Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom meetings aren’t end-to-end encrypted, despite marketing

theintercept.com

Post reply on HN
Print view View original

141–150 of 351 posts

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#141

Post by snarf21 »

tialaramex wrote: post #100
upofadown wrote: post #86

Inherent to any e2e encryption scheme is the question; are you talking to who you think you are talking to? In other words; are you the victim of a man in the middle attack? So if you ever encounter a system that has the ease of use feature where you don't have to verify the identity of the other participant(s) with something like a identity fingerprint number then you already know you do not have all the protection…

It's true that you need an out-of-band verification to determine who the other party is in an end-to-end encrypted system. But it is not true that the absence of such a verification means you don't have end-to-end encryption. It means only that you don't know for sure who the other party is. You are only put at risk if there is an active MITM attack in progress. Depending on your threat model that's an enormous chang…

Additionally, just because you have o-o-b verification, that still doesn't mean that it is e2ee. Until you can view the source and build it yourself, who knows what back doors could exist. But this is the challenge, how do you balance security and convenience? People, by and large, aren't building source and side loading. They are going to have to take a leap and trust someone. It is a very hard problem to solve. Generally, no one cares until the one bad thing happens, then they care immensely. I've said that it is hard to get people to care about privacy when they live stream and share pictures of their life every 30 minutes already.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#142

Post by krageon »

bad_user wrote: post #43
mabcat wrote: post #13

End-to-end encryption has been named as a required feature for telehealth in Australia. Interest in telehealth has gone from zero to infinity over the past two weeks for obvious reasons. So I've been trying really hard to work out if Zoom is E2E, and reached the same conclusions as the article. First, it isn't, and second, Zoom are really going out of their way to obscure that fact. It's great that The Intercept is t…

End-to-end encryption is hard to implement, might cost more processing or bandwidth or storage (depending on the product) and does not yield benefits for companies interested in processing user data. If it's not clearly advertised on the front page, _emphasized_ and not a foot note, then it's NOT e2e encrypted. Example: https://signal.org

Given that Signal doesn't have reproducible builds and may therefore have absolutely anything inside of it's distributed binaries, I'm not sure if this is meant to be a good or a bad example.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#143

Post by organsnyder »

tyingq wrote: post #57
Flimm wrote: post #4

This is not "slightly" dishonest on Zoom's part. It is dishonest. Edit: now that the title has been modified, I feel I need to add back context. Zoom claims to support end-to-end encryption when it doesn't. That is dishonest.

"Zoom for the Enterprise Secure and reliable End-to-end 256-bit AES encryption, data sovereignty, and role-based access control" Right on the front page. So, it would seem dishonest, yes.

There's the technical definition of "end-to-end" that we all know here—encrypted at one endpoint and decrypted at the other—but I'm wondering how well-understood that term is in broader context. I could see someone saying "end-to-end" encrypted meaning that each segment in the path is encrypted, but with the intermediate nodes decrypting and re-encrypting the payload. Perhaps we should try to come up with a more specific term? Or we should at least be aware of the potential for confusion.

Not excusing Zoom here—they should know better.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#144

Post by elliekelly »

SamuelAdams wrote: post #88
mabcat wrote: post #13

End-to-end encryption has been named as a required feature for telehealth in Australia. Interest in telehealth has gone from zero to infinity over the past two weeks for obvious reasons. So I've been trying really hard to work out if Zoom is E2E, and reached the same conclusions as the article. First, it isn't, and second, Zoom are really going out of their way to obscure that fact. It's great that The Intercept is t…

Hold on, E2E encryption is now required for telehealth in Australia, yet the Australian government passed laws that required LEO's to have access to E2E encrypted data [1]? How are tech companies supposed to comply with that? [1]: https://www.wired.com/story/australia-encryption-law-global-...

This is a fairly small/simple example but a significant (yet hidden) portion of compliance is figuring out how best to "comply" with conflicting regulations. Everyone always complains about the operational cost of compliance but the expense that goes into making these decisions (risk assessment, lawyers, senior executive time, board meetings, etc.) is where compliance quickly gets very costly IMO.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#145

Post by banads »

slgeorge wrote: post #81
mtthwn wrote: post #45

Earlier quoted context omitted.

Honest question, what do you find is better about zoom? Compared to webex, skype, slack call… What do people like about zoom?

It works. 1. It's actually cross-platform: - Still can't use Webex across Linux, Windows and Mac in 2020. - Same goes for Skype, plus half the users who have Skype don't realise it's Linc and the two are completely different. 2. It's far more bandwidth efficient than things like Slack. The codecs are much more resilient, this applies (from what I can tell) to all the embedded options that are just using the browser.…

>Still can't use Webex across Linux, Windows and Mac in 2020.

Have you tried just running webex in a browser? Works fine for me on Chrome in windows or linux

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#146

Post by krageon »

relaunched wrote: post #126
viraptor wrote: post #96

Earlier quoted context omitted.

Google provides close captioning for meet calls. That means it's not E2E. Also pretty much no service can provide multi-party video call with adaptive quality without completely destroying your bandwidth.

I'm interested in knowing more about why closed captions would imply not end-to-end encrypted. Wouldn't it be possible to build a model and distribute the model with the client-side application, and run it at the edge?

If they did that, everyone would have the model (meaning you would see closed captions in a lot more places, because it would absolutely be stolen).

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#147

Post by Krasnol »

XelNika wrote: post #121
Krasnol wrote: post #118

Earlier quoted context omitted.

Yeah, it was picked up because it was a much bigger deal. Now the issues are a smaller deal but are still being picked up. Most people I work with haven't even heard about Zoom until those last months when they've been forced to use a teleconference for the first time in their lifes. They also probably didn't even hear about the issue last year too.

I'm still not convinced this coverage is in any way related to Zoom's current popularity or COVID-19, I just think a company that keeps fucking up is a better story than a one-off.

Most of the articles over here in Germany don't even mention the last fuck up and the news about the company are now beyond the tech media.

You may not be convinced even after you attributed to my argument but it won't change anything about the facts.

Edit: since I can't post in god knows how long due to the wonderful stfu tech here on hn here are sources for german media:

https://www.google.ch/search?q=zoom&complete=0&source=lnms&t...

It's all over and I find it very curious that you've not been able to find anything in Danish media even though it looks the same for the english speaking outlets.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#148

Post by lorenzhs »

krageon wrote: post #142
bad_user wrote: post #43

Earlier quoted context omitted.

End-to-end encryption is hard to implement, might cost more processing or bandwidth or storage (depending on the product) and does not yield benefits for companies interested in processing user data. If it's not clearly advertised on the front page, _emphasized_ and not a foot note, then it's NOT e2e encrypted. Example: https://signal.org

Given that Signal doesn't have reproducible builds and may therefore have absolutely anything inside of it's distributed binaries, I'm not sure if this is meant to be a good or a bad example.

Signal for Android has had reproducible builds since 2016: https://signal.org/blog/reproducible-android/

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#149

Post by Krasnol »

mulmen wrote: post #115
Krasnol wrote: post #84

Earlier quoted context omitted.

Well, they became the popular go to solution because the other popular solutions suck. Now they are also in the focus of privacy interested media and therefore end up becoming stories. The Intercept didn't care about Zoom a few months ago and wouldn't have without Corona.

Zoom has been doing shady shit forever. Last year it was for installing a web server on localhost to save a click then dragging their feet on a fix when told how stupid that is.

They may have been doing that forever but that doesn't change anything about my argument.

They just were not as popular as they are these days which makes them much more newsworthy and which is why we're seeing constant new articles about them now about issues that have been there for a long time but which were not newsworthy a few months ago.

Edit: no, I'm not defending them. I just explain why they are all over the news these days.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#150

Post by SamuelAdams »

SkyPuncher wrote: post #133
mabcat wrote: post #13

End-to-end encryption has been named as a required feature for telehealth in Australia. Interest in telehealth has gone from zero to infinity over the past two weeks for obvious reasons. So I've been trying really hard to work out if Zoom is E2E, and reached the same conclusions as the article. First, it isn't, and second, Zoom are really going out of their way to obscure that fact. It's great that The Intercept is t…

Just an FYI, two weeks ago, CMS announced it would be suspending enforcement of telehealth tools used in good faith during the COVID pandemic. [0] Basically, if you are a family doc that's been thrown into the telehealth ringer, you can get started with everyday tools for video chat, like Facetime, Google Hangouts, Skype, etc - regardless of that tool's Hipaa compliance. Overtime I do expect they'll want to see provi…

Note this only applies to the USA, other countries might not have loosened their regulations quite yet.
Post reply on HN