Zoom to bring end-to-end encryption to all users, including non-paying • Hacker News Board

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#121

Post by botto » Wed, Jun 17, 2020, 5:33 PM UTC

damanamathos wrote: post #70

botto wrote: post #24

Earlier quoted context omitted.

Yes, if the keys are held in servers that they have access to then they would be able to decrypt the traffic and see what is happening. The whole point of e2e encryption is that only the 2 parties have the keys, Zoom are abusing this term and making people believe they are doing e2e

What makes you think they're abusing the term? Did you read their whitepaper? https://github.com/zoom/zoom-e2e-whitepaper

The whitepaper is fine, it's the comments from Alex Stemos that make me think they are abusing the term.

https://twitter.com/alexstamos/status/1268061792527241216

He did not say they can't monitor calls.

https://twitter.com/alexstamos/status/1268061795572314113

If they can enter the meeting, either they have to get confirmation from the host who would send the keys to the person entering the meeting or they already have the keys and can enter the meeting and decrypt the stream.

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#122

Post by pdkl95 » Wed, Jun 17, 2020, 5:34 PM UTC

Aunche wrote: post #103

fsflover wrote: post #6

"To make this possible, Free/Basic users seeking access to E2EE will participate in a one-time process that will prompt the user for additional pieces of information, such as verifying a phone number via a text message. Many leading companies perform similar steps on account creation to reduce the mass creation of abusive accounts." Perfect instrument to collect more personal data.

Is there any E2EE app that doesn't require verification? Whatsapp does. Even Signal requires a phone number.

https://otr.cypherpunks.ca/

https://en.wikipedia.org/wiki/Off-the-Record_Messaging

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#123

Post by coreypreston » Wed, Jun 17, 2020, 5:34 PM UTC

hypewatch wrote: post #93

I find this story arch with Zoom amusing: 1. Pre-COVID Zoom claims it has E2E encryption for everyone. 2. During COVID Zoom grows in popularity, which prompts journalists to learn that the claims that Zoom has E2E encryption are inaccurate. 3. Zoom admits that it never had true E2E encryption, but announces they will develop it and it will only be available for paying customers. 4. Zoom gets another wave of criticism…

They're 6 months away from becoming a case study in squandering momentum.

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#124

Post by inetknght » Wed, Jun 17, 2020, 5:34 PM UTC

hypewatch wrote: post #93

I find this story arch with Zoom amusing: 1. Pre-COVID Zoom claims it has E2E encryption for everyone. 2. During COVID Zoom grows in popularity, which prompts journalists to learn that the claims that Zoom has E2E encryption are inaccurate. 3. Zoom admits that it never had true E2E encryption, but announces they will develop it and it will only be available for paying customers. 4. Zoom gets another wave of criticism…

You mean to imply that a business would just lie to customers?

Come on, the market wouldn't permit that to happen! They'd lose all their customers!

/s

Edit: on a less sarcastic note, I'd be less critical of Zoom if their software were open source.

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#125

Post by gfodor » Wed, Jun 17, 2020, 5:35 PM UTC

SahAssar wrote: post #117

gfodor wrote: post #104

Earlier quoted context omitted.

But what's stopping the software from, say, having a backdoor that is only exposed under certain conditions? For example, if you are under an FBI investigation. I suppose you could automate the verification on a per-call basis. Unfortunately, every bit over the wire would need to be seen by a fool-proof algorithm to ensure your safety. Seems not tractable.

Agreed. You can only verify E2EE for the traffic you inspect, not for traffic you don't. If they open-sourced the client it'd help a lot, but I'd also like to point out that you probably have stuff in your current device that has DMA and network access that is not open source either (PSP, IME, 4G modem, and so on) and that could break that encryption too. If you are under serious investigation I wouldn't trust anythi…

Yup fair point. Circling back to Zoom, I think the trust part of this has been violated enough that such an inspector tool ought to be considered strictly necessary to use it if you are security minded. So in the end, there's not much of a point to the announcement imo.

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#126

Post by botto » Wed, Jun 17, 2020, 5:35 PM UTC

bonestamp2 wrote: post #75

ajzinsbwbs wrote: post #54

Earlier quoted context omitted.

If implemented correctly, the server doesn’t get the key. Look up Diffie–Hellman key exchange for more information on how this is possible. This can be verified by auditing the client so you don’t need to trust Zoom.

What do you mean by auditing the client... Like audit the source code or something that we could do independent of the source code? (serious question)

You can audit the client either through source code or through very painful binary analysis.

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#127

Post by surround » Wed, Jun 17, 2020, 5:36 PM UTC

> All Zoom users will continue to use AES 256 GCM transport encryption as the default encryption, one of the strongest encryption standards in use today.

I’m glad that Zoom is finally implementing E2E encryption, but I hate that they have been (and still are) advertising “full encryption” and using jargon like “AES 256 GCM” to deceive users into thinking they’re using anything more than SSL.

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#128

Post by smt88 » Wed, Jun 17, 2020, 5:36 PM UTC

ilikehurdles wrote: post #45

rootsudo wrote: post #33

Earlier quoted context omitted.

While I understand that on the surface seems "bad", you have to understand the CCP taps into people worldwide, and while I don't know his position per se, or finances -- or connection with China today. It doesn't paint a great picture, especially with espionage and CCP tactics. Look at previous German and USA interference w/ GE, Bosch, -- it's the same story. Except now it's highlight as "bad" to point out that conne…

I'm disgusted that in 2020, Americans continue to use the same racist, unfounded smears againts people based on their ethnicity just as they did when they were throwing Japanese-Americans into internment camps.

There are plenty of HN users who won't (or wouldn't, in an ideal world) use any US-based software because of NSA interference.

The issue is national origin, not ethnicity. Japanese Americans were thrown into camps for the same reason, but we're not talking about jailing anyone here. We're talking about avoiding a specific product.

Another difference is that Japanese Americans were put into camps regardless of how many generations removed from being Japanese they were. No one is arguing that CCP has control over Chinese Americans whose ancestors immigrated here in the 1800s. It's about people who literally grew up in China and/or still have close family there for CCP to threaten.

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#129

Post by bisby » Wed, Jun 17, 2020, 5:36 PM UTC

thevagrant wrote: post #112

hypewatch wrote: post #93

I find this story arch with Zoom amusing: 1. Pre-COVID Zoom claims it has E2E encryption for everyone. 2. During COVID Zoom grows in popularity, which prompts journalists to learn that the claims that Zoom has E2E encryption are inaccurate. 3. Zoom admits that it never had true E2E encryption, but announces they will develop it and it will only be available for paying customers. 4. Zoom gets another wave of criticism…

It wouldn't surprise me as recently the app tried to get me to trust an untrusted cert.

It's encrypted all the way from one end to the other end, we just also happen to have a copy of the key and can dencrypt it in the middle.

Technically, the exact packets of the data you send is E2E encrypted... but the copies they make for themselves aren't.

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#130

Post by sneak » Wed, Jun 17, 2020, 5:37 PM UTC

Now do Apple.

https://sneak.berlin/20200604/if-zoom-is-wrong-so-is-apple/

(Most of iCloud, including notes, photos(!), and backups, including your complete text message history(!!!), is not end to end encrypted for anyone, paid or otherwise.)