Grover's algorithm on AES-128
If all of the problems of Grover's algorithm are solved then yes, otherwise no!
Grover's algorithm provides quadratic speed up so AES-128 has 64-bit security in the terms of searching complexity of Grover's method.
Grover's attack for AES-128 requires approximately $2^{64}$ successive AES evaluations. That is one has to set up the machine $2^{64}$ times, run successfully, and extract the result. This is not like a for loop on the classical machines.
The attack time is still quadratic and the required gates are not practical and it can be around $2^{86}$ for AES-128.
Graver algorithm can run in parallel, however, running $k$ machines will provide $\sqrt{k}$ speed up, and the above problem will still exist in each copy.
They are a company, if you are going to be their customer ask them to include the easiest mitigation AES-256 if you fear the future. The performance difference between AES-128 and AES-256 is just 40%, that is AES-256 is 40% slower. This is not a big deal in security. It is strange that they don't offer that since the industry sees the AES-256 as the gold standard.
A more realistic attack on AES-128
In MEGA file encryption, each node (file or folder) has its own encryption key. Although AES-128 is secure, with AES-128 the more users the MEGA has and the more file uploaded by the users will create an realistic attack on AES-128, the multi-target attack with parallel versions of Oechslin's rainbow tables.
Finding a key from $t$ targets's expected cost is $2^{128}/t$. Now assume that you have a billion targets. Then, you will be able to find the first encryption key much lower than 128-bit security. The cost would be below $2^{100}$ and the time would be below $2^{70}$. This can be achievable with supercomputers.
Therefore the MEGA must give the option to use AES-256 for their clients. In the end, the encryption is performed on the client-side, that is no cost for the MEGA servers at all.
A Review of Mega from their White Paper
Mega is simply
MEGA is a secure cloud storage and communication platform with user-controlled end-to-end encryption (E2EE). End-to-end encryption means that no intermediary - not even MEGA - has access to the user’s encryption keys and therefore the stored data. However, users have the option to share data (individual files or entire folders), plus the associated encryption keys, with others.
It enables browser-based access to end-to-end-encrypted
cloud storage.
End-to-end encryption
The files are encrypted on the client-side before uploading. If the user wants to share a file, then they share the encryption key of the file with the recipient’s public key. The recipient key can be verified in another channel as the Signal does, and any change will be notified.
Source code transparency
All security-related code work on the user side and Mega releases the source code so that third parties can verify the source code. This is a very important aspect
Privacy
They promise to only keep the user's e-mail and IP address for operational purposes. They promise to not keeping processing activities and the data, though they can see the activity. The files are still encrypted and not accessible to Mega.
Vulnerability management
They want to ensure security on an ongoing basis and they offer a prize for a previously unknown security-relevant bug or design flaw. This is an important aspect since it will attract more people to look at their designs and codes.
They also provide Data Redundancy and compliance with regulatory
requirements. The compliance is an interesting part since, at least now, Australia banned end-to-end encryption. Although the MEGA's service is governed by New Zealand law, it is unclear to me in the case of LAW change.
