Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom meetings aren’t end-to-end encrypted, despite marketing

theintercept.com

Post reply on HN
Print view View original

111–120 of 351 posts

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#111

Post by mulmen »

AlphaSite wrote: post #39
mulmen wrote: post #26

Earlier quoted context omitted.

Zoom has always been shady as hell. Between the ridiculous web server on MacOS, web client anti-patterns and other endless nonsense the only explanation for their popularity is good marketing.

I dont know, their competitors are probably the reason for their popularity. It’s definitely a space with a lack of genuinely UX focused competitors.

Sure but that’s kind of like saying Wells Fargo has competitive interest rates. The advertised product isn’t the problem. It’s everything they make you take along with it.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#112

Post by bscphil »

mox1 wrote: post #94
mabcat wrote: post #13

End-to-end encryption has been named as a required feature for telehealth in Australia. Interest in telehealth has gone from zero to infinity over the past two weeks for obvious reasons. So I've been trying really hard to work out if Zoom is E2E, and reached the same conclusions as the article. First, it isn't, and second, Zoom are really going out of their way to obscure that fact. It's great that The Intercept is t…

How do you E2E encrypt a video stream and still allow adaptive bit rates? If the server can't read (decrypt) the video, it cannot re-encode the video at different bitrates for different clients. Or the Zoom client has to encode multiple steams and upload them locally...or it just downgrades to the bitrate of the slowest client... You get shitty video and E2E encryption or good video and transport encryption.

I'd probably have each client encode one high quality stream that's targeted to be accessible to 90+% of clients, and a very low quality stream that's 5% of the bitrate of the high quality one. Low encoding complexity and adds a negligible amount to your upload bandwidth requirements. (Obviously if a client can't meet the upload quota for the highest quality, you max out at whatever they can do.)

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#113

Post by netflixandkill »

mulmen wrote: post #26
devin wrote: post #17

It's disappointing to see a company that has better tech than its rivals playing these games. I have been singing Zoom's praises, but this really makes me want to look elsewhere. What a bummer.

Zoom has always been shady as hell. Between the ridiculous web server on MacOS, web client anti-patterns and other endless nonsense the only explanation for their popularity is good marketing.

The explanation for their popularity is that it isn't a constant struggle to use zoom for meetings. Their software may have other problems, but people can run it and get into a meeting with minimal effort.

Yesterday by comparison half the people on a Skype meeting had to dial into an audio bridge with their cell phones because their computer audio didn't work for no fucking reason, and screen sharing kept lagging unless restarted every so often.

The good marketing for zoom is that webex is awful.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#114

Post by viraptor »

zo1 wrote: post #104
viraptor wrote: post #91

Earlier quoted context omitted.

It's not incompatible technically. The law requires access on request, not all the time. If LEO doesn't ask, it may be still E2E.

That adds an even bigger layer of complexity for people to understand. The whole point of E2E was so that only the two ends could decrypt the data being transferred. If we now add "except if government agency requests it" then we're hijacking the term and making it no more meaningful that saying "yeah our app has encryption".

I'm not trying to hijack the term. Once LEO puts in the request the system stops being E2E - that's true. It would be good if this wasn't possible, but for that we need the whole stack of: open protocol, opensource implementation, signed verified release, and people keen to verify fingerprints. And if we're pedantic, also a verifiable execution environment.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#115

Post by mulmen »

Krasnol wrote: post #84
Insanity wrote: post #47

Another day, another Zoom issue. I've resolved to not using Zoom - when it was suggested at work I just posted links to the issues (mostly gotten from HN actually) so we decided against it.

Well, they became the popular go to solution because the other popular solutions suck. Now they are also in the focus of privacy interested media and therefore end up becoming stories. The Intercept didn't care about Zoom a few months ago and wouldn't have without Corona.

Zoom has been doing shady shit forever. Last year it was for installing a web server on localhost to save a click then dragging their feet on a fix when told how stupid that is.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#116

Post by bloopernova »

mulmen wrote: post #26
devin wrote: post #17

It's disappointing to see a company that has better tech than its rivals playing these games. I have been singing Zoom's praises, but this really makes me want to look elsewhere. What a bummer.

Zoom has always been shady as hell. Between the ridiculous web server on MacOS, web client anti-patterns and other endless nonsense the only explanation for their popularity is good marketing.

I think it's more incompetence on the part of their engineers.

Engineers code shitty apps to fill requirements. Lie to project/product managers about what is complete, or have a "good enough" attitude. Managers communicate to marketing that Zoom is end to end encrypted.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#117

Post by XelNika »

sarakayakomzin wrote: post #90
michaelt wrote: post #41

Earlier quoted context omitted.

1. Clients negotiate end-to-end encryption session key between themselves the same way as a chat app would. 2. Each client sends the server two (or more) encrypted video streams, varying in bandwidth and keyframes per second, with unencrypted markers showing where they can be sliced and joined. If you can upload a 1080p stream, chances are you've got the bandwidth to send a 360p stream too! 3. Each client tells the s…

a few problems: >Clients negotiate end-to-end encryption session key between themselves the same way as a chat app would. how are you doing this exactly? a 50 way diffie-hellman that renegotiates every time a user leaves or joins? How do you plan on doing that without any substantial lag? >2. Each client sends the server two (or more) encrypted video streams, varying in bandwidth and keyframes per second you have man…

> you have managed to double your egress

Only compared to the current, unencrypted version. For E2E encryption, the alternative, as I see it, is pushing out an encrypted video stream per recipient. He has reduced his egress from O(n) to O(1).

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#118

Post by Krasnol »

XelNika wrote: post #108
Krasnol wrote: post #84

Earlier quoted context omitted.

Well, they became the popular go to solution because the other popular solutions suck. Now they are also in the focus of privacy interested media and therefore end up becoming stories. The Intercept didn't care about Zoom a few months ago and wouldn't have without Corona.

> The Intercept didn't care about Zoom a few months ago and wouldn't have without Corona. The 2019 Zoom vulnerability[1] was a much bigger deal and did get picked up by the media. Zoom already had a terrible reputation before COVID-19. [1] https://news.ycombinator.com/item?id=20387298

Yeah, it was picked up because it was a much bigger deal.

Now the issues are a smaller deal but are still being picked up.

Most people I work with haven't even heard about Zoom until those last months when they've been forced to use a teleconference for the first time in their lifes. They also probably didn't even hear about the issue last year too.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#119

Post by mulmen »

slgeorge wrote: post #81
mtthwn wrote: post #45

Earlier quoted context omitted.

Honest question, what do you find is better about zoom? Compared to webex, skype, slack call… What do people like about zoom?

It works. 1. It's actually cross-platform: - Still can't use Webex across Linux, Windows and Mac in 2020. - Same goes for Skype, plus half the users who have Skype don't realise it's Linc and the two are completely different. 2. It's far more bandwidth efficient than things like Slack. The codecs are much more resilient, this applies (from what I can tell) to all the embedded options that are just using the browser.…

You should do 30 seconds of research. Zoom has a long history of shady bullshit.

The “pitchforks” are people who pay attention and do not trust Zoom for established reasons. We are now forced to use it because I guess business in 2020 requires the ability to look like you’re on a beach in your sweat pants.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#120

Post by Veedrac »

PudgePacket wrote: post #20
mabcat wrote: post #13

End-to-end encryption has been named as a required feature for telehealth in Australia. Interest in telehealth has gone from zero to infinity over the past two weeks for obvious reasons. So I've been trying really hard to work out if Zoom is E2E, and reached the same conclusions as the article. First, it isn't, and second, Zoom are really going out of their way to obscure that fact. It's great that The Intercept is t…

Hopefully we've reconsidered the laws of mathematics in the last few years ... https://www.newscientist.com/article/2140747-laws-of-mathema... "“The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia,” said Turnbull. Turnbull’s comments came as he proposed a new law to force tech companies to give security services access to encrypted messages." "The UK home s…

I realize HN will think much the same of it either way, but AFAICT that second quote of yours is a lie; she called WhatsApp's encryption unacceptable, not encryption in general.
Post reply on HN