Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom meetings aren’t end-to-end encrypted, despite marketing

theintercept.com

Post reply on HN
Print view View original

331–340 of 351 posts

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#331

Post by fulafel »

rstuart4133 wrote: post #325
SamuelAdams wrote: post #88

Earlier quoted context omitted.

Hold on, E2E encryption is now required for telehealth in Australia, yet the Australian government passed laws that required LEO's to have access to E2E encrypted data [1]? How are tech companies supposed to comply with that? [1]: https://www.wired.com/story/australia-encryption-law-global-...

The law actually requires the companies MITM the video to give them access. It doesn't place any requirement on the end user. So use a solution that doesn't put a company in the middle. Use open source, E2E encrypt with keys secured by the user and not central server and you are good. One solution available now - Signal. Despite the heat being laid on Zoom, they have no choice. Any platform that does mixing to produc…

PIP or other effects can be done well on client side eg with WebGL or nultiple canvases.

Possibly you can save on BW by server processing - far from "no choice" however.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#332

Post by cbsmith »

pthatcherg wrote: post #288
cbsmith wrote: post #280

Earlier quoted context omitted.

That would seem to require significantly more upload bandwidth & compression capacity from clients, which is often not broadly available to consumers. I guess you could drop down to the lowest resolution only when sending to the service if you have a bandwidth challenge, but that seems less than ideal.

Lots of video conferencing systems already work this way (the SFU way). Compared to just sending the full resolution all the time, adding the smaller resolutions doesn't add that much bandwidth and compression because they are so much smaller.

Actually I'm calling BS on this. Zoom is literally adjusting frame rates at the single frame per second level. There is definitely upload pressure. SFU isn't going to be enough.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#333

Post by londons_explore »

anticensor wrote: post #276
londons_explore wrote: post #15

Earlier quoted context omitted.

End to End encryption in conferences of >2 participants causes substantial quality degradation for the same bandwidth use, since you can't have a central server re encoding streams to produce low quality streams for those participants who need it. I believe zooms reputation as being more likely to 'just work' in part hinges on that,

If end-to-end symmetrical is not feasible then use fully homomorphic public key encryption, which will allow operations without decryption.

Show me any system allowing video re-encoding with this...

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#334

Post by devin »

mbesto wrote: post #254
slgeorge wrote: post #81

Earlier quoted context omitted.

It works. 1. It's actually cross-platform: - Still can't use Webex across Linux, Windows and Mac in 2020. - Same goes for Skype, plus half the users who have Skype don't realise it's Linc and the two are completely different. 2. It's far more bandwidth efficient than things like Slack. The codecs are much more resilient, this applies (from what I can tell) to all the embedded options that are just using the browser.…

> It works. Crazy theory, so just hear me out for a second. Maybe the fact that they do some things that violate security is the reason that "it just works". I'm not saying Zoom shouldn't do better here, I'm just saying that there are probably legitimate product/business reasons. From Steve Yegge's platform rant:[0] Like anything else big and important in life, Accessibility has an evil twin who, jilted by the unbala…

None of their dark patterns or shenanigans make it easier to use. They don't make it harder, but they really do nothing for the user experience.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#335

Post by marcus_holmes »

cyphar wrote: post #326
marcus_holmes wrote: post #305

Earlier quoted context omitted.

If they employ a single Aussie developer, or have foreign developers on Australian soil, the government can coerce those developer to insert anything they like.

This is not quite true, though it was reported widely. The legislation doesn't consider individuals as "designated communications providers" if they work for one (unless they are self-employed or sole traders). The way it works is that your employer gets a TCN and then they disclose it to the employees necessary to implement it. But note that if you have an Australian employee (unless they are a sole trader / contrac…

useful correction, thanks :)

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#336

Post by JoeAltmaier »

noahtallen wrote: post #300
libraryatnight wrote: post #294

Earlier quoted context omitted.

When our company picked up Zoom we did a test and had 100 users all on camera and it worked flawlessly.

We had 500 people on a meeting yesterday. Not all broadcasting, but plenty still sending video. Works just as well as a 3 person call.

Very cool! They got the conference server stuff right then. Its critical to manage bandwidth, share streams, have backpressure at every stage. So easy to have packets pile up at unexpected places (bufferbloat-like) and experience delayed audio or dropouts.

Also, resilience thru network changes and weird packet behavior. Back then we encountered home routers that would drop 50% (every other) UDP packets! And reorder UDP, which is very much better to survive and recover than to drop.

As I recall, our product would let you walk around with your laptop, roaming from Wifi to Wifi, plugging and unplugging your wired connection, and it would switch seamlessly to the new network, all streams intact.

That was a cool product. Sigh.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#337

Post by ric2b »

tzs wrote: post #314
mox1 wrote: post #94

Earlier quoted context omitted.

How do you E2E encrypt a video stream and still allow adaptive bit rates? If the server can't read (decrypt) the video, it cannot re-encode the video at different bitrates for different clients. Or the Zoom client has to encode multiple steams and upload them locally...or it just downgrades to the bitrate of the slowest client... You get shitty video and E2E encryption or good video and transport encryption.

Note: what follows is probably not how anyone actually does it. It is just an illustration that adaptive video is not incompatible with E2E encryption. Suppose you have a block of 4 pixels, represented by 4 24-bit values. Instead of sending the 4 pixel values, send one 24-bit value that is the average of all 4 pixel values, and then the actual 24-bit values for 3 of the 4 pixels. The receiver can figure out the 4th p…

> Suppose you have a block of 4 pixels, represented by 4 24-bit values. Instead of sending the 4 pixel values, send one 24-bit value that is the average of all 4 pixel values, and then the actual 24-bit values for 3 of the 4 pixels.

So you still send 4*24 bits? what's the point?

> If something transporting this needs to lower the bandwidth, it can just drop the E2E discrete pixel stream, leaving just the E2E average stream. The receiver can then use that average value for all 4 pixels, in effect getting a video that is 1/2 the resolution both horizontally and vertically.

But you need knowledge of this protocol, so the sender is the only one able to do this. In that case just encode the downsampled resolution and send that, no tricks needed.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#338

Post by jp10558 »

pubstik wrote: post #258
m3kw9 wrote: post #188

Earlier quoted context omitted.

Because you think of the millions of streams going on, Zoom will snoop on yours? I mean as a security issue it isn’t black or white, you are always having some detrimental issue trade off and by chance. Use face time, have janky video cut offs etc lose productivity, man hours. That’s a trade off. Use zoom, Zoom may broad cast your video to your competitors and you lose money, what is more likely though?

Security through obscurity is a fantasy, and a dangerous one. You start thinking your screen door matters to the bear sauntering by, smelling what you're cooking, and coming in for a snack.

Sure. However I don't think he's promoting security through obscurity so much as figuring out his threat model and risk acceptance. For most businesses and end users who love Zoom, everything else they've tried has failed to do the thing acceptably. Like, they probably are more secure in so far as not enough people can successfully use them, so doing no video conferencing is more secure than doing some video conferencing.

And to be honest, most business stuff is by unencrypted e-mail, so I don't see how a TLS encrypted Video Chat increases their exposure.

Finally, the chance of someone, even zoom, recording and analyzing all the video conferences ever to somehow get important info from a video conference seems pretty low anyway. Unless you're worried about the NSA, and even then, it seems like they'd have a way into WebEx etc also, so even on risk.

At this point, it seems reasonable to go by what works for people. And Zoom works.

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#339

Post by phonon »

ccktlmazeltov wrote: post #328
phonon wrote: post #304

Earlier quoted context omitted.

> NOBODY does it! Google Duo does. https://support.google.com/duo/answer/9280240?hl=en

It is not a VC application, it's a user chat application

You can have a group call with up to 12 people now. https://www.neowin.net/news/google-duo-now-supports-up-to-12...

Re: Zoom meetings aren’t end-to-end encrypted, despite marketing

#340

Post by allover »

jp10558 wrote: post #338
pubstik wrote: post #258

Earlier quoted context omitted.

Security through obscurity is a fantasy, and a dangerous one. You start thinking your screen door matters to the bear sauntering by, smelling what you're cooking, and coming in for a snack.

Sure. However I don't think he's promoting security through obscurity so much as figuring out his threat model and risk acceptance. For most businesses and end users who love Zoom, everything else they've tried has failed to do the thing acceptably. Like, they probably are more secure in so far as not enough people can successfully use them, so doing no video conferencing is more secure than doing some video conferen…

tl;dr of your comment is "I don't care about privacy, if the product works".

But privacy is not about those privileged enough to where privacy doesn't matter.

I don't care that you don't care. Privacy matters.

Post reply on HN