traffic, remember, all those headers are also sent over SSL so unless T-Mobile is performing MITM, this shouldn't be a problem.

As for the Chrome Turbo mode thing, it is disabled for SSL traffic, as are most of these other things.

https://developer.chrome.com/multidevice/data-compression

[ Parent | on HN ]
Re:Even when told not to, Windows 10 doesn't stop talking to... by k3d3 on Friday August 14, 2015 @12:48PM (#10061175)
> Essentially, the site uses JavaScript for showing images without providing any advantage to either the user or the site.

That is a very baseless and false conclusion.

[ Parent | on HN ]
Re:Even when told not to, Windows 10 doesn't stop talking to... by ultramancool on Friday August 14, 2015 @12:52PM (#10061200)
Well, admittedly, in the context of a link on Hacker News, it's pretty true. The link containing the seed is trivial to obtain and could easily be reported to the providers who would have to take it down if deemed legally necessary.
[ Parent | on HN ]