Zoom meetings aren’t end-to-end encrypted, despite marketing • Hacker News Board

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#231

Post by lvh » Tue, Mar 31, 2020, 3:43 PM UTC

101404 wrote: post #213

maze-le wrote: post #54

Earlier quoted context omitted.

Number one reason we dropped JIRA.

Why? How is it related to Jira?

Atlassian is an Australian company, headquartered in Sydney, though the current plc is legally in the UK. (I have no idea if that means they're bound by said backdoor law.)

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#232

Post by ThePowerOfFuet » Tue, Mar 31, 2020, 3:44 PM UTC

101404 wrote: post #213

maze-le wrote: post #54

Earlier quoted context omitted.

Number one reason we dropped JIRA.

Why? How is it related to Jira?

Atlassian is based in Australia.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#233

Post by albedoa » Tue, Mar 31, 2020, 3:45 PM UTC

narsil wrote: post #23

I am willing to chalk this up to an honest mistake considering "end-to-end" encryption as being from the client's end to the server, although that's not the accepted use of the term. This appears to be their explanation. I hope their marketing team fixes this now that it's been pointed out to them though.

Since this comment was written, narsil (Vinod Chandruis) has edited his profile to remove the fact that he is a co-founder of Kloudless. You can see it cached in google search results:

https://www.google.com/search?q=narsil+kloudless

Kloudless is currently promoting security solutions on their twitter timeline.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#234

Post by octorian » Tue, Mar 31, 2020, 3:45 PM UTC

hipaulshi wrote: post #221

Do people still remember Telegram don't have E2E encryption on by default? and does not work across multiple platforms when E2E is on? I am annoyed because those are my favorite apps and they don't have what's important.

No, they still have to be constantly reminded.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#235

Post by upofadown » Tue, Mar 31, 2020, 3:46 PM UTC

marcinzm wrote: post #178

Adverblessly wrote: post #66

Earlier quoted context omitted.

> I'm pretty sure that Google Meet isn't end-to-end encrypted either. Nothing that Google does is. To the best of my understanding, they say that it is https://support.google.com/a/answer/7582940?hl=en EDIT: On rereading they actually just say that it is encrypted, not neccesarily end-to-end encrypted.

Isn't 128-bit AES and SHA-1 fairly weak encryption nowadays?

>128-bit AES

Perfectly fine...

>SHA-1

You missed the important bit:

>SHA-1 HMAC

Also perfectly fine...

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#236

Post by hota_mazi » Tue, Mar 31, 2020, 3:48 PM UTC

Short version: Zoom video is encrypted to external attackers but not to Zoom (the company) itself.

This is important because the company could be compelled to release such videos if subpoena'ed, or they could also simply be hacked.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#237

Post by munkiefish » Tue, Mar 31, 2020, 3:49 PM UTC

krageon wrote: post #146

relaunched wrote: post #126

Earlier quoted context omitted.

I'm interested in knowing more about why closed captions would imply not end-to-end encrypted. Wouldn't it be possible to build a model and distribute the model with the client-side application, and run it at the edge?

If they did that, everyone would have the model (meaning you would see closed captions in a lot more places, because it would absolutely be stolen).

Google translate and Google Gboard offer offline voice to text transcription... So it would seem the model is indeed on your device, and Google says as such - http://ai.googleblog.com/2019/03/an-all-neural-on-device-spe...

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#238

Post by nathanlied » Tue, Mar 31, 2020, 3:52 PM UTC

jaywalk wrote: post #217

threatofrain wrote: post #186

Earlier quoted context omitted.

“Military grade encryption” might’ve sold better too.

Don't forget another marketing favorite: "Bank-level encryption"

"Bank-level cryptography" with some of them still storing passwords in cleartext, and others made a very painful transition to unsalted md5 within the last 5 years because they "couldn't budget it in" any earlier.

No, thanks.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#239

Post by f38zf5vdt » Tue, Mar 31, 2020, 3:53 PM UTC

pulse7 wrote: post #201

Spivak wrote: post #151

Are people just looking for things to be mad at Zoom for at this point? When Zoom says E2E encryption they're using older notion when it was common for services to not use encryption at all for these kinds of things and it was somewhat of a technical accomplishment that every client-server-server-client leg was all encrypted. Like it's fine to point out that the bar has been raised in the security community and that…

It seems that HN is flooded with commenters trying to redefine the well-established meaning of strong E2E encryption. I ask myself if there is any motivation for such comments?

Have you been introduced to our new comment lord and savior, sentiment-based NLP models adjusted to context?

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#240

Post by ds » Tue, Mar 31, 2020, 3:54 PM UTC

So, I got around a issue like this in the past by using url fragments. I imagine the same thing could work for zoom?

Basically you would join a meeting by going to zoom.us/meeting-id-number#secrethashtag

The "secrethashtag" is never sent to the server, but can be accessed by javascript on the client end. Im not sure if this would be acceptable for security nuts though, as I am sure they would make the argument zoom could insert some nefarious js to intercept the url fragment.