Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom meetings aren’t end-to-end encrypted, despite marketing

theintercept.com

Post reply on HN
Print view View original

161–170 of 351 posts

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#161

Post by jefftk »

organsnyder wrote: post #143
tyingq wrote: post #57

Earlier quoted context omitted.

"Zoom for the Enterprise Secure and reliable End-to-end 256-bit AES encryption, data sovereignty, and role-based access control" Right on the front page. So, it would seem dishonest, yes.

There's the technical definition of "end-to-end" that we all know here—encrypted at one endpoint and decrypted at the other—but I'm wondering how well-understood that term is in broader context. I could see someone saying "end-to-end" encrypted meaning that each segment in the path is encrypted, but with the intermediate nodes decrypting and re-encrypting the payload. Perhaps we should try to come up with a more spec…

"End to end encryption" is the more specific term! The specific term for each segment being encrypted is "link encryption". The general term is plain "encryption".

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#162

Post by braythwayt »

Spivak wrote: post #151

Are people just looking for things to be mad at Zoom for at this point? When Zoom says E2E encryption they're using older notion when it was common for services to not use encryption at all for these kinds of things and it was somewhat of a technical accomplishment that every client-server-server-client leg was all encrypted. Like it's fine to point out that the bar has been raised in the security community and that…

You make a useful point about older definitions and/or the world of HIPAA, and nothing else you say dilutes or undermines that.

However, I take issue with your opening ad hominem abuse. People are looking for abuses of trust. That has nothing to do with “being mad at zoom.” That has everything to do with uncovering dishonest behaviour that is detrimental to the industry.

You positioning it as some kind of emotional crusade does a disservice to people who care about important matters like informed consent.

All that being said, the factual information you shared is valuable, and I thank you for it.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#163

Post by crazygringo »

This really is false marketing, but technically what they're doing seems reasonable. Key quote:

> Matthew Green, a cryptographer and computer science professor at Johns Hopkins University, points out that group video conferencing is difficult to encrypt end to end. That’s because the service provider needs to detect who is talking to act like a switchboard, which allows it to only send a high-resolution videostream from the person who is talking at the moment, or who a user selects to the rest of the group, and to send low-resolution videostreams of other participants. This type of optimization is much easier if the service provider can see everything because it’s unencrypted... This isn’t impossible, though, Green said, as demonstrated by Apple’s FaceTime, which allows group video conferencing that’s end-to-end encrypted. “It’s doable. It’s just not easy.”

Group videoconferencing is inherently centralized through a server that needs to analyze video/audio not only for signals as to who's talking, but also mix normalized audio and re-encode streams not just for lower thumbnail resolutions, but for clients with different bitrates.

I don't doubt that FaceTime finds a way to do this, but everyone is using Zoom instead because its performance is way better. I'm not entirely sure that all the necessary signal processing can be done performantly client-side, especially when you're allowing for a wide variety of endpoints (WebRTC, phone calls, etc.). You certainly can't mix encrypted audio (at least to the best of my knowledge?), for instance, which means increased bandwidth to everyone to handle overlapping speakers (someone interjecting "could I just say something?" while two other people are talking).

Also, handling key management for groups of people where you don't have the bandwidth to re-encrypt the stream separately for each receiver is very complex too, and in the end you're basically just going to have to trust that Zoom itself can't access the keys. Because usually Zoom will be able to, so that it can handle phone dial-ins.

But regardless... while Zoom should absolutely advertise full encryption, Zoom should absolutely not advertise end-to-end encryption. That's bad, and harms user trust in security overall when advertised technical terms become meaningless.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#164

Post by amelius »

Spivak wrote: post #151

Are people just looking for things to be mad at Zoom for at this point? When Zoom says E2E encryption they're using older notion when it was common for services to not use encryption at all for these kinds of things and it was somewhat of a technical accomplishment that every client-server-server-client leg was all encrypted. Like it's fine to point out that the bar has been raised in the security community and that…

That's messed up, how could the security community have allowed such ambiguity in terminology?

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#165

Post by PopeDotNinja »

jefftk wrote: post #158
Spivak wrote: post #151

Are people just looking for things to be mad at Zoom for at this point? When Zoom says E2E encryption they're using older notion when it was common for services to not use encryption at all for these kinds of things and it was somewhat of a technical accomplishment that every client-server-server-client leg was all encrypted. Like it's fine to point out that the bar has been raised in the security community and that…

I've always understood E2E to mean that it's encrypted from one end to the other, without any intermediate decryption stops. This is how https://en.wikipedia.org/wiki/End-to-end_encryption defines it, and has since it was a stub in 2007 ( https://en.wikipedia.org/w/index.php?title=End-to-end_encryp... ). Do you have any links for E2E being used in this "older" way?

A simple example could be something like using TLS or DTLS between all nodes in the network. But that doesn't mean data on a Zoom server sitting in the middle of a call is encrypted.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#166

Post by 2ion »

Spivak wrote: post #151

Are people just looking for things to be mad at Zoom for at this point? When Zoom says E2E encryption they're using older notion when it was common for services to not use encryption at all for these kinds of things and it was somewhat of a technical accomplishment that every client-server-server-client leg was all encrypted. Like it's fine to point out that the bar has been raised in the security community and that…

e2e always meant e2e. What you are referring to is transport encryption, which as seen doesn't mean execatly the same thing.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#167

Post by Kalium »

nschoe wrote: post #131
ekimekim wrote: post #29

Earlier quoted context omitted.

It looks like WebRTC doesn't support it, so basically no-one can because all these browser-based technologies end up just being WebRTC in the end. From the Jitsi Meet README: > WebRTC does not (yet) provide a way of conducting multi-party conversations with end-to-end encryption. Unless you consistently compare DTLS fingerprints with your peers vocally, the same goes for one-to-one calls.

I don't understand "WebRTC doesn't support it". What do you mean? WebRTC uses an external signalling channel to negotiate ICE candidates, codecs, and necessary information to establish a media communication. Once this is done, the visio/audio conference is P2P and encrypted from the caller to the callee: how is this not E2E? (Genuinely curious, not criticizing) That is, if you're not using a TURN relay server, which…

It sounds to me like you've nailed precisely what the Jitsi README is talking about. Full context from the README (https://github.com/jitsi/jitsi-meet/blob/master/README.md) is this:

> WebRTC does not (yet) provide a way of conducting multi-party conversations with end-to-end encryption. Unless you consistently compare DTLS fingerprints with your peers vocally, the same goes for one-to-one calls. As a result, your stream is encrypted on the network but decrypted on the machine that hosts the bridge when using Jitsi Meet.

> The Jitsi Meet architecture allows you to deploy your own version, including all server components. In that case, your security guarantees will be roughly equivalent to a direct one-to-one WebRTC call. This is the uniqueness of Jitsi Meet in terms of security.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#168

Post by unityByFreedom »

organsnyder wrote: post #143
tyingq wrote: post #57

Earlier quoted context omitted.

"Zoom for the Enterprise Secure and reliable End-to-end 256-bit AES encryption, data sovereignty, and role-based access control" Right on the front page. So, it would seem dishonest, yes.

There's the technical definition of "end-to-end" that we all know here—encrypted at one endpoint and decrypted at the other—but I'm wondering how well-understood that term is in broader context. I could see someone saying "end-to-end" encrypted meaning that each segment in the path is encrypted, but with the intermediate nodes decrypting and re-encrypting the payload. Perhaps we should try to come up with a more spec…

end-to-end isn't some marketing phrase like "the cloud", it has a technical meaning. They flat out lied

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#169

Post by DCKing »

PopeDotNinja wrote: post #165
jefftk wrote: post #158

Earlier quoted context omitted.

I've always understood E2E to mean that it's encrypted from one end to the other, without any intermediate decryption stops. This is how https://en.wikipedia.org/wiki/End-to-end_encryption defines it, and has since it was a stub in 2007 ( https://en.wikipedia.org/w/index.php?title=End-to-end_encryp... ). Do you have any links for E2E being used in this "older" way?

A simple example could be something like using TLS or DTLS between all nodes in the network. But that doesn't mean data on a Zoom server sitting in the middle of a call is encrypted.

The point is that the term "E2E encryption" was never used for "there is TLS involved". Because that's not what end-to-end means.

E2E encryption was always clearly defined as "only the two communicating parties can access the information". Using the term "E2E encryption" in other ways is deliberately confusing. Edit: and pretending that E2E encryption meant something else in some unspecified past is revising history.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#170

Post by marcinzm »

SkyPuncher wrote: post #133
mabcat wrote: post #13

End-to-end encryption has been named as a required feature for telehealth in Australia. Interest in telehealth has gone from zero to infinity over the past two weeks for obvious reasons. So I've been trying really hard to work out if Zoom is E2E, and reached the same conclusions as the article. First, it isn't, and second, Zoom are really going out of their way to obscure that fact. It's great that The Intercept is t…

Just an FYI, two weeks ago, CMS announced it would be suspending enforcement of telehealth tools used in good faith during the COVID pandemic. [0] Basically, if you are a family doc that's been thrown into the telehealth ringer, you can get started with everyday tools for video chat, like Facetime, Google Hangouts, Skype, etc - regardless of that tool's Hipaa compliance. Overtime I do expect they'll want to see provi…

As a note, HIPAA does not require end-to-end encryption as long as you have a BAA with the provider. Zoom has an option for a BAA starting at $200/month.

edit: Server-client communication does need to be encrypted which zoom does.

Post reply on HN