512 login attempts is nothing. The Bleichenbacher'98 padding oracle attack is sometimes called "the million message attack", and it's one of the more practical crypto attacks --- I've been on projects that deployed that attack adversarially to accomplish things.

These are apparently login attempts visible to the user.

To conceal them might be possible in some cases, but requires tampering suspiciously with public source client-side apps

The server can just accept the SID the client "decrypted" with the malicious RSA key, and run the attack over time. This is right there in the paper.

This isn't a cryptosystem, it's a CTF level.

Put simply: this attack required the user to enter the password 512 times[0]

[0] https://mega-awry.io/#questions

Put simply: this attack required the user to log in 512 times, ever.

You don't have to take my word for it; that's how Mega summarizes the attack in their response.

The point is this exploit, according to the researchers, required massive and unusual manual intervention by the user, so it's very different from the other exploit you mentioned that involves millions of auth attempts

From the link I just posted, written by the researchers:

'Nevertheless, on the clients that we analyzed, all attacks would have required a substantial number of manual login attempts (i.e., the user entering the password). Since clients usually cache the credentials, users often stay logged in, minimizing the number of logins performed and thereby increasing the difficulty of the attacks.'

That's his/her point, right?

  >  I have a Mega account and I think I've logged 
  > in less than 50 times in the entire lifetime of my account...

I also have a Mega account, and my experience is the same.

You know a million times more about cryptography than me, but it doesn't change the fact that I, personally, am not compromised by an attack that requires me to log in that many times.

That's not very many if "remember me" feature is broken and you use the service a lot. I suspect that there are non-malicious services i use where i have entered my password 500 times.

Even if its a lot given average user behaviour, that's an incredibly low margin for safety

If you have a personal and a school/work around on Microsoft platforms, and you use them daily, I bet you can be asked to log in 500 times in a couple of week of intense use. And each time you'll be asked if you want them to "remember you"!

Sure, but I mean, this whole line of discussion is sort of brain-breaking. When we reason about cryptosystems, we don't generally reach the question of "how many hundreds of times can you log in before the system permanently loses all of its security". That's not like, a figure of merit in a typical cryptosystem; the right (and ordinary) answer to that question is "practically infinite".

You've picked a sort of strange hill to die on when you find yourself arguing that a system is in practical terms secure because it's unlikely you're going to log in enough times to trip the bug that coughs up your private keys. If you have to compute the number of times you can safely log in, something has gone terribly, terribly wrong.

I completely argree, I was just using the chance to vent about how much I hate Microsoft logins.

I've used corporate systems which made u login every visit (multiple times a day for me, 5 days a week), I've seen government systems do it, there might be a surprising number of targets where 512 attempts is effective

> I have a Mega account and I think I've logged in less than 50 times in the entire lifetime of my account, including when it was still controlled by Kim Dotcom.

Same experience here. I've logged in maybe once per year, if it suddenly started asking me to login every time I used it, it would be a huge red flag.

Mega controls the client side too, right? So when you put your password into the app, they can make 512 logins right then.

They could also just upload the password and the key material, so in the end this is about them being able to do it in a way that isn't obvious to everyone looking at the network tab, which is the real issue being pointed out.

Their MEGAsync client is open source at least.

Are the binaries reproducibly built?

Yeah, with `emerge -av` or `nix build`

I'm talking about the binaries offered by the Mega website. Can they be trusted as the product of the open source build?

Nope, but why to use binaries if you may not?

No they don't, unless you use their website.