Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom still don't understand GDPR

threatspike.com

Post reply on HN
Print view View original

231–240 of 267 posts

Re: Zoom still don't understand GDPR

#231

Post by iaml »

HumblyTossed wrote: post #208
m463 wrote: post #167

Earlier quoted context omitted.

every teleconferencing app does this. Teams will not show you a browser link until you download the web client. webex will actively download a .exe (on my mac?) before showing the browser link. When I see stuff like this, I think "market opportunity" but the status quo must be pretty profitable.

webex (1).exe webex (2).exe webex (3).exe ... After a Windows update webex kept crashing and bringing my laptop down with it, so I started using the web app. My Downloads folder ended up with quite a few webex downloads. Now I have a script to clean them out each night.

Can’t you just block downloads for domain in browser?

Re: Zoom still don't understand GDPR

#232

Post by ryneandal »

dheera wrote: post #119
irjustin wrote: post #116

Earlier quoted context omitted.

Any company that has an operating entity in an EU country must comply or risk being fined by regulators. If the target is big enough, EU regulators will ask for help from other countries. Zoom operates offices in a few EU countries[0] so they'll definitely have some sort of entity(ies) setup - regulation pressure can be applied. [0] https://zoom.us/contact

You're right, I checked and Zoom does have offices in Paris and Amsterdam. I suppose then they have the choice of doing Google's playbook in China and just close their EU offices if they wanted, instead of complying. I mean, China wanting censorship and EU wanting GDPR aren't any different. Without arguing for or against either, China's censorship and GDPR are both local laws and foreign-based companies with no local…

I think you entirely misunderstand the purpose of the GDPR.

Re: Zoom still don't understand GDPR

#233

Post by JamesSwift »

RandomBacon wrote: post #228
Alupis wrote: post #47

Earlier quoted context omitted.

For remote support, you may want to look into a more purpose-built system, such as TeamViewer or LogMeIn Rescue.

Last time I spoke with TeamViewer, they still wouldn't admit they were hacked. https://news.ycombinator.com/item?id=11826431 (TeamViewer denies hack after PCs hijacked, PayPal accounts drained)

Yep, switched my parents off TeamViewer after that and have blacklisted it personally.

Re: Zoom still don't understand GDPR

#234

Post by jt94mf90d »

gspr wrote: post #197
hajwh wrote: post #143

Earlier quoted context omitted.

Holy shit - you can run Zoom in the browser???

Yes, of course. People wouldn't be crazy enough to install the binary blob of this extremely sketchy company, would they!?

My zoom shows up recording audio in the audo mixer even after leaving meetings.

Re: Zoom still don't understand GDPR

#235

Post by timerol »

andrewnicolalde wrote: post #104
juped wrote: post #99

Earlier quoted context omitted.

What was the draw of Keybase? I wasn't interested when it was a "post all your website usernames here, but with crypto somehow" site, and by the time I looked in on it later, it was an unreadable startup homepage and had some kind of cryptocurrency scam attached to it. If it had a good messaging featureset that should be cloned, former Keybase users should speak up!

It had excellent chat functionality that worked well, and this was at a time in which the Signal client for Android was still quite buggy (hundreds of Bad encrypted message messages flooding group chats, messages delivered hours late and all at once, poor performance etc.) My group naturally gravitated towards Keybase as our secure messaging platform. The other killer feature was KBFS, which was a sort of shared encr…

FYI, if you want to liquidate those, AnchorUSD makes it really easy to transfer them out to a US bank account.

Re: Zoom still don't understand GDPR

#236

Post by franga2000 »

donkeyd wrote: post #155
panpanna wrote: post #149

Earlier quoted context omitted.

What do you then do about the horrible performance of zoom in chrome? For me, the sound becomes unintelligible as soon as someone shares his screen.

Try a different browser. On Mac, Safari is much more resource efficient than Chrome for example. On Windows I'm not sure, but it can't hurt t give FF a try.

N=1, but it works great in Firefox on Linux and doesn't use noticeably more resources that what I usually see with video calls.

Re: Zoom still don't understand GDPR

#237

Post by currysausage »

robflaherty wrote: post #192
currysausage wrote: post #158

Earlier quoted context omitted.

This is very likely not valid consent under GDPR. Look at specific guidance on valid consent by DPAs: https://ico.org.uk/for-organisations/guide-to-data-protectio...

Can you explain what is invalid about it? The list of functional cookie permissions on the consent opt-in specifically mentions cookies to remember log in details.

Sure, let's have a look at Article 4 GDPR: ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her

In this case, I doubt that consent is freely given (which requires a true choice on the user's part), I doubt that it is specific (that the choice is granular pertaining to different cookies fulfilling different purposes), and I doubt that it is informed (that the user understands the relevance of different cookies).

Most importantly, consent given in the context of a visit of the zoom.us site cannot be specific and, at the same time, cover cookies being unexpectedly set by a local uninstall program. We are not talking about the usual session ID cookie here ("remember log in details").

Recital 43: Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case,

Somewhat questionable in this case. Is there a way to opt out of the specific cookie? I guess not.

or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.

Quite likely.

Recital 42: For consent to be informed, the data subject should be aware at least of the identity of the controller and the purposes of the processing for which the personal data are intended

Where does Zoom explain the purpose of the "everlogin" cookie?

Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.

Again, is there a way to opt out of the specific cookie?

Article 7 GDPR: The data subject shall have the right to withdraw his or her consent at any time. ... It shall be as easy to withdraw as to give consent.

It's quite easy to consent to cookies at zoom.us. Where, however, can a user revoke their consent?

When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

I don't think it's possible to use Zoom without this (unnecessary) cookie being saved. Therefore, consent is most likely not applicable.

Again, ICO guidance is a great resource: Be specific and ‘granular’ so that you get separate consent for separate things. Vague or blanket consent is not enough.

Consent under GDPR simply doesn't work like "I consent to all of your cookies".

Re: Zoom still don't understand GDPR

#239

Post by franga2000 »

IvanSologub wrote: post #164

Read between the lines: a company established on the territory of a state where there is no concept of "private property" does not understand that it is impossible to collect personal data.

Who what now? Zoom? California? Because of that one squatting case?

Whatever it is that you are referring to, it sounds political and can't possibly have anything to do with the topic at hand. Save it for a different thread.

Re: Zoom still don't understand GDPR

#240

Post by caymanjim »

johnchristopher wrote: post #229

Why is an uninstaller allow to access a browser's files on the first place and then modify it? There's a name for that category of software.

While it's annoying that this is the case, pretty much all software on all commonly-used operating systems has complete access to everything.

When you install software in Windows, either it installs without Administrator permissions (in which case it still has access to every single user file) or it asks for elevation to Administrator, and users blindly click Yes (in which case it has access to the entire machine).

When you install software in Unix/Linux, you're almost certainly using sudo, giving up complete control. User permissions on single user systems are almost irrelevant. It's all about blind trust. People think nothing of installing software via "curl | sudo bash", or adding random PPA repositories to apt, downloading a binary and running it as root, or deploying a docker container linked from a blog. I know the risks and I do it all the time, because convenience always wins and popular things are reasonably safe due to the "mob trust" factor.

MacOS has made some incremental steps to wall applications off from each other, requiring explicit authorization for some actions via System Preferences toggles, but really, it's just adding inconvenience for your average user, and people will generally blindly agree, in part because some of the categories are too vague or broad (small UI widgets that alter e.g. keyboard bindings or window placement require carte blanche).

Phone operating systems are better at this than most, requiring explicit permission to access e.g. contacts, but there are still limits on how protected your data is. Most of the security on phone apps comes from the vetting required by the vendor lock-in stores. Yet we still had apps able to invisibly steal global clipboard contents until earlier this year.

So, yeah, it's stupid that Zoom's uninstaller has access to browser cookies, but do you think there's a single piece of software you use that doesn't? Everything on your system has access to everything else in most cases.

Post reply on HN