Yet another example of just how unsafe cloud storage can be.

These days, cloud computing has us all retooling our due diligence processes. Here’s an example of why!

A security researcher has found that confirmation emails sent by MEGA to new users put users’ passwords at risk for being cracked by hackers. A program called MegaCracker has recently been released by the very researcher who discovered the vulnerability which can take the link given in one of these confirmation emails and extract the user’s password. It is well known that attackers have no problem intercepting unencrypted email messages, so the fact that MEGA is sending passwords as hashes over email has many security professionals scratching their heads.

MEGA has only so far responded by defending its methods and claiming that as long as users use strong passwords, there is no risk. However, security researches maintain that it is unconventional to send both the hashed password and the master encryption key in a confirmation email. Many other companies, such as Netflix and Twitter, option for sending new users a random number value which is only known by the server and recipient. In the hours following the announcement of the program and the vulnerability, articles from Forbes and IDG News have cautioned their readers to avoid placing confidential information on the company’s cloud servers.

Original article by Dan Goodin.
Read the full story here.