Live data from Hacker News

Zoom meetings aren’t end-to-end encrypted, despite marketing

theintercept.com

31–40 of 351 posts

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#31
post #27

how can you have end-to-end encryption with server side processing in conference calls with 50 participants?

You abandon the server-side processing part and have all 50 participants share a single key. The server then acts as a dumb broadcast network. It's definitely not easy, which is probably a big reason no-one in this space is doing it.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#32
post #5

I guess Zoom says they're end-to-end encrypted because they're using WebRTC, which probably means traffic is end-to-end encrypted after signaling, but users need to trust that zoom's signaling server doesn't do anything fishy. Edit: I do not understand the reason for the downvotes. I am not defending the practice but am just describing their potential line of explanation. Please let me know explicitly if my comment i…

There's no way the audio can be end-to-end encrypted, because I can call in from a normal telephone and hear everyone.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#33
post #23

I am willing to chalk this up to an honest mistake considering "end-to-end" encryption as being from the client's end to the server, although that's not the accepted use of the term. This appears to be their explanation. I hope their marketing team fixes this now that it's been pointed out to them though.

That’s not an honest mistake. It’s an inexcusable fuckup. End to end encryption is not a difficult concept. Redefining the “ends” doesn’t excuse Zoom’s continually shady behavior.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#34

Earlier quoted context omitted.

Hopefully we've reconsidered the laws of mathematics in the last few years ... https://www.newscientist.com/article/2140747-laws-of-mathema... "“The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia,” said Turnbull. Turnbull’s comments came as he proposed a new law to force tech companies to give security services access to encrypted messages." "The UK home s…

> The UK home secretary Amber Rudd has previously called encryption "completely unacceptable" ... Theresa May has said that the big internet companies give terrorists "safe spaces" to communicate. Ironically, the UK government in fact uses Zoom for all its meetings depsite privacy and security implications. Saudi Arabia, take note. Ref: https://www.businessinsider.com/coronavirus-boris-johnson-zo...

That's terrible for national security. Zoom engineers are based in China: https://www.cnbc.com/2019/03/26/zoom-key-profit-driver-ahead...

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#35
post #13

End-to-end encryption has been named as a required feature for telehealth in Australia. Interest in telehealth has gone from zero to infinity over the past two weeks for obvious reasons. So I've been trying really hard to work out if Zoom is E2E, and reached the same conclusions as the article. First, it isn't, and second, Zoom are really going out of their way to obscure that fact. It's great that The Intercept is t…

Actually zoom despite its privacy concerns is on the whitelist for telemedical application by the insurers in Germany, so I think they understand how to play the game...

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#36
post #27

how can you have end-to-end encryption with server side processing in conference calls with 50 participants?

You abandon the server-side processing part and have all 50 participants share a single key. The server then acts as a dumb broadcast network. It's definitely not easy, which is probably a big reason no-one in this space is doing it.

You lose a lot of features, too. No calling in from a normal telephone if your Internet connection sucks. Everyone has to share the same stream, so no tailoring res/bitrate/etc to individual participants.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#37
post #30
post #16

Earlier quoted context omitted.

GoToMeeting claims end to end encryption[1] and in the same sentence say it's just SSL just like Zoom. Never the less they offer call-in as well so end to end becomes impossible right there. I have serious doubts about any conference software offering real end to end encryption as it's unrealistic for clients to be dealing with that many av streams. 1. https://support.goto.com/meeting/help/security-faqs-g2m05001...

End-to-end encryption doesn't require participants to receive full-quality video from everyone. Each client can be responsible for encoding their own video feed at multiple quality levels simultaneously – what WebRTC calls simulcasting. That does increase required processing power and upload bandwidth, but not to the point of infeasibility. And you do inevitably leak the identity of the person currently talking, as t…

To add on this, an encrypted stream with a variable bitrate encoding allows to guess the amount of transmitted information entropy.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#39
post #26
post #17

It's disappointing to see a company that has better tech than its rivals playing these games. I have been singing Zoom's praises, but this really makes me want to look elsewhere. What a bummer.

Zoom has always been shady as hell. Between the ridiculous web server on MacOS, web client anti-patterns and other endless nonsense the only explanation for their popularity is good marketing.

I dont know, their competitors are probably the reason for their popularity. It’s definitely a space with a lack of genuinely UX focused competitors.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#40
post #27

how can you have end-to-end encryption with server side processing in conference calls with 50 participants?

Though it is probably not practical today, there exists a research field for this kind of problems. The keyword is "homomorphic encryption".
Post reply on HN