Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom meetings aren’t end-to-end encrypted, despite marketing

theintercept.com

Post reply on HN
Print view View original

321–330 of 351 posts

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#321

Post by ThePowerOfFuet »

marcinzm wrote: post #178
Adverblessly wrote: post #66

Earlier quoted context omitted.

> I'm pretty sure that Google Meet isn't end-to-end encrypted either. Nothing that Google does is. To the best of my understanding, they say that it is https://support.google.com/a/answer/7582940?hl=en EDIT: On rereading they actually just say that it is encrypted, not neccesarily end-to-end encrypted.

Isn't 128-bit AES and SHA-1 fairly weak encryption nowadays?

128-bit AES is not "weak" by any definition of the term.

SHA-1 is deprecated but it's good enough for this application for the near future.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#322

Post by glennpratt »

organsnyder wrote: post #143
tyingq wrote: post #57

Earlier quoted context omitted.

"Zoom for the Enterprise Secure and reliable End-to-end 256-bit AES encryption, data sovereignty, and role-based access control" Right on the front page. So, it would seem dishonest, yes.

There's the technical definition of "end-to-end" that we all know here—encrypted at one endpoint and decrypted at the other—but I'm wondering how well-understood that term is in broader context. I could see someone saying "end-to-end" encrypted meaning that each segment in the path is encrypted, but with the intermediate nodes decrypting and re-encrypting the payload. Perhaps we should try to come up with a more spec…

Yes, this term has been used in the industry for always encrypted on the wire and at rest, but not "never decrypted" over the years.

If you think about it for hosted services that provide non-trivial functions for your data, you'd see the definition of e2e we apply to messenging apps would never apply.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#323

Post by cbsmith »

pthatcherg wrote: post #288
cbsmith wrote: post #280

Earlier quoted context omitted.

That would seem to require significantly more upload bandwidth & compression capacity from clients, which is often not broadly available to consumers. I guess you could drop down to the lowest resolution only when sending to the service if you have a bandwidth challenge, but that seems less than ideal.

Lots of video conferencing systems already work this way (the SFU way). Compared to just sending the full resolution all the time, adding the smaller resolutions doesn't add that much bandwidth and compression because they are so much smaller.

But a lot of video conferencing systems are designed for office environments, where you tend to have symmetric bandwidth.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#324

Post by cbsmith »

berkes wrote: post #253
cbsmith wrote: post #251

Earlier quoted context omitted.

I don't know that Zoom is really going out of its way to obscure that it is not E2E. I never for a second thought they were doing E2E when I enabled the encryption. It was very clear from how the features was described that you got TLS to Zoom's servers, not E2E.

They literally call it "an end to end encrypted connection" and "secure with end to end encryption". How is this "clear" that it is not E2E?

Because I live in a world where that term is pretty ambiguous because they aren't security experts.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#325

Post by rstuart4133 »

SamuelAdams wrote: post #88
mabcat wrote: post #13

End-to-end encryption has been named as a required feature for telehealth in Australia. Interest in telehealth has gone from zero to infinity over the past two weeks for obvious reasons. So I've been trying really hard to work out if Zoom is E2E, and reached the same conclusions as the article. First, it isn't, and second, Zoom are really going out of their way to obscure that fact. It's great that The Intercept is t…

Hold on, E2E encryption is now required for telehealth in Australia, yet the Australian government passed laws that required LEO's to have access to E2E encrypted data [1]? How are tech companies supposed to comply with that? [1]: https://www.wired.com/story/australia-encryption-law-global-...

The law actually requires the companies MITM the video to give them access. It doesn't place any requirement on the end user.

So use a solution that doesn't put a company in the middle. Use open source, E2E encrypt with keys secured by the user and not central server and you are good. One solution available now - Signal.

Despite the heat being laid on Zoom, they have no choice. Any platform that does mixing to produce a composite image with Picture in Picture like Zoom does has no choice. That includes Hangouts, Skype and so on. They do it to save bandwidth - something I've been grateful for.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#326

Post by cyphar »

marcus_holmes wrote: post #305
cyphar wrote: post #277

Earlier quoted context omitted.

They are because they provide services to Australians and have an Australian subsidiary -- just as anyone in Australia must comply with a warrant or any other lawful request by law enforcement.

If they employ a single Aussie developer, or have foreign developers on Australian soil, the government can coerce those developer to insert anything they like.

This is not quite true, though it was reported widely. The legislation doesn't consider individuals as "designated communications providers" if they work for one (unless they are self-employed or sole traders). The way it works is that your employer gets a TCN and then they disclose it to the employees necessary to implement it.

But note that if you have an Australian employee (unless they are a sole trader / contractor) you must already have an Australian subsidiary of your company (for tax and superannuation reasons).

Don't get me wrong, I am absolutely opposed to this legislation and think it is a draconian overstep of government power which (despite the PR spin doled out by the government) was absolutely not necessary for effective law enforcement. But it's best not to fall into the trap of overstating what the law actually allows the government to do.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#327

Post by ccktlmazeltov »

mabcat wrote: post #58
gtirloni wrote: post #44

Earlier quoted context omitted.

Where does it say they have e2e video encryption? I can only find something about chats.

https://zoom.us/healthcare "Achieve HIPAA (signed BAA) and PIPEDA/PHIPA compliance with complete end-to-end 256-bit AES encryption."

1. HIPAA et al have very specific meaning that do not have anything to do with end-to-end encryption at all. If you know this, read this line, and care about HIPAA you know exactly this.

2. end-to-end has several meanings, for users it means what Signal does, for machines it means TLS is securing edges.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#328

Post by ccktlmazeltov »

phonon wrote: post #304
ccktlmazeltov wrote: post #6

Earlier quoted context omitted.

TBF it's mostly short sellers doing this, because the complaints have been... poor. The first one was about an advertisement pixel, which everybody is doing but for some reason surfaced only for Zoom. The second one is end-to-end encryption, which is not expected at all for VC apps. NOBODY does it!

> NOBODY does it! Google Duo does. https://support.google.com/duo/answer/9280240?hl=en

It is not a VC application, it's a user chat application

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#329

Post by ccktlmazeltov »

fsh wrote: post #10
ccktlmazeltov wrote: post #6

Earlier quoted context omitted.

TBF it's mostly short sellers doing this, because the complaints have been... poor. The first one was about an advertisement pixel, which everybody is doing but for some reason surfaced only for Zoom. The second one is end-to-end encryption, which is not expected at all for VC apps. NOBODY does it!

I really hope that this stupid "short seller conspiracy" meme is going away soon. According to the article Apple does end-to-end encryption for video conferences. Also other providers are not lying about it like zoom does.

Apple has a VC product? I wasn't aware of this

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#330

Post by lonelappde »

SkyPuncher wrote: post #242
marcinzm wrote: post #170

Earlier quoted context omitted.

As a note, HIPAA does not require end-to-end encryption as long as you have a BAA with the provider. Zoom has an option for a BAA starting at $200/month. edit: Server-client communication does need to be encrypted which zoom does.

It's a bit more nuanced. Hipaa (two a's) does not require the type end-to-end encryption that most devs come to think of. Generally, Hipaa does require transport encryption from the client to the server processing the request. The importance here is SSL/TLS should be terminated at the app server.

HIPAA (all caps)
Post reply on HN