Mega was second: The first client-encrypted file sharing service, Securesha.re

Re:Mega was second: The first client-encrypted file sharing ... by exec on Sunday January 20, 2013 @04:32PM (#5088337)

Not using HTTPS is a critical mistake. Adversary can just do MITM attack and send modified code to the user's browser to steal passwords.

It's not best idea to share sensitive documents without using HTTPS.

[ Parent | on HN ]

Re:Mega was second: The first client-encrypted file sharing ... by bascule on Sunday January 20, 2013 @10:09PM (#5089625)

Confirm. This system was obviously designed by people who had no idea what they were doing, which is about the last thing you want in a cryptosystem. Failing to authenticate the JS cryptographic code (TLS would've helped here) makes this system effectively worthless and simple to MitM.

A good read on the matter is Matasano's JavaScript Cryptography Considered Harmful: http://www.matasano.com/articles/javascript-cryptography/

[ Parent | on HN ]

Re:Mega was second: The first client-encrypted file sharing ... by STRML on Sunday January 20, 2013 @10:59PM (#5089778)

I wasn't aware of the MITM issues, thank you for letting me know. I'm working on setting up a cert as we speak.

[ Parent | on HN ]

Re:Mega was second: The first client-encrypted file sharing ... by STRML on Monday January 21, 2013 @10:58AM (#5091985)

HTTPS is now enabled on the site. Thanks for letting me know.

Just curious, do you see any other red flags in the system?

[ Parent | on HN ]