341–350 of 351 posts
Are people just looking for things to be mad at Zoom for at this point? When Zoom says E2E encryption they're using older notion when it was common for services to not use encryption at all for these kinds of things and it was somewhat of a technical accomplishment that every client-server-server-client leg was all encrypted. Like it's fine to point out that the bar has been raised in the security community and that…
Earlier quoted context omitted.
If they did that, everyone would have the model (meaning you would see closed captions in a lot more places, because it would absolutely be stolen).
Google translate and Google Gboard offer offline voice to text transcription... So it would seem the model is indeed on your device, and Google says as such - http://ai.googleblog.com/2019/03/an-all-neural-on-device-spe...
I am willing to chalk this up to an honest mistake considering "end-to-end" encryption as being from the client's end to the server, although that's not the accepted use of the term. This appears to be their explanation. I hope their marketing team fixes this now that it's been pointed out to them though.
Kloudless is currently promoting security solutions on their twitter timeline.
Earlier quoted context omitted.
Note: what follows is probably not how anyone actually does it. It is just an illustration that adaptive video is not incompatible with E2E encryption. Suppose you have a block of 4 pixels, represented by 4 24-bit values. Instead of sending the 4 pixel values, send one 24-bit value that is the average of all 4 pixel values, and then the actual 24-bit values for 3 of the 4 pixels. The receiver can figure out the 4th p…
> Suppose you have a block of 4 pixels, represented by 4 24-bit values. Instead of sending the 4 pixel values, send one 24-bit value that is the average of all 4 pixel values, and then the actual 24-bit values for 3 of the 4 pixels. So you still send 4*24 bits? what's the point? > If something transporting this needs to lower the bandwidth, it can just drop the E2E discrete pixel stream, leaving just the E2E average…
It's that server that wants to be able to dynamically downgrade outgoing feeds based on the bandwidth between it and the meeting participants, which can vary from participant to participant.
Alice, for example, might be on a symmetric gig fiber connection with consistent and low latency. Her client can send a high resolution feed to the server. Bob might have no trouble with receiving that, but Carol might be on slower, less stable connection, and need a lower resolution version.
If you aren't trying to do E2E encryption, you can handle this by having the server deal with taking the high resolution feed from Alice and generating a low resolution feed and then sending the other participants whichever is the best version they can handle. That works because without E2E encryption the server actually has access to the video, so it can do things like resample and re-encode.
If you are using E2E though then the only parties that should have access to the video itself are the meeting participants. The server should not have access to the video except in encrypted form.
The problem then is how to encode and encrypt a video stream in such a way that a server that is copying that stream between a sender and one or more recipients can alter a copy of the stream in such a way as to reduce the resolution even though it does not have access to unencrypted video?
Earlier quoted context omitted.
Components of the GB 5g network are also being outsourced to China. Some of the ruling party's MP's are not happy about it.
The noisy back-benchers are a little silly as all of Huawei's work is scrutenised: https://www.wired.co.uk/article/huawei-gchq-security-evaluat... Of course, in the UK, calling Tory back-benchers "a little silly" is an understatement.
What if Huawei was Russian, would it still be "a little silly"?
Earlier quoted context omitted.
I really hope that this stupid "short seller conspiracy" meme is going away soon. According to the article Apple does end-to-end encryption for video conferences. Also other providers are not lying about it like zoom does.
Apple has a VC product? I wasn't aware of this
Earlier quoted context omitted.
Actually zoom despite its privacy concerns is on the whitelist for telemedical application by the insurers in Germany, so I think they understand how to play the game...
It's not (see the list in the sibling comment). To get certified you need to transport the video/audio stream peer-to-peer between the clients only and end-to-end encrypted, see § 5 of the agreement https://www.kbv.de/media/sp/Anlage_31b_Videosprechstunde.pdf The regulatory bodies took some time to understand the issues and this is why it took so long until it arrived at all. Private consultations not billed through…
I am willing to chalk this up to an honest mistake considering "end-to-end" encryption as being from the client's end to the server, although that's not the accepted use of the term. This appears to be their explanation. I hope their marketing team fixes this now that it's been pointed out to them though.
Since this comment was written, narsil (Vinod Chandruis) has edited his profile to remove the fact that he is a co-founder of Kloudless. You can see it cached in google search results: https://www.google.com/search?q=narsil+kloudless Kloudless is currently promoting security solutions on their twitter timeline.
I'm not really seeing how this is relevant or how the post is justified. People edit their profiles all the time, and have a right to. It's up to them what they want to put in there. This comment seems to be crossing into personal attack and a mild sort of doxxing. Please don't go there on HN.
Also, please don't repost comments that were flag-killed (https://news.ycombinator.com/item?id=22738656).
Earlier quoted context omitted.
Given that Signal doesn't have reproducible builds and may therefore have absolutely anything inside of it's distributed binaries, I'm not sure if this is meant to be a good or a bad example.
Signal for Android has had reproducible builds since 2016: https://signal.org/blog/reproducible-android/
Earlier quoted context omitted.
It doesn't matter where they're based. What matters is that Zoom isn't safe by any measure and tells you about that if you spend a little time reading critically.
If they're based in Australia they can be legally coerced into installing any code the Australian government feels like telling them to insert. So I'm not sure that China is much worse.