Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom rolled their own encryption scheme, transmit keys through servers in China

citizenlab.ca

Post reply on HN
Print view View original

131–140 of 316 posts

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#131

Post by eanzenberg »

_snsh wrote: post #63
gen3 wrote: post #2

This is honestly the best “Zoom is bad” summery I’ve seen so far. While I certainly believe some of the Zoom hate is blown out of proportion, this article does a good job explaining to someone who isn't a security expert what the issues are. I've been getting questions about the company from family and friends, and will be forwarding this to them. Well done.

This is a great article, but as an educational provider it fails to answer one question: Why should I care? The only concerning thing for me is, why would they lie about using AES-256 when none of my users (and I assume most of their users) would care in any way about AES-256 vs. AES-128 in ECB mode. Why would they lie? Even after this, having my users conducting university lessons over something that might be decryp…

You should care because Zoom is a company run by and within China. What's troubling for the west is having so much IP and information flowing through a bad state actor without knowing about it.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#132

Post by Judgmentality »

dang wrote: post #124

Matthew Green's article on this is has a thread here: https://news.ycombinator.com/item?id=22771193 The Intercept article on it has a thread here: https://news.ycombinator.com/item?id=22767807 It's probably too much of a stretch to merge all these, because many comments are about specifics of those posts, and the ones that aren't are kind of generic and so maybe not worth merging anyway ( https://hn.algolia.com/?date…

Hi dang,

Thanks in advance for all your moderation efforts that make HN the site we all love to use on a regular basis.

I'm curious if you've ever considered writing a blog post about some of the things you've learned from your years of moderation? You spend so much time on HN, you must have seen lots of patterns and have lots of insights on...well, everything that gets posted on HN to everybody that posts on HN. I'd genuinely be interested in reading it if you ever did.

Cheers, a semi-anonymous HN user

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#133

Post by cjhopman »

013a wrote: post #10

> Zoom’s most recent SEC filing shows that the company (through its Chinese affiliates) employs at least 700 employees in China that work in “research and development.” Wow. What could all of these people possibly be doing? It can't be development and QA; what's going on over there?

Skype had 500 employees in 2010 a year before they were acquired. 700 doesn't seem clearly out of proportion.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#134

Post by BurningFrog »

derision wrote: post #24
Leary wrote: post #21

Earlier quoted context omitted.

"Wow. What could all of these people possibly be doing?" There are 20,000 google engineers working in "research and development", what could all of these people possibly be doing?

Google is many orders of magnitudes larger than Zoom. Zoom has one product, Google has thousands of products, many more complex than Zoom.

Google has maybe 5 products that matter.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#135

Post by umeshunni »

tibbydudeza wrote: post #5

Zoom just works great ... just focus on making a better product (aggh Google Hangouts) than hyping up the hysteria by adding China to the mix. It is rather suspicious to see all the articles of late.

Nothing suspicious.

Zoom is in the news lately, so there are more researchers and others looking at their security practices.

Bloggers know that they'll get clicks by writing about Zoom.

China is just thrown in since they're the Boogieman in the US these days.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#136

Post by Leary »

Judgmentality wrote: post #132
dang wrote: post #124

Matthew Green's article on this is has a thread here: https://news.ycombinator.com/item?id=22771193 The Intercept article on it has a thread here: https://news.ycombinator.com/item?id=22767807 It's probably too much of a stretch to merge all these, because many comments are about specifics of those posts, and the ones that aren't are kind of generic and so maybe not worth merging anyway ( https://hn.algolia.com/?date…

Hi dang, Thanks in advance for all your moderation efforts that make HN the site we all love to use on a regular basis. I'm curious if you've ever considered writing a blog post about some of the things you've learned from your years of moderation? You spend so much time on HN, you must have seen lots of patterns and have lots of insights on...well, everything that gets posted on HN to everybody that posts on HN. I'd…

While you wait for his response:

https://www.newyorker.com/news/letter-from-silicon-valley/th...

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#137

Post by CamperBob2 »

_snsh wrote: post #103
gerdesj wrote: post #73

Earlier quoted context omitted.

"... and then they came for me". Obviously that poem was written about something rather more serious than your privacy but the point stands.

As I alluded to in another post I am from Germany and certain people I work with actually went through the "... they came for me" phase. Your point does not stand on its own.

Your point does not stand on its own.

No, but it will when the next generation of Nazi, Stalinist, and Maoist regimes arise and gain access to the data in question because we weren't fanatical enough about E2E privacy today.

And just as Niemoeller's verse warns, by then it will be too late.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#138

Post by WheelsAtLarge »

"Zoom, a Silicon Valley-based company, appears to own three companies in China through which at least 700 employees are paid to develop Zoom’s software. This arrangement is ostensibly an effort at labor arbitrage: Zoom can avoid paying US wages while selling to US customers, thus increasing their profit margin. However, this arrangement may make Zoom responsive to pressure from Chinese authorities."

I'm not here to defend zoom but any and all companies that can do this have and are doing the very same thing to minimize costs. It's not great but it's the expected way of managing a software company in 2020. It would be hard to do business otherwise.

Whether it's good or bad that's a question that will need to be reexamined given the current situation.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#139

Post by _jal »

monocasa wrote: post #87
stouset wrote: post #53

Earlier quoted context omitted.

Compression already makes a compressed file roughly indistinguishable from random noise (module access to the decompressor). So the patterns have been removed. That doesn’t make this good , but it means that one specific example isn’t immediately applicable.

There's more in the stream than just compressed data. There'll be metadata info that you can make reasonable guesses about. ECB mode lets you take that information and apply it to other blocks in the ciphertext.

This thread is an excellent illustration of why you don't want your encryption implemented by merely good coders. You need people who know what they are doing.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#140

Post by eyegor »

_snsh wrote: post #63
gen3 wrote: post #2

This is honestly the best “Zoom is bad” summery I’ve seen so far. While I certainly believe some of the Zoom hate is blown out of proportion, this article does a good job explaining to someone who isn't a security expert what the issues are. I've been getting questions about the company from family and friends, and will be forwarding this to them. Well done.

This is a great article, but as an educational provider it fails to answer one question: Why should I care? The only concerning thing for me is, why would they lie about using AES-256 when none of my users (and I assume most of their users) would care in any way about AES-256 vs. AES-128 in ECB mode. Why would they lie? Even after this, having my users conducting university lessons over something that might be decryp…

> Why would they lie?

I kind of doubt it was intentional. Developers are not marketing, typically, and it seems reasonable to assume that a technical person said "aes" when a marketing person asked "do we have encryption?". And then the marketing person searched for "aes" and assumed that meant "aes-256".

Post reply on HN