> Without a built-in, well-audited, static browser mechanism no web service can ever be trusted with confidential data

That's why mega has a separate app: https://mega.co.nz/#chrome

The article isn't proving anything, it's an example of how a known problem affects MEGA. It's saying encrypt your files first, because trusting MEGA (or anyone who uses that kind of encryption) is not enough.

Sure, but don't you think it's important that they make this clear?

So far they market heavily on the fact that it's secure when this is simply not true.

If you read their security page, they do say you shouldn't use it if you don't trust them. But that's about it for any warning that you're basically sitting there naked.

I know no security system is entirely secure, but they aren't generally targeting security minded folks, they're targeting the layman who reads what they say and then thinks they're secure due to their weasel worded security page.