Subject: Re: Upgraded Security
From: Ondřej Jirman
Date: Sun, 7 May 2023 13:45:54 +0200
Hi,

On Sun, May 07, 2023 at 05:24:43AM +0000, createmajor2 wrote:
> I should also note that apparently, the unsuccessful retrieval of folders
> seems to be only happening on folders created BEFORE the upgraded security was
> accepted into the MEGA account. New folders and its files uploaded AFTER are
> listed successfully, just found this out.

Good to know.

> Sent with [Proton Mail](https://proton.me/) secure email.
> 
> ------- Original Message -------
> On Sunday, May 7th, 2023 at 7:14 AM, createmajor2 <createmajor2@proton.me> wrote:
> 
> > Hi, thank you for maintaining your tool, it's immensely useful. Wanted to write a quick email to note that apparently MEGA's new "security upgrade" seems to have broken megatools. From what I've gathered, it seems to be related to this:
> > https://blog.mega.io/e2ee-security-update/
> >
> > If one logs in to one's MEGA account on browser, it will prompt asking to "upgrade the security of the account" and that it will be a one time thing.
> >
> > I've accepted the security upgrade on one of my accounts and megatools will no longer work properly. For example, it won't list folders (it seems to still list files on Root). This is the terminal output when trying to ls:
> >
> >> WARNING: Skipping import of a key 8K5C1XXX because it's authentication failed
> >> WARNING: Skipping import of a key dLxAgXXX because it's authentication failed
> >> WARNING: Skipping FS node dLxAgXXX because node key wasn't found
> >> WARNING: Skipping FS node 8K5C1XXX because node key wasn't found
> >> WARNING: Skipping FS node BWo21XXX because node key wasn't foundWARNING: Skipping FS node oLwSwXXX because node key wasn't found
> >> ...
> >> /Contacts
> >> /Inbox
> >> /Root
> >> /Trash
> >
> > I have 2 root folders so I imagine the first 2 warnings is about those
> > folders and the rest about sub-folders.
> >
> > When doing ls again, it will skip all the warnings. Only when deleting the
> > "megatools.cache" obtained from the first login will the warnings appear
> > again. I assume this is normal behavior. Since I don't have any root files
> > and my files are in folders, when I stumbled upon this, megatools gave me
> > the impression that my storage was empty when it wasn't, so that was a bit
> > of a shock.
> >
> > In any case, it's clear MEGA has changed things on their end, it would be
> > very much appreciated if you could look into it and possibly find a fix.

It's this change on mega's side: https://github.com/meganz/webclient/commit/520804af96144530b1c78161d37b870cd4335b5f

About 2000 new lines of obtuse mix of mega.nz UI and crypography code. I have no
idea what mega changed other than that it seems like they added a whole new key
management layer.

I haven't used mega.nz in the last 5 years, so I'm just waiting for someone
to either analyze this and give me a summary of what changed on the API
layer which mega.nz doesn't document, or for patches. :)

kind regards,
	o.

> > Thank you once again.