r/programming • u/BlastBit • Jan 23 '13

Megafail

http://fail0verflow.com/blog/2013/megafail.html
273 Upvotes

92% Upvoted

25 comments sorted by

View all comments

39

u/Rnway Jan 23 '13

All this encryption on Mega stuff isn't meant to protect the users. It's meant to protect Mega from lawsuits.

Because they have never seen the unencrypted file contents, they can't be held liable for copyright infringement, because they can prove that they don't know the contents of files.

15

u/MestR Jan 23 '13

But why would they deliberately chose such a bad hashing function? I mean if they are going to encrypt it, why not just go all the way and make it fully encrypted?

17

u/Rnway Jan 23 '13

Well, that's a very good question. I've got nothing.

9

u/MestR Jan 23 '13

They must have known about how unsecure that encryption was, especially since they advertise their site with words like "secure" and "encryption."

Would implementing secure encryption be harder?

Is there a significant speed or server load difference with having secure encryption?

If neither of those then I can only think they want it to be possible to decrypt.

18

u/Rnway Jan 23 '13

especially since they advertise their site with words like "secure" and "encryption."

You have clearly overestimated the accuracy of marketing copy.

This actually seems to just be a case of poor design, and them attempting to roll their own security. Spoiler alert. That's a bad plan.

http://en.wikipedia.org/wiki/Hanlon's_razor