Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom rolled their own encryption scheme, transmit keys through servers in China

citizenlab.ca

Post reply on HN
Print view View original

71–80 of 316 posts

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#71

Post by DevKoala »

colanderman wrote: post #51
kop316 wrote: post #30

Earlier quoted context omitted.

> Using AES in ECB mode is clearly a bad choice, but honestly it's not that horrible for high entropy data like compressed audio/video. I'm sure someone could prove me wrong one day, but it seems hard to extract any useful patterns out of compressed audio/video. ...you're joking right? The Wikipedia example for why ECB is not recommended is literally an image: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operat…

No comment on the original claim, but that example is encryption applied to an uncompressed image. (Adjacent identical pixels are not typically represented individually when compressed, and thus encryption could not cause the banding patterns seen in those regions of the image if it were compressed prior to encryption.)

Seriously. The main argument of this article is assuming Zoom encrypts uncompressed video data. That is not what is happening here.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#72

Post by dividedbyzero »

lutorm wrote: post #61
thedudeabides5 wrote: post #48

Earlier quoted context omitted.

I mean, isn't this stuff they can fix? Like good that the market is stressing them on their security, at $30bn they should be able to engage with that feedback and then loop. On the other hand, tried to use Skype lately? Product has barely evolved since they were bought out by MSFT. Guess google does videoconferencing too, but they know enough about us all already....

They can fix the code, but would people trust them when they say that the code is fixed? Trust needs to be earned.

People trust them even though their security is broken. Lots of people don't know, lot don't care, quite a few probably don't get it anyway.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#73

Post by gerdesj »

_snsh wrote: post #63
gen3 wrote: post #2

This is honestly the best “Zoom is bad” summery I’ve seen so far. While I certainly believe some of the Zoom hate is blown out of proportion, this article does a good job explaining to someone who isn't a security expert what the issues are. I've been getting questions about the company from family and friends, and will be forwarding this to them. Well done.

This is a great article, but as an educational provider it fails to answer one question: Why should I care? The only concerning thing for me is, why would they lie about using AES-256 when none of my users (and I assume most of their users) would care in any way about AES-256 vs. AES-128 in ECB mode. Why would they lie? Even after this, having my users conducting university lessons over something that might be decryp…

"... and then they came for me". Obviously that poem was written about something rather more serious than your privacy but the point stands.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#74

Post by api »

WalterBright wrote: post #68
AshamedCaptain wrote: post #62

Seriously, all people who are surprised about this type of news should really understand that most "successful" (as in, popular) tech/.com/SV "startups" these days are like this. If you "waste" time on the real important stuff such as a good design, user security, or the like, you will lose over to a competitor who didn't and therefore was able to spend more time on marketing. If you waste your time on user privacy y…

I more suspect it is a problem stemming from hiring people who are all new to professional programming. Avoiding these issues means hiring some older, experienced professionals.

Those cost more.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#75

Post by restingrobot »

dpeck wrote: post #70
restingrobot wrote: post #66

Earlier quoted context omitted.

This is a bad point. The difference between using AES-128 and AES-256 from a code standpoint is trivial. The only explanation for this is either gross incompetence or malevolence. Personally I don't use Zoom, nor would I recommend its use for even personal conversation.

the difference is a copy and paste from an older StackOverflow post.

Using code without understanding its implications would fall in the gross incompetence category.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#76

Post by jonmartinwest »

AshamedCaptain wrote: post #62

Seriously, all people who are surprised about this type of news should really understand that most "successful" (as in, popular) tech/.com/SV "startups" these days are like this. If you "waste" time on the real important stuff such as a good design, user security, or the like, you will lose over to a competitor who didn't and therefore was able to spend more time on marketing. If you waste your time on user privacy y…

I think you might be missing the bigger picture. You have a company that the "Ministry of State Security of the People's Republic of China" can easily hack to spy on American children and businesses. What could go wrong?

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#77

Post by restingrobot »

api wrote: post #41

Why can't people bother to construct a minimally secure encryption system given that there are so many good documents and code examples out there? I don't mean anything with ratcheting, forward secrecy, replay protection, nonce reuse resistance, or any other bells and whistles, just basic competent symmetric encryption without gaping holes or ridiculous bizarre design choices? It's not hard! (1) Generate 12 bytes of…

Or use TLS end to end like a normal company...

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#78

Post by AshamedCaptain »

restingrobot wrote: post #75
dpeck wrote: post #70

Earlier quoted context omitted.

the difference is a copy and paste from an older StackOverflow post.

Using code without understanding its implications would fall in the gross incompetence category.

And my point is that this happens all the time. Natural selection seems to favor the type of company that would just copy&paste from SO (then spend their resources on some fancy viral marketing) instead of the one that would stop to think about it.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#79

Post by WalterBright »

api wrote: post #74
WalterBright wrote: post #68

Earlier quoted context omitted.

I more suspect it is a problem stemming from hiring people who are all new to professional programming. Avoiding these issues means hiring some older, experienced professionals.

Those cost more.

Much cheaper than trying to put out the fires caused by not using them.

Experience costs more because it pays off.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#80

Post by anaphor »

staticassertion wrote: post #55
miked85 wrote: post #42

Earlier quoted context omitted.

If the encryption scheme is poor, why would the data being compressed or not matter?

It's harder to extract patterns from high entropy data. I don't think anyone's saying that this is even an OK thing to rely on, at all, just that the nature of the data means that this specific weakness is likely more difficult to take advantage of. If zoom were transmitting text this would be relatively more serious.

What about the chat system? I doubt they're intentionally compressing the text there in order to increase the entropy. I guess they could be using gzip or whatever, but we'd need to look at how the protocol works in more detail. Or do they use a different system for the chat protocol altogether?
Post reply on HN