Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom meetings aren’t end-to-end encrypted, despite marketing

theintercept.com

Post reply on HN
Print view View original

201–210 of 351 posts

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#201

Post by pulse7 »

Spivak wrote: post #151

Are people just looking for things to be mad at Zoom for at this point? When Zoom says E2E encryption they're using older notion when it was common for services to not use encryption at all for these kinds of things and it was somewhat of a technical accomplishment that every client-server-server-client leg was all encrypted. Like it's fine to point out that the bar has been raised in the security community and that…

It seems that HN is flooded with commenters trying to redefine the well-established meaning of strong E2E encryption. I ask myself if there is any motivation for such comments?

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#202

Post by lozf »

mtthwn wrote: post #52

I used wire before is opensourced parts of the backend. I thought it was well designed and interesting. They claim to be the only video conferencing with end to end encryption that is opensource. https://wire.com/en/features/encrypted-voice-video/ Has anyone followed wire more closely?

I've heard nothing about Wire recently.

Wickr.com is another similar service that claims to be end-to-end encrypted, but again I haven't seen much about them at all.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#203

Post by supermatt »

PopeDotNinja wrote: post #179
DCKing wrote: post #169

Earlier quoted context omitted.

The point is that the term "E2E encryption" was never used for "there is TLS involved". Because that's not what end-to-end means. E2E encryption was always clearly defined as "only the two communicating parties can access the information". Using the term "E2E encryption" in other ways is deliberately confusing. Edit: and pretending that E2E encryption meant something else in some unspecified past is revising history.

With true E2E encryption, could you support features like recording a video and making it available for download? If yes, does that reflect how their video recording features work now?

Sure you could. Either a participants client records the stream and uploads, or a ‘recording client’ is added to the conversation by the service.

However, I think the real value of mitm is more to do with redistribution of streams and muxing to reducing total bandwidth over that required by a full e2e encrypted p2p mesh. I.e one upload vs one per peer (although this could also be done with e2e encryption with multiple recipients and simply routing through the service) and potentially a single download too (depending on how the muxing is done), rather than one per peer (but this couldn’t be done with e2e encryption).

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#204

Post by 101404 »

PopeDotNinja wrote: post #179
DCKing wrote: post #169

Earlier quoted context omitted.

The point is that the term "E2E encryption" was never used for "there is TLS involved". Because that's not what end-to-end means. E2E encryption was always clearly defined as "only the two communicating parties can access the information". Using the term "E2E encryption" in other ways is deliberately confusing. Edit: and pretending that E2E encryption meant something else in some unspecified past is revising history.

With true E2E encryption, could you support features like recording a video and making it available for download? If yes, does that reflect how their video recording features work now?

Yes, of course you can. But the recording has to be done on one of the clients.

Then the other client can download the video via the same e2e tunnel.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#205

Post by SkyPuncher »

DCKing wrote: post #193
Spivak wrote: post #151

Are people just looking for things to be mad at Zoom for at this point? When Zoom says E2E encryption they're using older notion when it was common for services to not use encryption at all for these kinds of things and it was somewhat of a technical accomplishment that every client-server-server-client leg was all encrypted. Like it's fine to point out that the bar has been raised in the security community and that…

You could argue whether the attack on Zoom is warranted. But don't start revising history to make your point. E2E has never meant that. There's no such "old notion". I can't find any sources saying HIPAA would use that deviating definition. Most sources I see use Whatsapp as an example, which is E2E under the proper definition.

> I can't find any sources saying HIPAA would use that deviating definition.

That's because HIPAA does not define any implementation details. Google "Hipaa end to end encryption" and you'll quickly realize the Hipaa world uses a much looser definition than the security world.

"End-to-end" in the context of Hipaa is typically used to indicate encryption (specifically SSL/TLS) of on-the-wire data through the entire request process. Practically this means on-the-wire data needs to be protected all the way to the underlying app service.

For example, if you're running Rails with Docker. SSL/TLS transport needs to be present all the way to the container. A load balancer (or other device) is allowed to terminate/re-encrypt as long as on-the-wire data remains protected.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#206

Post by xorcist »

Spivak wrote: post #151

Are people just looking for things to be mad at Zoom for at this point? When Zoom says E2E encryption they're using older notion when it was common for services to not use encryption at all for these kinds of things and it was somewhat of a technical accomplishment that every client-server-server-client leg was all encrypted. Like it's fine to point out that the bar has been raised in the security community and that…

> E2E in healthcare means exactly what Zoom is doing

In what context is E2E used within HIPAA in any other context than "not accessible by intermediaries"?

Having no experience with HIPAA but plenty with PCI DSS, where E2EE is used only in this regular sense, it is easy to find public HIPAA compliance checklists which are very explicit about the end-to-end part and hard to find anyone that would allow Zoom-like uses.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#207

Post by braythwayt »

threatofrain wrote: post #189
braythwayt wrote: post #162

Earlier quoted context omitted.

You make a useful point about older definitions and/or the world of HIPAA, and nothing else you say dilutes or undermines that. However, I take issue with your opening ad hominem abuse. People are looking for abuses of trust. That has nothing to do with “being mad at zoom.” That has everything to do with uncovering dishonest behaviour that is detrimental to the industry. You positioning it as some kind of emotional c…

The “fact” that E2E has an older meaning in industry seems very hard to chase down right now. We also have the problem that if we accept this as honest or acceptable marketing language, then Apple and Google should be allowed to engage in similar standards of marketing language.

I do not think Zoom are being honest about this matter. What they are is “encrypted in transit.” I appreciate that there may be %REASONS% that E2E is unachievable given the feature set they wish to provide, but to me, that juts means they should be up front.

“All Zoom communications are encrypted-in-transit. We do process them on our servers to provide features like X, Y, or Z.”

Would they lose even one sale if they said this?

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#208

Post by Krasnol »

m-p-3 wrote: post #122
Krasnol wrote: post #84

Earlier quoted context omitted.

Well, they became the popular go to solution because the other popular solutions suck. Now they are also in the focus of privacy interested media and therefore end up becoming stories. The Intercept didn't care about Zoom a few months ago and wouldn't have without Corona.

I must say that Google Meet has been a smooth experience at work, but if I had to go with a privacy-focused solution, that'd be Jitsi and not Zoom.

My best example is a friend who needed a video conference fast and needed an alternative to WebEx which stopped recognizing his video feed from one day to another (I couldn't find a solution for that too). Jitsi doesn't work for more then two. We tried to set up teams. Took too long (I tried it again a week later, people had issues with the invites, some got audio error messages even though it worked with zoom... we gave up). So I went for zoom. EVERYBODY (old people, first time video conferencing) was able to install it and it just worked flawlessly. Even I was surprised.

This is what people need these days and this is why Zoom is so popular.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#209

Post by tomarr »

Spivak wrote: post #151

Are people just looking for things to be mad at Zoom for at this point? When Zoom says E2E encryption they're using older notion when it was common for services to not use encryption at all for these kinds of things and it was somewhat of a technical accomplishment that every client-server-server-client leg was all encrypted. Like it's fine to point out that the bar has been raised in the security community and that…

Agree.

Also surely one of the limitations here is technical / usability. One of the big features of Zoom is transcoding streams from all manner of devices and sending them to all manner of devices. Doing this on the fly is still computationally demanding and not feasible for consumer devices (or the E's in the true E2E model).

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#210

Post by maerF0x0 »

> In fact, Zoom is using its own definition of [end-to-end encryption], one that lets Zoom itself access unencrypted video and audio from meetings.

It's not a standard. If you want compliance to a standard then create/adopt/require one. When you go by marketing materials all you have is "Trust us, everything will be fine"

Post reply on HN