Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom meetings aren’t end-to-end encrypted, despite marketing

theintercept.com

Post reply on HN
Print view View original

131–140 of 351 posts

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#131

Post by nschoe »

ekimekim wrote: post #29
catmanjan wrote: post #24

Does anyone know of a video conferencing system (3++++ participants) that actually does do end-to-end encryption?

It looks like WebRTC doesn't support it, so basically no-one can because all these browser-based technologies end up just being WebRTC in the end. From the Jitsi Meet README: > WebRTC does not (yet) provide a way of conducting multi-party conversations with end-to-end encryption. Unless you consistently compare DTLS fingerprints with your peers vocally, the same goes for one-to-one calls.

I don't understand "WebRTC doesn't support it". What do you mean?

WebRTC uses an external signalling channel to negotiate ICE candidates, codecs, and necessary information to establish a media communication. Once this is done, the visio/audio conference is P2P and encrypted from the caller to the callee: how is this not E2E? (Genuinely curious, not criticizing)

That is, if you're not using a TURN relay server, which is easy enough to know.

Maybe you meant that multi-party (one-to-many or many-to-many) calls are not E2E. Again I'm not too sure I understand: it is possible to have multi-party conf calls: each participants can encrypt its media stream and send it to the N-1 other participants. Obviously this costs a lot of CPU (for multiple encryption) and a lot of uplink because the same stream is sent N-1 times. But it is __possible__, and certainly viable with only 3 or 4 participants, provided people have a decent connection (WebRTC uses adapative bitrate streaming [0] to compensate for bandwith usage).

Then again, I know that generally, with WebRTC people would use MCU [1] when dealing with many-to-many conf calls, and then I agree it breaks E2E. But for the other mentioned cases, WebRTC is E2E, isn't it?

Again, I'm genuinely curious about this, not trying to criticize or undermine.

Thank!

[0]: https://www.wikiwand.com/en/Adaptive_bitrate_streaming

[1]: https://www.wikiwand.com/en/Multipoint_control_unit

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#132

Post by bad_user »

antoinealb wrote: post #77
bad_user wrote: post #49

Earlier quoted context omitted.

I'm pretty sure that Google Meet isn't end-to-end encrypted either. Nothing that Google does is. WhatsApp does claim that videos are end-to-end encrypted as well, although given Facebook announced they'll implement client-side agents for processing user data and given its proprietary nature, I avoid WhatsApp for anything very sensitive as well.

Google Duo is end-to-end encrypted [0]. I don't know about Meet. Disclaimer: Working at Google, in the same org as Duo. [0] http://support.google.com/duo/answer/9280240?hl=en

Ah, it's nice to hear that Duo does e2e, thanks.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#133

Post by SkyPuncher »

mabcat wrote: post #13

End-to-end encryption has been named as a required feature for telehealth in Australia. Interest in telehealth has gone from zero to infinity over the past two weeks for obvious reasons. So I've been trying really hard to work out if Zoom is E2E, and reached the same conclusions as the article. First, it isn't, and second, Zoom are really going out of their way to obscure that fact. It's great that The Intercept is t…

Just an FYI, two weeks ago, CMS announced it would be suspending enforcement of telehealth tools used in good faith during the COVID pandemic. [0]

Basically, if you are a family doc that's been thrown into the telehealth ringer, you can get started with everyday tools for video chat, like Facetime, Google Hangouts, Skype, etc - regardless of that tool's Hipaa compliance.

Overtime I do expect they'll want to see providers transition to compliant solutions, but they understand thousands of doctors, some of whom have never delivered telemedicine, can't simply audit and on-boarding a new provider overnight.

[0] https://www.cms.gov/newsroom/fact-sheets/medicare-telemedici...

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#134

Post by Ididntdothis »

mox1 wrote: post #94
mabcat wrote: post #13

End-to-end encryption has been named as a required feature for telehealth in Australia. Interest in telehealth has gone from zero to infinity over the past two weeks for obvious reasons. So I've been trying really hard to work out if Zoom is E2E, and reached the same conclusions as the article. First, it isn't, and second, Zoom are really going out of their way to obscure that fact. It's great that The Intercept is t…

How do you E2E encrypt a video stream and still allow adaptive bit rates? If the server can't read (decrypt) the video, it cannot re-encode the video at different bitrates for different clients. Or the Zoom client has to encode multiple steams and upload them locally...or it just downgrades to the bitrate of the slowest client... You get shitty video and E2E encryption or good video and transport encryption.

I used to work in video and if I remember correctly there were I, P and B frames. You need I and P but the B frames are optional. So if some meta data is unencrypted the server can tell which packets are B frames and decide not to send them to slow clients. The actual data is still encrypted.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#135

Post by SkyPuncher »

killerpopiller wrote: post #60
riedel wrote: post #35

Earlier quoted context omitted.

Actually zoom despite its privacy concerns is on the whitelist for telemedical application by the insurers in Germany, so I think they understand how to play the game...

really? Psychotherapists are required to use one of the certified providers to be able to bill for tele sessions. https://www.kbv.de/media/sp/Liste_zertifizierte_Videodiensta...

Hipaa has additional restriction/controls for psychotherapy notes as they are considered highly sensitive. I'd expect this is the same line of thinking in Germany.

Discussing your heart disease or skin condition is sensitive, but it's not as sensitive as discussing deeply personal thoughts or inner monologues.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#136

Post by cpach »

tony101 wrote: post #48

Original title: "Zoom Meetings Aren't End-to-End Encrypted, Despite Misleading Marketing" For some reason, the title was trimmed an hour after submission to omit the "misleading marketing" part. The ranking also appears to have artificially been lowered. Now it is below some other posts that are older and with fewer points.

Regarding the ranking: This post is currently #1 on the front page.

It was posted around 08:00 UTC. In my experience it is generally very hard to get traction for a post that is posted before ~14:00 UTC. This is a site with lots of US users, and it’s still early on the west coast (07:18 PDT).

This post managed to climb to the top despite that, probably because Zoom is a company that is interesting to techies, the article is from a well-regarded news source (at least in this crowd), it covers misleading marketing, it’s a bit related to Covid-19 and it also touches the topic of E2EE.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#137

Post by krageon »

tony101 wrote: post #34
ignoramous wrote: post #22

Earlier quoted context omitted.

> The UK home secretary Amber Rudd has previously called encryption "completely unacceptable" ... Theresa May has said that the big internet companies give terrorists "safe spaces" to communicate. Ironically, the UK government in fact uses Zoom for all its meetings depsite privacy and security implications. Saudi Arabia, take note. Ref: https://www.businessinsider.com/coronavirus-boris-johnson-zo...

That's terrible for national security. Zoom engineers are based in China: https://www.cnbc.com/2019/03/26/zoom-key-profit-driver-ahead...

It doesn't matter where they're based. What matters is that Zoom isn't safe by any measure and tells you about that if you spend a little time reading critically.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#138

Post by cat199 »

the statement:

    The encryption that Zoom uses to protect meetings is TLS, the same
    technology that web servers use to secure HTTPS websites. This means
    that the connection between the Zoom app running on a user’s computer
    or phone and Zoom’s server is encrypted in the same way the connection
    between your web browser and this article (on https://theintercept.com)
    is encrypted. This is known as transport encryption, which is
    different from end-to-end encryption because the Zoom service itself
    can access the unencrypted video and audio content of Zoom meetings.
jumbles TLS with end to end. zoom could e.g. proxy or support rendevous of peer to peer connections and still use TLS to negotiate end-to-end encryption between the clients (though this would be MITMable). anyway.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#139

Post by prophesi »

imglorp wrote: post #80
tony101 wrote: post #46

Earlier quoted context omitted.

My problem with this is Zoom's misleading claims. If Zoom can't implement end-to-end encryption, it shouldn't claim that it does.

I think they would claim the terminology is ambiguous. If the connection is encrypted between all clients and the central server, a business person might say that's end-to-end, ie all traffic in flight. The real test is peer-to-peer or not.

I'm afraid of other services catching on to this "semantic loophole". Would changing the terminology to perhaps client-to-client encryption solve this?
Post reply on HN