MEGA: Malleable Encryption Goes Awry

Re:MEGA: Malleable Encryption Goes Awry by sp332 on Tuesday June 21, 2022 @07:05PM (#31830127)

Mega controls the client side too, right? So when you put your password into the app, they can make 512 logins right then.

[ Parent | on HN ]

Re:MEGA: Malleable Encryption Goes Awry by meibo on Tuesday June 21, 2022 @07:25PM (#31830285)

They could also just upload the password and the key material, so in the end this is about them being able to do it in a way that isn't obvious to everyone looking at the network tab, which is the real issue being pointed out.

[ Parent | on HN ]

Re:MEGA: Malleable Encryption Goes Awry by albatruss on Tuesday June 21, 2022 @07:25PM (#31830288)

Their MEGAsync client is open source at least.

[ Parent | on HN ]

Re:MEGA: Malleable Encryption Goes Awry by projektfu on Tuesday June 21, 2022 @08:52PM (#31830823)

Are the binaries reproducibly built?

[ Parent | on HN ]

Re:MEGA: Malleable Encryption Goes Awry by pshirshov on Tuesday June 21, 2022 @08:56PM (#31830852)

Yeah, with `emerge -av` or `nix build`

[ Parent | on HN ]

Re:MEGA: Malleable Encryption Goes Awry by projektfu on Tuesday June 21, 2022 @10:12PM (#31831328)

I'm talking about the binaries offered by the Mega website. Can they be trusted as the product of the open source build?

[ Parent | on HN ]

Re:MEGA: Malleable Encryption Goes Awry by pshirshov on Wednesday June 22, 2022 @02:43PM (#31840079)

Nope, but why to use binaries if you may not?

[ Parent | on HN ]

Re:MEGA: Malleable Encryption Goes Awry by megous on Tuesday June 21, 2022 @07:30PM (#31830334)

No they don't, unless you use their website.

[ Parent | on HN ]