The issue here is that MEGA presents itself as "the privacy company" and makes some very careful claims about encryption:<p><pre><code> All files stored on MEGA are encrypted. All data transfers from and
to MEGA are encrypted. And while most cloud storage providers can
and do claim the same, MEGA is different – unlike the industry norm
where the cloud storage provider holds the decryption key, with
MEGA, you control the encryption, you hold the keys, and you decide
who you grant or deny access to your files, without requiring any
risky software installs. It’s all happening in your web browser!
</code></pre>
It's true that everything is encrypted. And it's true that many cloud storage providers hold the decryption keys. It's also true that with MEGA, you hold the keys. What they carefully avoid claiming is that MEGA is unable to read the decryption keys.<p>All it takes is one court order in a country where MEGA operates ordering them to obtain the user-held decryption keys via the exact same method this bookmarklet demonstrates. MEGA doesn't even have to be involved. In the US, a National Security Letter to your ISP could lead to a man-in-the-middle attack with the help of an SSL certificate that the government orders a trusted CA to provide for MEGA's domain. At that point, all of MEGA's carefully-crafted claims about security are moot.