81–90 of 438 posts
Does it open Zoom to being sued by clients? If a company signed a contract with Zoom in which e2e encryption was stated.
Like a class action lawsuit? I think there have to be evidence of damage done in that case.
If Zoom made clear to users that connections were not secured to the same standards as competitors, and that potentially hundreds of employees could be silently listening in on any call, I think that would have prevented them becoming a leader in video conference tech. So the right fine here is their entire market cap. That would put them back at square one, which is where an honest competitor would be right now.
Earlier quoted context omitted.
Some reports say the whole video conferencing market, being very optimistic, will reach $50B in 2026 (considering Covid-19 - https://www.gminsights.com/industry-analysis/video-conferenc... ) But Zoom, alone, already has a marketcap of $117.534B ( https://finance.yahoo.com/quote/ZM/ ) I really think there is an unsustainable distortion happening.
The market being $50B means there are $50B of sales to do per year. Market cap is a multiplier of revenues, easily 10 or 20 for a tech company, that means a $1T market cap to be taken across the videoconference companies. Wondering how numbers can be so high? Count $10 per month * 12 months in a year * 100 million employees in the US... that is $12B per year going to video software!
- AMZN: 92
- GOOG: 34
- FB: 33
- NFLX: 76
- AAPL: 35
- MSFT: 35
Compare this to, say, 3M, at 19, or GM with 17.
edit: incidentally, apparently Zoom's P/E is... 527, which is grossly inflated even for a tech company. Tesla is also in the same category with a P/E of 834.
I don't understand how the FTC arrived at the conclusion they're not E2E? Or have I missed something? >Despite promising end-to-end encryption, the FTC said that "Zoom maintained the cryptographic keys that could allow Zoom to access the content of its customers' meetings, and secured its Zoom Meetings, in part, with a lower level of encryption than promised." Not wonderful but that still, technically, is an E2E encr…
Most videoconferencing systems are not E2E-encrypted. They encrypt the link between each participant and the central server. This makes implementation simpler in a few ways. A good E2E-encrypted system would involve Zoom never having the keys at all, so "key storage" would be irrelevant. The issue here is merely that Zoom claimed to be E2E-encrypted when they were not. They could have simply said "encrypted" and ther…
Is there anyone doing group videoconferencing with E2E encryption, for more than a handful of participants?
Earlier quoted context omitted.
> Even with open source software you will never know what is actually running on the servers. If the clients are open-source and properly implement end-to-end encryption, and you verify that they are not sending your keys to the servers, then what is running on the servers is irrelevant.
But they may run modified software e.g. with added backdoors and you wouldn't know as you cannot check what is actually running on servers.
The only relevant vulnerability is stealth updates infecting the client, but the client could disallow it as well.
Earlier quoted context omitted.
Once can't just delegate responsibility like that. Any company should enage in some form of due dilligence before procuring software. If there are expecations of privacy then those should be proven by the company procuring the software, not the vendor.
How would you verify e2e encryption on a proprietary protocol? Not every company that cares about privacy has crypto experts on staff. They should have a reasonable expectation that the vendor is telling the truth.
If Zoom made clear to users that connections were not secured to the same standards as competitors, and that potentially hundreds of employees could be silently listening in on any call, I think that would have prevented them becoming a leader in video conference tech. So the right fine here is their entire market cap. That would put them back at square one, which is where an honest competitor would be right now.
Is this about the audio streams? I imagine that if at any time there are a million video streams happening, and zoom wanted to sneak into 1% of them, it would pretty much need 10000 vCPUs of compute to do that? The current tech scales affordably because only the encoded packets get transmitted between callers (via "selective forwarding units") without needing server-side re-encoding? edit: That was for video streams.…
If Zoom made clear to users that connections were not secured to the same standards as competitors, and that potentially hundreds of employees could be silently listening in on any call, I think that would have prevented them becoming a leader in video conference tech. So the right fine here is their entire market cap. That would put them back at square one, which is where an honest competitor would be right now.
Not defending them in any way - but don't think security was the primary reason for Zoom taking off. It was stability - it just worked and at the same time competitors didn't. Everybody used to have Skype and I would have gladly handed over my data to MS if only it would have been able to do stable video calls. It was often a disaster for just 2-way calls, let alone group.
I don't understand how the FTC arrived at the conclusion they're not E2E? Or have I missed something? >Despite promising end-to-end encryption, the FTC said that "Zoom maintained the cryptographic keys that could allow Zoom to access the content of its customers' meetings, and secured its Zoom Meetings, in part, with a lower level of encryption than promised." Not wonderful but that still, technically, is an E2E encr…
I'm not sure what you mean by "you need a specific kind of key storage". You don't need any kind of key storage for e2e. You only need to facilitate the key exchange as a server, then push the opaque data both ways. If zoom (the company, not the software client) can get the encryption key, the call is not e2e encrypted.
Ah, thank you. That was the bit I was missing.
Silly question I know but I couldn't wrap my head around the wording
Earlier quoted context omitted.
I thought the lesson is clear. All e2e claims with closed source software must be dismissed by default. The burden of proof is on the seller.
I mean, I agree with you, and I guess the "surely Apple is not blatantly lying about being unable to read the content of your communication" argument has eroded a bit after Zoom's behaviour. But the penalties (both in terms of reputation and in terms of monetary fines) for this kind of misbehaviour are already large, and are likely to increase over time, and it seems an unnecessarily extreme risk for these companies…