Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom meetings aren’t end-to-end encrypted, despite marketing

theintercept.com

Post reply on HN
Print view View original

101–110 of 351 posts

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#101

Post by gruez »

mox1 wrote: post #94
mabcat wrote: post #13

End-to-end encryption has been named as a required feature for telehealth in Australia. Interest in telehealth has gone from zero to infinity over the past two weeks for obvious reasons. So I've been trying really hard to work out if Zoom is E2E, and reached the same conclusions as the article. First, it isn't, and second, Zoom are really going out of their way to obscure that fact. It's great that The Intercept is t…

How do you E2E encrypt a video stream and still allow adaptive bit rates? If the server can't read (decrypt) the video, it cannot re-encode the video at different bitrates for different clients. Or the Zoom client has to encode multiple steams and upload them locally...or it just downgrades to the bitrate of the slowest client... You get shitty video and E2E encryption or good video and transport encryption.

Probably something like this:

https://en.wikipedia.org/wiki/Bitrate_peeling

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#102

Post by viraptor »

imglorp wrote: post #80
tony101 wrote: post #46

Earlier quoted context omitted.

My problem with this is Zoom's misleading claims. If Zoom can't implement end-to-end encryption, it shouldn't claim that it does.

I think they would claim the terminology is ambiguous. If the connection is encrypted between all clients and the central server, a business person might say that's end-to-end, ie all traffic in flight. The real test is peer-to-peer or not.

That's not how E2E is defined... anywhere. Also you don't have to be P2P to support E2E.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#103

Post by minusf »

timkam wrote: post #5

I guess Zoom says they're end-to-end encrypted because they're using WebRTC, which probably means traffic is end-to-end encrypted after signaling, but users need to trust that zoom's signaling server doesn't do anything fishy. Edit: I do not understand the reason for the downvotes. I am not defending the practice but am just describing their potential line of explanation. Please let me know explicitly if my comment i…

https://webrtchacks.com/zoom-avoids-using-webrtc/

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#104

Post by zo1 »

viraptor wrote: post #91
SamuelAdams wrote: post #88

Earlier quoted context omitted.

Hold on, E2E encryption is now required for telehealth in Australia, yet the Australian government passed laws that required LEO's to have access to E2E encrypted data [1]? How are tech companies supposed to comply with that? [1]: https://www.wired.com/story/australia-encryption-law-global-...

It's not incompatible technically. The law requires access on request, not all the time. If LEO doesn't ask, it may be still E2E.

That adds an even bigger layer of complexity for people to understand. The whole point of E2E was so that only the two ends could decrypt the data being transferred. If we now add "except if government agency requests it" then we're hijacking the term and making it no more meaningful that saying "yeah our app has encryption".

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#105

Post by Zenbit_UX »

viraptor wrote: post #91
SamuelAdams wrote: post #88

Earlier quoted context omitted.

Hold on, E2E encryption is now required for telehealth in Australia, yet the Australian government passed laws that required LEO's to have access to E2E encrypted data [1]? How are tech companies supposed to comply with that? [1]: https://www.wired.com/story/australia-encryption-law-global-...

It's not incompatible technically. The law requires access on request, not all the time. If LEO doesn't ask, it may be still E2E.

A requirement for e2e is that the company doesn't hold the keys, otherwise it's just regular transport encryption + a promise that they'll never peak at the your data, even though they can. So yes, it's very much incompatible technically.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#106

Post by bscphil »

Zenbit_UX wrote: post #105
viraptor wrote: post #91

Earlier quoted context omitted.

It's not incompatible technically. The law requires access on request, not all the time. If LEO doesn't ask, it may be still E2E.

A requirement for e2e is that the company doesn't hold the keys, otherwise it's just regular transport encryption + a promise that they'll never peak at the your data, even though they can. So yes, it's very much incompatible technically.

You just have two modes, one with e2e enabled and one not. e2e is enabled normally but when LE requests access, the user client receives a message telling it not to use e2e. That may not satisfy you as someone who wants secure encryption (and it probably shouldn't), but it is e2e when it's actually enabled.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#107

Post by mjlee »

tantalor wrote: post #98
bad_user wrote: post #43

Earlier quoted context omitted.

End-to-end encryption is hard to implement, might cost more processing or bandwidth or storage (depending on the product) and does not yield benefits for companies interested in processing user data. If it's not clearly advertised on the front page, _emphasized_ and not a foot note, then it's NOT e2e encrypted. Example: https://signal.org

> hard to implement https://en.wikipedia.org/wiki/One-time_pad

It's not clear from the context if you mean to say that's simple or hard with that link.

A OTP might be mathematically simple, but logistically it's very hard - you have to safely distribute the key and that key must be at least as long as the message you're passing.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#108

Post by XelNika »

Krasnol wrote: post #84
Insanity wrote: post #47

Another day, another Zoom issue. I've resolved to not using Zoom - when it was suggested at work I just posted links to the issues (mostly gotten from HN actually) so we decided against it.

Well, they became the popular go to solution because the other popular solutions suck. Now they are also in the focus of privacy interested media and therefore end up becoming stories. The Intercept didn't care about Zoom a few months ago and wouldn't have without Corona.

> The Intercept didn't care about Zoom a few months ago and wouldn't have without Corona.

The 2019 Zoom vulnerability[1] was a much bigger deal and did get picked up by the media. Zoom already had a terrible reputation before COVID-19.

[1] https://news.ycombinator.com/item?id=20387298

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#109

Post by viraptor »

Zenbit_UX wrote: post #105
viraptor wrote: post #91

Earlier quoted context omitted.

It's not incompatible technically. The law requires access on request, not all the time. If LEO doesn't ask, it may be still E2E.

A requirement for e2e is that the company doesn't hold the keys, otherwise it's just regular transport encryption + a promise that they'll never peak at the your data, even though they can. So yes, it's very much incompatible technically.

The company doesn't have to keep the keys for everyone. They can switch you on request from E2E to central encryption for you account only. Without an opensource client and the possibility to verify the used keys, you wouldn't know that happened. And realistically, even with those options, almost nobody verifies the changed fingerprint.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#110

Post by JoeAltmaier »

So sad, still getting this wrong after so many years.

I was part of a startup Sococo some 8 years ago. We had end-to-end encryption right out of the box. Plus video, document sharing, chat. All encrypted, end to end with rotating keys. Up to 100 people in a meeting, sharing and chatting indiscriminately.

Its gone now, and the new folks are starting way down the feature ladder from where we were. It's disappointing. Now its 'good' if you can get 6 in a conference.

I hear Zoom can support large meetings. So they may be doing something right.

Post reply on HN