SpaceX bans Zoom over privacy concerns • Hacker News Board

Re: SpaceX bans Zoom over privacy concerns

#211

Post by diebeforei485 » Thu, Apr 02, 2020, 8:40 AM UTC

dgcupps wrote: post #105

modeless wrote: post #97

Earlier quoted context omitted.

Yes, it does. The messages are 'end to end' encrypted in the iMessage service, but then iMessage backs up its encryption key in the iCloud backup service, defeating the point. "If you have iCloud Backup turned on, your backup includes a copy of the key protecting your Messages. This ensures you can recover your Messages if you lose access to iCloud Keychain and your trusted devices." https://support.apple.com/en-us/H…

That is true of any end-to-end solution. If you back up your private keys, anyone who has access to your backup would be able to access the encrypted messages. Remember, you can turn off iCloud backup if you're worried about Apple accessing your keys. Ultimately, it's false to equate iMessage's encryption scheme, which is end-to-end, to an encryption scheme that requires a server to relay decrypted data.

Turning off iCloud backup is not a genuine choice, because it means you lose everything if you lose or break your phone (there is no other way to back up your phone except iCloud backup, Apple does not allow third-party phone backup services).

Re: SpaceX bans Zoom over privacy concerns

#212

Post by diebeforei485 » Thu, Apr 02, 2020, 8:42 AM UTC

_ph_ wrote: post #204

The problem with Zoom isn't, that it doesn't have end-to-end encryption. If you consider the problem, it is extremely difficult to solve, as in contrast to a 1:1 video call, the server somehow has to to multiplex the streams and thus at least some access to them. With a trustworthy provider, this isn't a big issue. A trustworthy provider will have a clear policy which ensures that only the multiplexer has access to t…

FaceTime seems to do it well enough. It's limited to ~30 people per call though.

Re: SpaceX bans Zoom over privacy concerns

#213

Post by tiborsaas » Thu, Apr 02, 2020, 8:46 AM UTC

hunter2_ wrote: post #98

macrael wrote: post #25

Earlier quoted context omitted.

they appear to have already changed this to "your client connection is encrypted"

That must have a hilarious commit message.

update priavcy bullshit txt

Re: SpaceX bans Zoom over privacy concerns

#214

Post by simonh » Thu, Apr 02, 2020, 8:46 AM UTC

modeless wrote: post #141

jedieaston wrote: post #137

Earlier quoted context omitted.

There’s a good HN thread from earlier this year about that, but basically, you can disable iCloud Backup and enable Messages in the Cloud, so that all of the messages are still backed up and synced between your devices but the keys are not, so that Apple can not read them. Then you can back up to your Mac/PC instead.

But unless everyone you correspond with does this too, Apple can still read your messages to them.

Sure, the security of your communications to someone depends on how well they protect them, not just you. That’s always true.

Re: SpaceX bans Zoom over privacy concerns

#215

Post by giantDinosaur » Thu, Apr 02, 2020, 8:47 AM UTC

lern_too_spel wrote: post #207

peteretep wrote: post #206

Earlier quoted context omitted.

Sorry, let's be explicit here, as you seem intent on muddying the issue. Where, other than the endpoints, is the message decrypted when people use iMessage? Your succinct answer to that will clear this up for everyone.

On GCBD's servers in China. Possibly on Apple's servers in the US if they are running a wiretap. Due to the way key distribution works for iMessage, it is trivial for Apple and GCBD to do so. https://news.ycombinator.com/item?id=22755903

Apple can, of course, do whatever it likes, up to simply recording the screen and sending that to weird & wonderful government agencies. Like almost everything in mainstream security, it comes down to who you trust. It doesn't mean it isn't E2E though.

Re: SpaceX bans Zoom over privacy concerns

#216

Post by garyclarke27 » Thu, Apr 02, 2020, 8:52 AM UTC

I use MS Teams in my company, seems to work very well, great quality video, I’m don’t fully understand the security issues with Zoom, so I’m curious, does anyone know how MS Teams compares to Zoom?? The school my kids go to (in Portugal) also use Teams, for online learning, seems to be working well for them now. (Europe had issues a few weeks ago with Teams, when most of the schools first closed)

Re: SpaceX bans Zoom over privacy concerns

#217

Post by Dylan16807 » Thu, Apr 02, 2020, 8:54 AM UTC

modeless wrote: post #198

Dylan16807 wrote: post #195

Earlier quoted context omitted.

If iMessage was made by a third party and worked exactly the same then you'd have no objection to calling it end-to-end encrypted?

No. This is a necessary condition for being end-to-end encrypted, not a sufficient one. But iMessage doesn't meet it.

Okay, so if I can't guess your point of view, then it would really help if you would answer the question I asked about desktop apps.

Re: SpaceX bans Zoom over privacy concerns

#218

Post by [deleted] » Thu, Apr 02, 2020, 8:58 AM UTC

damanamathos wrote: post #66

nilkn wrote: post #41

Zoom is such a bizarre product. For huge video calls, it tends to perform as well or better than everything else out there. Yet at the same time it literally seems like straight-up malware and seems to violate your trust and privacy left and right every step of the way, even in the installer (!).

It was one of the fastest-growing SAAS companies before coronavirus hit despite all the free competition. The reason? "It just works." It's clear their singular focus on making it "just work" for even the least tech-savvy users has led them to prioritise user experience over security/privacy. I imagine a rebalancing is coming.

[deleted]

Re: SpaceX bans Zoom over privacy concerns

#219

Post by simonh » Thu, Apr 02, 2020, 9:00 AM UTC

shirro wrote: post #71

I feel very conflicted on Zoom. It mostly just works and on every platform, even Linux. My kids use it to do their music lessons now. It really is very good at what it does in a time when such solutions are needed. Also they responded to the mobile facebook sdk issue and the macos issue quickly. But I agree the way they suggest it is end to end encrypted is misleading. I don't think it really can be end to end to get…

They did not address the OSX issue for ages. They claimed it was intentional and a valuable feature for customers. In the end Apple had to release a security update to remove the web server.

Re: SpaceX bans Zoom over privacy concerns

#220

Post by LatteLazy » Thu, Apr 02, 2020, 9:00 AM UTC

garyclarke27 wrote: post #216

I use MS Teams in my company, seems to work very well, great quality video, I’m don’t fully understand the security issues with Zoom, so I’m curious, does anyone know how MS Teams compares to Zoom?? The school my kids go to (in Portugal) also use Teams, for online learning, seems to be working well for them now. (Europe had issues a few weeks ago with Teams, when most of the schools first closed)

I believe...

MS Teams is better but you have to pay for it (and maybe it's complex to implement too).

Zoom is free (and supports large numbers of participants which other free alternatives don't). Also meetings can be setup with about 4 mouse clicks by the user himself with no other kit than a browser in Zoom. Getting your art department home workers to correctly

It has been weird watching people insist we use zoom because it supports so many users, when there are only three of us actually in a meeting. So the cynic in my suspects it's being used by (say) schools and universities (as the Skype limit was 32 people, now 50). And other people have assumed it's better since Harvard\Cambridge use it, so now they use it for 4 people...