Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom to bring end-to-end encryption to all users, including non-paying

blog.zoom.us

Post reply on HN
Print view View original

161–170 of 557 posts

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#161

Post by [deleted] »

Nextgrid wrote: post #134
gonehome wrote: post #100

Earlier quoted context omitted.

Yeah - I'm pretty sure this is the real concern and verifying a phone number is reasonable trade-off. I know this argument is often quickly dismissed on HN since people see child abuse or 'going dark' as an easy excuse for the government to leverage to get more control (and it has been used for this), but that doesn't mean the problem isn't serious or doesn't exist. See this: https://www.nytimes.com/interactive/2019/…

> The people carrying out the abuse are sophisticated. In this case wouldn't they build their own solutions (potentially based on existing open-source solutions like Asterisk + Linphone or Jitsi Meet) or they might've built them already? Phone numbers are also very easy to obtain anonymously, so I am not sure SMS verification would help track down abusers when it'll lead to a prepaid SIM or some innocent user's phone…

[deleted]

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#162

Post by arthurcolle »

boogies wrote: post #159
jimbob45 wrote: post #146

Earlier quoted context omitted.

The goodwill has already been squandered. There’s simply nowhere else to jump to (jitsi lol). As soon as a viable competitor launches, everyone will jump. Same thing happened from Skype to Discord with the gaming community.

Jitsi Meet's not a viable competitor? It's simpler to set up (accounts and password protection are optional), IMO easier to use (eg. the hand button is on the bottom bar with mute, etc. and not in a menu labeled "Participants") and higher quality according to the New York Times, who deemed it "reliable and easy to use": https://www.nytimes.com/wirecutter/reviews/best-video-confer... . I've introduced it to extended f…

We tested it at my org, it doesn't scale past 15 users

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#163

Post by vsareto »

jimbob45 wrote: post #146
coreypreston wrote: post #123

Earlier quoted context omitted.

They're 6 months away from becoming a case study in squandering momentum.

The goodwill has already been squandered. There’s simply nowhere else to jump to (jitsi lol). As soon as a viable competitor launches, everyone will jump. Same thing happened from Skype to Discord with the gaming community.

Skype was never a real player in the gaming community, it was really just Teamspeak, Ventrilo, and Mumble

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#164

Post by just-ok »

bisby wrote: post #129
thevagrant wrote: post #112

Earlier quoted context omitted.

It wouldn't surprise me as recently the app tried to get me to trust an untrusted cert.

It's encrypted all the way from one end to the other end, we just also happen to have a copy of the key and can dencrypt it in the middle. Technically, the exact packets of the data you send is E2E encrypted... but the copies they make for themselves aren't.

This could be the case for literally any E2EE service that controls key distribution (including WhatsApp, Signal, etc.), especially when there's no way to verify key fingerprints (here Signal differs because it does have a way, and it's open source so you can be more confident that it's not BSing you).

It's shocking to me how often this is glossed over when discussing E2EE services: you still must trust the platform.

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#165

Post by justicezyx »

anonymousab wrote: post #148
hakka-nyu-su wrote: post #62

Earlier quoted context omitted.

Except Eric is not any sort of govt or party representative. He is a naturalized American of Chinese ancestry. In history, this kind of scapegoating was counterproductive.

The CCP can and will exert pressure on family members to get expats and former citizens to do what they want. They're not the only country to do so, not by a long shot, but they are particularly brazen about it. Though I think the CEO is less relevant than the critical amount of developers Zoom relies on that are directly living under and subject to CCP malfeasance.

> The CCP can and will exert pressure on family members to get expats and former citizens to do what they want.

Could you give a few such cases?

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#166

Post by SamWhited »

hypewatch wrote: post #93

I find this story arch with Zoom amusing: 1. Pre-COVID Zoom claims it has E2E encryption for everyone. 2. During COVID Zoom grows in popularity, which prompts journalists to learn that the claims that Zoom has E2E encryption are inaccurate. 3. Zoom admits that it never had true E2E encryption, but announces they will develop it and it will only be available for paying customers. 4. Zoom gets another wave of criticism…

You forgot "5. Zoom gets praised for developing features in response to criticism that already existed in other products that work better."

Jokes aside, with Zoom's track record, it's not worth using anymore regardless of what features they implement. Not having E2E encryption is no where near as much of a red flag as lying about it is to me.

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#168

Post by just-ok »

botto wrote: post #9

I'm quite frustrated they are calling this end to end. I can't find it now but a tweet earlier indicated that they have the keys and can help law enforcement with investigations which means it's can't be end to end.

Any centralized E2EE service has the (public) keys; that's the only way to distribute them to users. You have to trust (or verify, in the case of Signal) them to deliver authentic keys rather than MitM'ing you.

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#169

Post by screye »

damanamathos wrote: post #79
Nextgrid wrote: post #50

Earlier quoted context omitted.

Their argument doesn't make sense. The objective behind verifying accounts is to prevent spammers creating lots of spam accounts and using those to spam. However, spammers rarely care if their spam is encrypted, so putting E2E behind verification won't do anything as far as spammers are concerned - they'll happily keep spamming using the unencrypted accounts. There's some other reason behind this that isn't about red…

I think their concern is paedophile rings using large group E2EE for live child abuse with completely anonymous accounts.

I highly doubt paedophiles are watching child abuse streams on zoom.
Post reply on HN