Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom meetings aren’t end-to-end encrypted, despite marketing

theintercept.com

Post reply on HN
Print view View original

241–250 of 351 posts

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#241

Post by michaelt »

sarakayakomzin wrote: post #90
michaelt wrote: post #41

Earlier quoted context omitted.

1. Clients negotiate end-to-end encryption session key between themselves the same way as a chat app would. 2. Each client sends the server two (or more) encrypted video streams, varying in bandwidth and keyframes per second, with unencrypted markers showing where they can be sliced and joined. If you can upload a 1080p stream, chances are you've got the bandwidth to send a 360p stream too! 3. Each client tells the s…

a few problems: >Clients negotiate end-to-end encryption session key between themselves the same way as a chat app would. how are you doing this exactly? a 50 way diffie-hellman that renegotiates every time a user leaves or joins? How do you plan on doing that without any substantial lag? >2. Each client sends the server two (or more) encrypted video streams, varying in bandwidth and keyframes per second you have man…

> how are you doing this exactly? a 50 way diffie-hellman that renegotiates every time a user leaves or joins?

By doing whatever Signal and Whatsapp do to support 50-person encrypted group chats.

> you have managed to double your egress

Not at all.

Firstly, the whole point of having two streams is to accommodate viewers with different bandwidth requirements, so the second stream will be a fraction the size of the first. If I'm already uploading HD video at 5 Mbps, and I start also sending an SD stream at 1 Mbps, my egress has risen by only 20%.

Secondly, the h264 spec provides for 'Scalable Video Coding' [1] where a high quality stream can have a lower quality 'subset bitstream' allowing a high-quality video to be converted to low quality by selectively dropping packets. So your egress might not rise by even 20%! Although this h264 feature is less widely used, potentially raising engineering costs.

[1] https://en.wikipedia.org/wiki/Scalable_Video_Coding

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#242

Post by SkyPuncher »

marcinzm wrote: post #170
SkyPuncher wrote: post #133

Earlier quoted context omitted.

Just an FYI, two weeks ago, CMS announced it would be suspending enforcement of telehealth tools used in good faith during the COVID pandemic. [0] Basically, if you are a family doc that's been thrown into the telehealth ringer, you can get started with everyday tools for video chat, like Facetime, Google Hangouts, Skype, etc - regardless of that tool's Hipaa compliance. Overtime I do expect they'll want to see provi…

As a note, HIPAA does not require end-to-end encryption as long as you have a BAA with the provider. Zoom has an option for a BAA starting at $200/month. edit: Server-client communication does need to be encrypted which zoom does.

It's a bit more nuanced. Hipaa (two a's) does not require the type end-to-end encryption that most devs come to think of.

Generally, Hipaa does require transport encryption from the client to the server processing the request. The importance here is SSL/TLS should be terminated at the app server.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#243

Post by m11a »

floatingatoll wrote: post #154

Zoom’s HIPAA product documentation does define Zoom’s “end-to-end encryption” as: https://zoom.us/docs/doc/Zoom-hipaa.pdf > Meeting data transmitted across the network is protected using a unique Advanced Encryption Standard (AES) with a 256-bit key generated and securely distributed to all participants at the start of each session. It does not guarantee that the key is withheld from the server, which is unsurprising…

I'm not sure a company can make their own definition of "end-to-end encryption" and say they're E2E because they meet their own definition of the term.

Sure, they're legally in the green perhaps. But this is not E2E, it is not the decades-long definition of E2E, and this is ultimately deceptive marketing.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#244

Post by lvh »

floatingatoll wrote: post #172
krageon wrote: post #137

Earlier quoted context omitted.

It doesn't matter where they're based. What matters is that Zoom isn't safe by any measure and tells you about that if you spend a little time reading critically.

It’s certainly no less safe than the backdoored-for-decades phone/fax networks used by medical professionals to discuss medical secrets with patients and send prescriptions to pharmacies. It’d be nice if it was more safe, but it’s hard to sink lower than a telco line.

You can send faxes to someone without the telco running a local webserver on your fax machine, and you don't run thousands of other applications on your fax machine, and your fax machine doesn't usually come with a nifty record feature, nor a camera and a microphone.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#245

Post by upofadown »

tialaramex wrote: post #100
upofadown wrote: post #86

Inherent to any e2e encryption scheme is the question; are you talking to who you think you are talking to? In other words; are you the victim of a man in the middle attack? So if you ever encounter a system that has the ease of use feature where you don't have to verify the identity of the other participant(s) with something like a identity fingerprint number then you already know you do not have all the protection…

It's true that you need an out-of-band verification to determine who the other party is in an end-to-end encrypted system. But it is not true that the absence of such a verification means you don't have end-to-end encryption. It means only that you don't know for sure who the other party is. You are only put at risk if there is an active MITM attack in progress. Depending on your threat model that's an enormous chang…

Just semantics at this point. A system that distributed the keys to all participants in the clear from a central server is still encrypted end to end in some sense. As pointed out by someone else in this comment section, the expression "end to end encryption" comes from the early day of PGP. PGP specifically protects against MITM with a fairly sophisticated web of trust system. So it is entirely legitimate to assume that e2e encryption includes MITM protection as a hard requirement.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#246

Post by organsnyder »

pulse7 wrote: post #200
organsnyder wrote: post #143

Earlier quoted context omitted.

There's the technical definition of "end-to-end" that we all know here—encrypted at one endpoint and decrypted at the other—but I'm wondering how well-understood that term is in broader context. I could see someone saying "end-to-end" encrypted meaning that each segment in the path is encrypted, but with the intermediate nodes decrypting and re-encrypting the payload. Perhaps we should try to come up with a more spec…

It seems that HN is flooded with commenters trying to redefine the well-established meaning of strong E2E encryption. I ask myself if there is any motivation for such comments?

No motivation at all. My only connection to Zoom (full disclosure) is that I own a small amount of their stock. My purpose in pointing this out is that what we understand as well-understood technical terms are easily confused when communicated to a larger audience. While we should absolutely criticize anyone misusing the term, we also need to take a step back and question whether we're communicating effectively to a non-technical audience.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#247

Post by kristianc »

lozf wrote: post #185
PudgePacket wrote: post #20

Earlier quoted context omitted.

Hopefully we've reconsidered the laws of mathematics in the last few years ... https://www.newscientist.com/article/2140747-laws-of-mathema... "“The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia,” said Turnbull. Turnbull’s comments came as he proposed a new law to force tech companies to give security services access to encrypted messages." "The UK home s…

> ... the [former] UK prime minister Theresa May has said that the big internet companies give terrorists “safe spaces” to communicate. Yes, IIRC she also said wanted to enter a dialogue about this "with the people that know the right hashtags"!

That was Amber Rudd.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#248

Post by KaoruAoiShiho »

SkyPuncher wrote: post #205
DCKing wrote: post #193

Earlier quoted context omitted.

You could argue whether the attack on Zoom is warranted. But don't start revising history to make your point. E2E has never meant that. There's no such "old notion". I can't find any sources saying HIPAA would use that deviating definition. Most sources I see use Whatsapp as an example, which is E2E under the proper definition.

> I can't find any sources saying HIPAA would use that deviating definition. That's because HIPAA does not define any implementation details. Google "Hipaa end to end encryption" and you'll quickly realize the Hipaa world uses a much looser definition than the security world. "End-to-end" in the context of Hipaa is typically used to indicate encryption (specifically SSL/TLS) of on-the-wire data through the entire req…

While I think people need to chill out on Zoom I can't find any alternative standards for end to end with HIPPA. Zoom fucked up here.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#250

Post by rurp »

PudgePacket wrote: post #20
mabcat wrote: post #13

End-to-end encryption has been named as a required feature for telehealth in Australia. Interest in telehealth has gone from zero to infinity over the past two weeks for obvious reasons. So I've been trying really hard to work out if Zoom is E2E, and reached the same conclusions as the article. First, it isn't, and second, Zoom are really going out of their way to obscure that fact. It's great that The Intercept is t…

Hopefully we've reconsidered the laws of mathematics in the last few years ... https://www.newscientist.com/article/2140747-laws-of-mathema... "“The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia,” said Turnbull. Turnbull’s comments came as he proposed a new law to force tech companies to give security services access to encrypted messages." "The UK home s…

> The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia,” said Turnbull.

Heh, that reminds me of the Indiana Pi Bill[0], where the state tried to legislate the value of pi to be 3.2.

[0]https://en.wikipedia.org/wiki/Indiana_Pi_Bill

Post reply on HN