Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom to bring end-to-end encryption to all users, including non-paying

blog.zoom.us

Post reply on HN
Print view View original

241–250 of 557 posts

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#241

Post by markkanof »

vntok wrote: post #229
jdsully wrote: post #209

Earlier quoted context omitted.

Lying about a feature isn’t just a “mistake”.

Lying about a feature is exactly what Silicon Valley's "fake it till you make it" culture encourages. Crucifying Zoom over this while letting virtually every other company in the space (inc. Hangout/Meet and MS Teams/Skype) go free seems quite hypocritical from an HN community that's comprised of many startupers and startup wannabees who spend their professional lives working for entities with similar practices.

That’s not what the expression means. If you are a tiny company and a big customer comes to you and says “can you scale to support us”, you answer yes even if you are not 100% sure you are ready. If however you claim to have feature X and you don’t, that’s just a lie.

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#243

Post by neodymiumphish »

vntok wrote: post #229
jdsully wrote: post #209

Earlier quoted context omitted.

Lying about a feature isn’t just a “mistake”.

Lying about a feature is exactly what Silicon Valley's "fake it till you make it" culture encourages. Crucifying Zoom over this while letting virtually every other company in the space (inc. Hangout/Meet and MS Teams/Skype) go free seems quite hypocritical from an HN community that's comprised of many startupers and startup wannabees who spend their professional lives working for entities with similar practices.

Did Meet/Teams/Skype claim E2E encryption?

The only alternative I ever looked into was Jitsi (because it was the first alternative I started doing research on, and by the time I'd finished researching it there was no doubt that it was more than good enough -- and super easy to build our own cloud instance so that, even though it wasn't E2E, we had total control of the server that managed the encryption), but I don't recall hearing arguments that any of the other major competitors were actually E2E encrypted.

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#244

Post by [deleted] »

vntok wrote: post #229
jdsully wrote: post #209

Earlier quoted context omitted.

Lying about a feature isn’t just a “mistake”.

Lying about a feature is exactly what Silicon Valley's "fake it till you make it" culture encourages. Crucifying Zoom over this while letting virtually every other company in the space (inc. Hangout/Meet and MS Teams/Skype) go free seems quite hypocritical from an HN community that's comprised of many startupers and startup wannabees who spend their professional lives working for entities with similar practices.

[deleted]

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#245

Post by anoraca »

boogies wrote: post #219
reaperducer wrote: post #200

Earlier quoted context omitted.

Another way of looking at it is that Zoom is learning from its mistakes and making improvements that the market demands. I'm no Zoom fan (I'd even use BlueJeans first), but people on HN are always so eager to crucify a company for its past. If it made mistakes, get out the tar and feathers! If it doesn't fix those mistakes, get out more tar and feathers! If it fixes the mistakes, even more tar and feathers!

There's a difference between a couple of honest mistakes and a history of shadiness (MacOS hidden server to prevent uninstallation), outright lies (E2EE), and attacking the pillars of democracy (censoring Chinese Americans discussing Tienanmen Square).

And routing interceptable call encryption keys through China even for calls that do not originate or terminate in China... https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto...

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#246

Post by pulse7 »

hypewatch wrote: post #93

I find this story arch with Zoom amusing: 1. Pre-COVID Zoom claims it has E2E encryption for everyone. 2. During COVID Zoom grows in popularity, which prompts journalists to learn that the claims that Zoom has E2E encryption are inaccurate. 3. Zoom admits that it never had true E2E encryption, but announces they will develop it and it will only be available for paying customers. 4. Zoom gets another wave of criticism…

The key information is in this sentences: "We are also pleased to share that we have identified a path forward that balances the legitimate right of all users to privacy and the safety of users on our platform ... while maintaining the ability to prevent and fight abuse on our platform." So they found a balance between privacy and ability to prevent abuse. In other words: this E2E encryption will have some backdoor which will be used only for legal reasons (to prevent abuse, etc.). Just like in the 80's when the US government asked Atari if they can provide encryption for their systems... In was encrypted for everybody, except... the government...

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#248

Post by neodymiumphish »

boogies wrote: post #239
depr wrote: post #199

Earlier quoted context omitted.

More to the point: which of those has true e2e encryption?

I don't think any of them do, but more relevant to security none of them has auditable source code. Jitsi Meet (the easiest to use out of the services I've tried, namely Zoom and Google Meet) has experimental E2EE. But if you want real security you probably want something more like GNU Jami, which is not grandma-friendly easy to use and is a native application only.

The beauty of Jitsi is that you can run the software yourself (especially with the free Google Cloud credit) and then the E2E is hardly relevant because it's still server-to-client encrypted and you own the server...

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#249

Post by pesfandiar »

smt88 wrote: post #128
ilikehurdles wrote: post #45

Earlier quoted context omitted.

I'm disgusted that in 2020, Americans continue to use the same racist, unfounded smears againts people based on their ethnicity just as they did when they were throwing Japanese-Americans into internment camps.

There are plenty of HN users who won't (or wouldn't, in an ideal world) use any US-based software because of NSA interference. The issue is national origin, not ethnicity. Japanese Americans were thrown into camps for the same reason, but we're not talking about jailing anyone here. We're talking about avoiding a specific product. Another difference is that Japanese Americans were put into camps regardless of how man…

I see your point about a person's family still living in China, and hence giving leverage to CCP to put pressure on them. However, the argument that where people grow up gives them inherent alignment with the government of that country, and they can only be "cleansed" through generations is at best bogus, and at worst ammunition for racism.

Not to justify atrocities happening in China or getting into Whataboutism, but just to give an analogy, would it be fair to consider any US expat an accomplice in or a proponent of separating migrant children from their families at the border?

Re: Zoom to bring end-to-end encryption to all users, including non-paying

#250

Post by a1a1a1a1a1a1 »

gruez wrote: post #28
mikece wrote: post #16

Has Zoom ever had their application(s) audited for security? Without an independent, external audit I don't know why they should be trusted that they've actually done e2e completely or correctly.

Any E2E implementation is worthless if the service provider controls the keys and doesn't allow the user to verify it (or alerts the user in the event of a key changing). Otherwise the service provider can simply swap the keys when they want to eavesdrop on someone and the users would be none the wiser. I don't believe that zoom has such measures, so any audit into whether E2E was implemented properly is pointless.

That was my thought exactly, but I read the zoom whitepaper (https://github.com/zoom/zoom-e2e-whitepaper/blob/master/zoom...), and it looks like the scheme addresses many of those issues.

Some things that looked like good steps:

> we will allow the SSO IDP (Identity Provider) to sign a binding of a Zoom public key to an SSO identity, and to plumb this identity through to the UI.

> Second, we allow users to track contacts’ keys across meetings. This way, the UI can surface warnings if a user joins a meeting with a new public key.

> we will implement a mechanism that forces Zoom servers (and SSO providers) to sign and immutably store any keys that Zoom claims belong to a specific user, forcing Zoom to provide a consistent reply to all clients about these claims. Each client will periodically audit the keys that are being advertised for their own account and surface new additions to the user.

> In Phase IV, we look to the future where Bob should sign new devices with existing devices, use an SSO IDP to reinforce device additions, or delegate to his local IT manager.

All of this of course relies on a zoom client actually doing everything described in the whitepaper, but it certainly looks like a good faith effort to implement real, functional e2ee

Post reply on HN