Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom lied to users about end-to-end encryption for years, FTC says

arstechnica.com

Post reply on HN
Print view View original

201–210 of 438 posts

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#201

Post by intricatedetail »

_-___________-_ wrote: post #77
intricatedetail wrote: post #76

Earlier quoted context omitted.

But they may run modified software e.g. with added backdoors and you wouldn't know as you cannot check what is actually running on servers.

Yes, but the servers only transfer encrypted payloads for which the servers do not have the decryption keys, and you can verify that just by looking at the clients (which are open source in this scenario). That is the entire point of end-to-end encryption.

Are you saying that MITM is not possible? For example your client will receive a key prepared by rogue server and it will decrypt and encrypt conversations on the fly. You wouldn't be able to tell unless you find a way to verify the person on the other side tried to exchange different keys.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#202

Post by ineedasername »

okprod wrote: post #158
_lqaf wrote: post #153

A deeper issue is how hard it is to "know" if companies hawking products with security implications (which is nearly everything, today) are lying. I'm not even talking about the gradient ranging from innocent bugs to incompetent coders and how that gets papered over. When you buy shoddy physical goods, there are typically characteristics you can't hide, like cheap materials. But with software like this of course the…

Freely licensed software would allow for audits.

As long as you audit both the software and the implementation.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#203

Post by raxxorrax »

crazygringo wrote: post #193
carapace wrote: post #177

Earlier quoted context omitted.

That's kind of the point isn't it? You can't know, because it wasn't actually e2ee, eh? That's the harm. Also, think of the competitors of zoom who lost customers to them due to their lying, that's a harm too, eh? These are hard to quantify but they're not nothing.

Well, we can know. It was encrypted, but not E2EE, so the only person who could have spied was Zoom itself, and we know the how too - by the same mechanism it performs a video recording, for example. We just don't know if . But seeing as we've had zero reports of any real-world consequences that could only have come about by Zoom spying, combined with the fact that "spying on your customers" is anathema to your busin…

Do you know about the every case of industrial espionage? No, because neither victim nor perpetrator are interested in sharing that info.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#204

Post by intricatedetail »

ent wrote: post #54
intricatedetail wrote: post #43

Earlier quoted context omitted.

Even with open source software you will never know what is actually running on the servers. It's best to assume none of the services are e2e encrypted and you should provide your own encryption on top of the medium you communicate with if you require privacy. By own encryption I mean exchanging keys and encrypting offline using oss tools.

Isn't the whole point of e2e that you don't need to worry about what runs on the server, unless you're worried about metadata leakage.

Correct, but if there is something between you and other user and can intercept key exchange then it can decrypt and encrypt anything on the fly. I think you would have to exchange keys offline to have true e2e experience.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#205

Post by LinuxBender »

phone8675309 wrote: post #174
_lqaf wrote: post #153

A deeper issue is how hard it is to "know" if companies hawking products with security implications (which is nearly everything, today) are lying. I'm not even talking about the gradient ranging from innocent bugs to incompetent coders and how that gets papered over. When you buy shoddy physical goods, there are typically characteristics you can't hide, like cheap materials. But with software like this of course the…

Any software you don't have the source for, haven't built yourself, and don't host yourself is immediate suspect. Third party audits aren't a silver bullet. Enron and Worldcom had third party audits.

Auditors operate off money, too. I have seen this first hand. If I tell them about an egregious violation and they don't even bother to write it down, I know what type of "auditor" I am dealing with. If they write it down and the issue is not resolved, same thing.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#206

Post by qazxcvbnmlp »

bborud wrote: post #196

Over the past decade I've had to deal with a lot of executives and security people who don't actually understand security all that well. Or at all. (Not that I'm a security expert, but that hardly makes it better when even I can see that something is nonsense). Right now I know of at least half a dozen products that are marketed as having E2E encryption but do not actually implement this (no, I'm not going to out the…

My boss is one of those people. He insists to our customers (and engineers) our product has encryption. It does not.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#207

Post by chasebank »

vitus wrote: post #83
user5994461 wrote: post #44

Earlier quoted context omitted.

The market being $50B means there are $50B of sales to do per year. Market cap is a multiplier of revenues, easily 10 or 20 for a tech company, that means a $1T market cap to be taken across the videoconference companies. Wondering how numbers can be so high? Count $10 per month * 12 months in a year * 100 million employees in the US... that is $12B per year going to video software!

Actually, price / earnings (P/E ratio) is typically 10-20 for _any_ company in the S&P 500. When you look at big tech, the numbers are drastically higher: - AMZN: 92 - GOOG: 34 - FB: 33 - NFLX: 76 - AAPL: 35 - MSFT: 35 Compare this to, say, 3M, at 19, or GM with 17. edit: incidentally, apparently Zoom's P/E is... 527, which is grossly inflated even for a tech company. Tesla is also in the same category with a P/E of…

P/E ratio formula is listed above correctly, however, earnings is earnings per share, not revenue. So the parent's market valuation rationale is whacky.

Side note - Go read about Japan's lost decade and you'll see how dangerously close our (US) current speculative investing environment is to theirs before it fell.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#208

Post by dspillett »

bborud wrote: post #196

Over the past decade I've had to deal with a lot of executives and security people who don't actually understand security all that well. Or at all. (Not that I'm a security expert, but that hardly makes it better when even I can see that something is nonsense). Right now I know of at least half a dozen products that are marketed as having E2E encryption but do not actually implement this (no, I'm not going to out the…

> It is also important to note that quite often you are not dealing only with the company that makes a product, but the regulatory bodies that can pressure companies into complying with their wishes.

While considering the regulatory requirements helps explain the desire to lie, it does not make the lie any more defensible. Even if a regulatory body is making impractical demand, I very much doubt they are demanding companies lie to their users and potential users. Even if they were "just following orders guv" is not an acceptable excuse.

The key facts: Zoom lied. They didn't have to. They could have accurately reported what encryption they use and what they were working towards if that was due to change.

Even if we accept that the initial claims were wrong due to executives misunderstanding what their own security/dev people had stated, that doesn't defend continuing to make the claim without seeking further clarity after questions were raised.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#210

Post by dspillett »

qazxcvbnmlp wrote: post #206
bborud wrote: post #196

Over the past decade I've had to deal with a lot of executives and security people who don't actually understand security all that well. Or at all. (Not that I'm a security expert, but that hardly makes it better when even I can see that something is nonsense). Right now I know of at least half a dozen products that are marketed as having E2E encryption but do not actually implement this (no, I'm not going to out the…

My boss is one of those people. He insists to our customers (and engineers) our product has encryption. It does not.

I strongly recommend attempting to fix that and/or (while I am aware that it may be difficult in the current climate) searching for a new boss.

In the meantime be very careful to monitor anything your name is associated with, just in case any of your customers get wind of the situation and sue-balls are thrown.

Post reply on HN