Mega Launches: Brilliantly Secure, But Not Anonymous

Mortal souls have to wait another day, but today members of the “press” were given an early look Megaupload’s successor, Mega.

TorrentFreak was lucky enough to be one of the early-birds and here we report our findings. Before going over to the obligatory screenshot tour we’ll take a look at the site’s most anticipated feature, encryption.

As promised, Mega encrypts all uploaded files by default. This works as promised and means that no one except the uploader of a file can see what it contains, unless he or she shares the private key with someone else.

With this tool Dotcom hopes to bring encryption into the mainstream.

“Our easy to use one-click privacy feature will turn encryption into a mass product. We believe within five years half of all Internet traffic will be encrypted with solutions born from our new API,” Dotcom told us previously.

So we’ll put a check mark behind security, assuming that people come up with decent passwords of course.

However, since Mega has branded itself “The Privacy Company” we couldn’t help but examine the site’s privacy policy, to see what personal information is stored and for how long. As it turns out the company keeps quite detailed records of its users, including IP-addresses.

We keep the following personal information:
– When a user signs up for particular services on our website they may need to give us the details required in our registration form and keep that information up to date;
– Communication logs, traffic data, site usage and other information related to us supplying the services (including for serving of advertising material on our site);
– Any personal information included in data uploaded to our system including but not limited to registration information.

We keep records of IP addresses used to access our services.

While this may not be a huge issue for the mainstream, privacy buffs usually prefer more anonymity. Currently dissidents and whistleblowers are not shielded from being exposed by Mega, if the authorities come knocking.

Mega won’t hand personal information out to random strangers of course, but they will cooperate with law enforcement and comply with subpoenas as they should. In their privacy policy they state the following:

If we think it is necessary or we have to by law in any jurisdiction then we are entitled to give your information to the authorities.

We reserve the right to assist any law enforcement agency with investigations, including and limited to by way of disclosure of information to them or their agents. We also reserve the right to comply with any legal processes, including but not limited to subpoenas, search warrents (sic) and court orders.

Another strange line we stumbled upon relates to the creditworthiness of Mega users. According to Mega’s terms this type of information can be shared with any person (see update at the bottom of the article).

We can use any information we have about you as a customer relating to your creditworthiness and give that information to any other person for credit assessment and debt collection purposes.

This anonymity aspect is somewhat of a missed opportunity.

Moving on to the rest of the site we see that Mega offers a great and easy to use interface combined with a decent feature set, including shared folders between contacts. It’s what you would expect from a cloud hosting service.

Aside from some browser incompatibilities the uploading, downloading and sharing of files works seamlessly.

The 50GB storage limit on a free account is definitely a plus. Premium accounts start at $9.99 per month for which users get 500GB of storage and 2TB for data transfers.

There are still many features and tools in the pipeline which will be released in the coming weeks and months. The development roadmap lists mobile access, sync tools for all major platforms, and a mount for Windows.

Finally we’d have to mention that Mega is nothing like the old Megaupload. It’s an entirely different animal, but definitely one worth keeping an eye on.

Update: Mega opened up to the public, hit 250,000 users in a few hours and is mostly offline now.

Update: The creditworthiness mention has been deleted from the TOS. It was most likely a copy/paste gone wrong.

On Sunday Dotcom and his colleagues will officially launch the site during a Mega press event, after which it will open up to the public.