Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom meetings aren’t end-to-end encrypted, despite marketing

theintercept.com

Post reply on HN
Print view View original

91–100 of 351 posts

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#91

Post by viraptor »

SamuelAdams wrote: post #88
mabcat wrote: post #13

End-to-end encryption has been named as a required feature for telehealth in Australia. Interest in telehealth has gone from zero to infinity over the past two weeks for obvious reasons. So I've been trying really hard to work out if Zoom is E2E, and reached the same conclusions as the article. First, it isn't, and second, Zoom are really going out of their way to obscure that fact. It's great that The Intercept is t…

Hold on, E2E encryption is now required for telehealth in Australia, yet the Australian government passed laws that required LEO's to have access to E2E encrypted data [1]? How are tech companies supposed to comply with that? [1]: https://www.wired.com/story/australia-encryption-law-global-...

It's not incompatible technically. The law requires access on request, not all the time. If LEO doesn't ask, it may be still E2E.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#92

Post by viraptor »

bogle wrote: post #87
Krasnol wrote: post #82

Earlier quoted context omitted.

> LD video TIL: there is a quality below SD.

How is a doctor supposed to do a video consultation if the blotches on your bum, purely for example, are all blurry because the definition is less than HD?

You get most of the consultation with history, described symptoms, etc. handled over telehealth and a quick follow-up in person if you require a physical examination. The process has to cover people who call from a landline as well.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#93

Post by timkam »

fsh wrote: post #7
timkam wrote: post #5

I guess Zoom says they're end-to-end encrypted because they're using WebRTC, which probably means traffic is end-to-end encrypted after signaling, but users need to trust that zoom's signaling server doesn't do anything fishy. Edit: I do not understand the reason for the downvotes. I am not defending the practice but am just describing their potential line of explanation. Please let me know explicitly if my comment i…

Video conferences via WebRTC usually have a central server that distributes all the video streams and are therefore not end-to-end encrypted.

Right, so I suppose that the numerous gateways zoom and others need to offer are an additional problem which implies that these services have to do "something fishy" on the signaling server. Generally, WebRTC traffic does not need to go through a centralized sever, though. It's peer-to-peer after signaling if possible, and if not it can use routing servers that merely route encrypted traffic. So I am wondering if these providers largely make use of standard WebRTC infrastructure plus gateways and how much proprietary magic they have on top/as an alternative. Of course, in no scenario the traffic is really secure.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#94

Post by mox1 »

mabcat wrote: post #13

End-to-end encryption has been named as a required feature for telehealth in Australia. Interest in telehealth has gone from zero to infinity over the past two weeks for obvious reasons. So I've been trying really hard to work out if Zoom is E2E, and reached the same conclusions as the article. First, it isn't, and second, Zoom are really going out of their way to obscure that fact. It's great that The Intercept is t…

How do you E2E encrypt a video stream and still allow adaptive bit rates?

If the server can't read (decrypt) the video, it cannot re-encode the video at different bitrates for different clients.

Or the Zoom client has to encode multiple steams and upload them locally...or it just downgrades to the bitrate of the slowest client...

You get shitty video and E2E encryption or good video and transport encryption.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#95

Post by extra88 »

DangerousPie wrote: post #64
mtthwn wrote: post #45

Earlier quoted context omitted.

Honest question, what do you find is better about zoom? Compared to webex, skype, slack call… What do people like about zoom?

Video/sound quality is much better than any alternative I have tried. You can see video from up to 25 (or even more now?) people at the same time. It's easy for people to set it up and join meetings. Easy to share screens/audio.

I think seeing up to 25 people in Gallery view is the default but there's a checkbox to enable seeing up to 49 people.

Schools like it because it can handle hundreds of participants in a single meeting and you can pay for extras to handle over a thousand.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#96

Post by viraptor »

Adverblessly wrote: post #66
bad_user wrote: post #49

Earlier quoted context omitted.

I'm pretty sure that Google Meet isn't end-to-end encrypted either. Nothing that Google does is. WhatsApp does claim that videos are end-to-end encrypted as well, although given Facebook announced they'll implement client-side agents for processing user data and given its proprietary nature, I avoid WhatsApp for anything very sensitive as well.

> I'm pretty sure that Google Meet isn't end-to-end encrypted either. Nothing that Google does is. To the best of my understanding, they say that it is https://support.google.com/a/answer/7582940?hl=en EDIT: On rereading they actually just say that it is encrypted, not neccesarily end-to-end encrypted.

Google provides close captioning for meet calls. That means it's not E2E. Also pretty much no service can provide multi-party video call with adaptive quality without completely destroying your bandwidth.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#97

Post by y7 »

Flimm wrote: post #4

This is not "slightly" dishonest on Zoom's part. It is dishonest. Edit: now that the title has been modified, I feel I need to add back context. Zoom claims to support end-to-end encryption when it doesn't. That is dishonest.

My Zoom client even has a little green lock with an "E" in it in the upper left side that says "Zoom is using an end to end encrypted connection" when hovering over it.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#98

Post by tantalor »

bad_user wrote: post #43
mabcat wrote: post #13

End-to-end encryption has been named as a required feature for telehealth in Australia. Interest in telehealth has gone from zero to infinity over the past two weeks for obvious reasons. So I've been trying really hard to work out if Zoom is E2E, and reached the same conclusions as the article. First, it isn't, and second, Zoom are really going out of their way to obscure that fact. It's great that The Intercept is t…

End-to-end encryption is hard to implement, might cost more processing or bandwidth or storage (depending on the product) and does not yield benefits for companies interested in processing user data. If it's not clearly advertised on the front page, _emphasized_ and not a foot note, then it's NOT e2e encrypted. Example: https://signal.org

> hard to implement

https://en.wikipedia.org/wiki/One-time_pad

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#99

Post by gnud »

mox1 wrote: post #94
mabcat wrote: post #13

End-to-end encryption has been named as a required feature for telehealth in Australia. Interest in telehealth has gone from zero to infinity over the past two weeks for obvious reasons. So I've been trying really hard to work out if Zoom is E2E, and reached the same conclusions as the article. First, it isn't, and second, Zoom are really going out of their way to obscure that fact. It's great that The Intercept is t…

How do you E2E encrypt a video stream and still allow adaptive bit rates? If the server can't read (decrypt) the video, it cannot re-encode the video at different bitrates for different clients. Or the Zoom client has to encode multiple steams and upload them locally...or it just downgrades to the bitrate of the slowest client... You get shitty video and E2E encryption or good video and transport encryption.

Sure. Then maybe don't claim that the service is e2e-encrypted?

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#100

Post by tialaramex »

upofadown wrote: post #86

Inherent to any e2e encryption scheme is the question; are you talking to who you think you are talking to? In other words; are you the victim of a man in the middle attack? So if you ever encounter a system that has the ease of use feature where you don't have to verify the identity of the other participant(s) with something like a identity fingerprint number then you already know you do not have all the protection…

It's true that you need an out-of-band verification to determine who the other party is in an end-to-end encrypted system. But it is not true that the absence of such a verification means you don't have end-to-end encryption.

It means only that you don't know for sure who the other party is. You are only put at risk if there is an active MITM attack in progress.

Depending on your threat model that's an enormous change.

Post reply on HN