Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom rolled their own encryption scheme, transmit keys through servers in China

citizenlab.ca

Post reply on HN
Print view View original

171–180 of 316 posts

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#171

Post by 013a »

cjhopman wrote: post #133
013a wrote: post #10

> Zoom’s most recent SEC filing shows that the company (through its Chinese affiliates) employs at least 700 employees in China that work in “research and development.” Wow. What could all of these people possibly be doing? It can't be development and QA; what's going on over there?

Skype had 500 employees in 2010 a year before they were acquired. 700 doesn't seem clearly out of proportion.

500 employees versus 700 R&D employees.

If that 700 count is including support staff, then it becomes slightly more believable, but even then, I'd expect Zoom to be at that 700-1500 number in terms of total employees, not just R&D.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#173

Post by [deleted] »

userbinator wrote: post #164
sudosysgen wrote: post #153

Earlier quoted context omitted.

Untrue. Many performance trade-offs have to be made and the entropy has to vary drastically with time. See for example B-Frames vs I-frames in compressed video. Couple that with the very low entropy video conference data and bam.

Two words: sensor noise. Even uncompressed video will be hard to see that "penguin image effect" in, because the pixels that make up each block will be constantly changing in a random way, and unlike that synthetically generated image, it's highly unlikely for a block to be the exact same as any other one in any given frame.

[deleted]

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#174

Post by 013a »

ziyao_w wrote: post #19
013a wrote: post #10

> Zoom’s most recent SEC filing shows that the company (through its Chinese affiliates) employs at least 700 employees in China that work in “research and development.” Wow. What could all of these people possibly be doing? It can't be development and QA; what's going on over there?

You do realize development include software engineering, right? 700 people doing programming isn't even remotely surprising. Not to defend them against the recent security fiasco, but innuendos such as this that links "employees working in China" directly with "shady business" makes me at least uncomfortable.

To be more clear, I meant "it can't only be development and QA". Meaning, there has to be something else included in that number that is not traditional R&D.

Also, to be clear: the statement is meant from the perspective of, how do they have that many employees (what are they all doing); not "why" do they have that many (which, while seemingly very large, I am not in a position to judge), nor meant to be a slander against outsourcing R&D work to China (though, to be crystalline clear, I inherently trust Zoom less because of this, just like I trust companies who base or outsource R&D to Australia less because of Australia's laws on these matters).

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#175

Post by tptacek »

tialaramex wrote: post #167
tptacek wrote: post #129

The serverside key handling stuff is bad, but generally known (Zoom has features whose natural implementation require them to keep keys serverside). People are dunking on Zoom for rolling their own crypto and coming up with AES-128-ECB. This is also bad, but people should be aware that it's a lot more complicated than "you can see penguins through it". You can see penguins through an ECB-encrypted bitmap because disc…

Encouraging companies to lie by just writing it off when they're caught is an under-appreciated problem. If I'm honest and I'm working on a video conferencing platform, a potential customer asks "Do you have End-to-end encryption?". I say honestly "No". The customer goes to Zoom because they lied and said they do. Any outcome where Zoom keeps even _some_ of the resulting customers and money rewards deceit and ensures…

I've read this comment a couple times and am not clear whether or where you see the potential for useful leaks through repeated aligned plaintext blocks to occur, either in VBR AAC or in H264 video. I am spitballing and would welcome specific feedback on this if you have it; if you're speculating, can you force your speculation to the form of a test case we can go implement? We don't have to use Zoom; a reasonable model of the codecs Zoom uses would suffice for discussion's sake.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#176

Post by [deleted] »

Leary wrote: post #136
Judgmentality wrote: post #132

Earlier quoted context omitted.

Hi dang, Thanks in advance for all your moderation efforts that make HN the site we all love to use on a regular basis. I'm curious if you've ever considered writing a blog post about some of the things you've learned from your years of moderation? You spend so much time on HN, you must have seen lots of patterns and have lots of insights on...well, everything that gets posted on HN to everybody that posts on HN. I'd…

While you wait for his response: https://www.newyorker.com/news/letter-from-silicon-valley/th...

[deleted]

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#178

Post by bad_user »

_snsh wrote: post #141
gerdesj wrote: post #121

Earlier quoted context omitted.

I (en_GB) lived in that weird place called West Germany for about 10 years on and off back in the 70s and 80s. We have many friends (Hi Wurms, int al) who also have family, friends and acquaintances that lived through those days directly, shall we say, and of course my own family members who did from another side and perspective. You may want to take another look at my username and make of that what you will. My poin…

I'm not going to play "guess what my username means" with you, sorry. I'm also not going to play "who knows more people that lived through the 3rd reich" with you. Me administering a Zoom account for my fellow employees and my students does not erode anybodies right. For me it is a choice between a GDPR compliant vendor and a vendor that does not care about the GDPR. Personally I have had good experiences with the GD…

Zoom also claims to have end-to-end encryption and yet they don't, their marketing and even their clarification post being a lie.

Companies like Zoom can claim that they are GDPR compliant however truth of the matter is that compliance offices are overwhelmed. And until Zoom will have a huge data leak or something nobody is going to investigate their compliance.

So a company like Zoom might claim GDPR compliance and that's something, but only if you can trust them.

And a company that lies in their marketing and press releases can't be trusted, sorry.

Google's Meet btw is also GDPR compliant, Google tries to be GDPR compliant nowadays with everything they do because they are a huge target. They also don't use bullshit in their marketing and are pretty good at security, so I personally trust them more, even if I actively avoid Google's products out of privacy concerns.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#179

Post by discordance »

thedudeabides5 wrote: post #48
jasonv wrote: post #3

Earlier quoted context omitted.

I think of it as a warning to future companies who take these kind of liberties...

I mean, isn't this stuff they can fix? Like good that the market is stressing them on their security, at $30bn they should be able to engage with that feedback and then loop. On the other hand, tried to use Skype lately? Product has barely evolved since they were bought out by MSFT. Guess google does videoconferencing too, but they know enough about us all already....

It’ll take a new CEO before people will trust them again, kind of like what happened at Uber.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#180

Post by miked85 »

fennecfoxen wrote: post #50
miked85 wrote: post #42

Earlier quoted context omitted.

If the encryption scheme is poor, why would the data being compressed or not matter?

"The use of ECB mode is not recommended because patterns present in the plaintext are preserved during encryption."

absolutely - I was asking why a poor encryption scheme would be considered acceptable just because the data is compressed.
Post reply on HN