In spite of its successful launch, which saw Kim Dotcom’s new storage site Mega accrue over a million users in the first 24 hours, the site has since attracted a lot of flak from security bloggers over its questionable encryption practices.

Kim Dotcom has never been one to keep his opinions to himself, and so it’s not surprising to see that the entrepreneur has come out fighting in an attempt to refute some of the criticisms leveled at Mega’s security.

Writing in the official Mega Blog, Dotcom focused his attention on two particularly unfriendly posts on Forbes and Ars Technica. Some of Dotcom’s comments were rather dry and laborious as he attempted to explain how the two articles weren’t completely accurate in their accusations against Mega, but he did hint at several changes in store for the cloud storage world’s newest kid on the block.

“The cloud storage market is dominated by players that do not take advantage of cryptography beyond HTTPS and server-side encryption,” writes Dotcom.

“Since we set out to improve this rather dissatisfying situation three days ago, some news outlets have made attempts to dismantle our crypto architecture. Frankly, we were not too impressed with the results and would like to address the points that were raised”

One of the biggest criticisms leveled against Mega in Lee Hutchinson’s post on Ars Technica is that the service lacks any kind of password recovery system. Such a system means that anyone who loses or forgets their password would be unable to decrypt their files, making them inaccessible apparently forever.

Dotcom admits this much in his blog post, but says that plans are in place for a secure password change mechanism in the near future, together with a password reset function for those who are particularly forgetful.

“A password reset mechanism will allow you to log back into your account, with all files being unreadable.”

“Now, if you have any pre-exported file keys, you can import them to regain access to those files. On top of that, you could ask your share peers to send you the share-specific keys, but that’s it – the remainder of your data appears as binary garbage until you remember your password.”

Another issue that the Ars Technica article had with Mega was its use of mouse movements and keyboard inputs to generate entropy for the RSA keys that underpin the site’s security. Hutchinson complained that Mega’s splash page statement explaining how this was done was “bafflingly misleading”, as it was vague as to when those movements were recorded.

Dotcom acknowledged these concerns and assured readers that changes in the way this works are also in the pipeline:

“This is correct – and quite a strange statement to make after conceding that mouse and keyboard entropy are indeed used to enhance Math.random(). We will, however, add a feature that allows the user to add as much entropy manually as he sees fit before proceeding to the key generation.”