Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom lied to users about end-to-end encryption for years, FTC says

arstechnica.com

Post reply on HN
Print view View original

351–360 of 438 posts

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#351

Post by fourthark »

soulofmischief wrote: post #285
bborud wrote: post #265

Earlier quoted context omitted.

Well, there might be conflicting interests within government. From a consumer advocate perspective government might want to demand this. From an intelligence services perspective you might want companies to lie.

> From an intelligence services perspective you might want companies to lie. No, I don't. I don't want companies to lie. You can collect intelligence the same way we've been collecting intelligence for our entire history on this planet prior to E2E comms. E2E isn't a hindrance, it's a way to enforce limitations on government overreach. No freedom is without compromise.

You are presumably not an intelligence agency.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#352

Post by TwoBit »

bborud wrote: post #196

Over the past decade I've had to deal with a lot of executives and security people who don't actually understand security all that well. Or at all. (Not that I'm a security expert, but that hardly makes it better when even I can see that something is nonsense). Right now I know of at least half a dozen products that are marketed as having E2E encryption but do not actually implement this (no, I'm not going to out the…

Disagree. Engineers of that system surely knew it wasn't E2E and voiced it, but marketing purposely lied. I will bet my farm on that.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#353

Post by p1necone »

Jasper_ wrote: post #244
wil421 wrote: post #232

Earlier quoted context omitted.

Our system has an AI module. AI module: If something Else if something else Else if Else if ... Else Call Human

To be honest, before the modern machine learning approach, this was known as a decision tree and was thought to be a valid way to approach "artificial intelligence". Lots of "AI" hype in the 80s was based around "Expert systems" and "Decision trees".

Decision trees/behaviour trees are still the most widely used way to build video game AI. Of course video game AI just has to appear smart, really you're solving a different problem a lot of the time.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#354

Post by lilyball »

> Amid controversy in July 2019, Zoom issued an update to completely remove the Web server from its Mac application, as we reported at the time.

Surprised to see them mention the web server thing and not mention that it was so bad that Apple actually updated its antivirus software to remove the Zoom web server.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#355

Post by mqus »

jdright wrote: post #235
desilentio wrote: post #211

Earlier quoted context omitted.

> As for Zoom, I don't understand why people trust them or still use their product if they are at all concerned about security. It makes very little sense. I certainly don't trust them, but I do use Zoom (from a dedicated unprivileged user, so it can't do any harm beyond recording my conversations), because my colleagues use Zoom, and because there doesn't seem to be any working alternative. I got them to try Jitsi o…

What does not work with jitsi? I've been using a lot recently and it is by far the easiest one to use. One link and done. I have lots of video and audio issues with zoom. Now, if you're a company, bluejeans may be the best one.

If you're going to have 10+ People in the meeting, there will be issues. Video/Audio getting bad, People loose have signal, etc. There is also a very noticable load on even more powerful PCs once you have some more people in the call.

So jitsi might work for one-on-ones but slightly bigger conference calls are a no-go.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#356

Post by FridgeSeal »

zelphirkalt wrote: post #252
Jasper_ wrote: post #244

Earlier quoted context omitted.

To be honest, before the modern machine learning approach, this was known as a decision tree and was thought to be a valid way to approach "artificial intelligence". Lots of "AI" hype in the 80s was based around "Expert systems" and "Decision trees".

And there are even modern tree based approaches, that beat some of the modern artificial neural network approaches! It's not like it has become an absolutely unusable class of algorithms.

People seem to think that the presence of neural nets and deep learning means that most of types of models are practically superseded whereas in my experience if some non-deep-learning model even gets you mostly there, then the efficiency and explain-ability wins make it worth it.

At my previous job I had a ML-based service that used a basic random-forest model instead of a neural net because it was faster to train and operate, not to mention easier to maintain and had equivalent accuracy with little to no effort required on my part. It was a solid little service.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#357

Post by vngzs »

NDizzle wrote: post #286
bborud wrote: post #196

Over the past decade I've had to deal with a lot of executives and security people who don't actually understand security all that well. Or at all. (Not that I'm a security expert, but that hardly makes it better when even I can see that something is nonsense). Right now I know of at least half a dozen products that are marketed as having E2E encryption but do not actually implement this (no, I'm not going to out the…

Oh man I had a great one last week. We're migrating stuff to a cloud provider, and they wanted to expose an internal only API to the internet so that the things could reach it. I was strongly against that, as it has no security involved at all. Fast and loose and all of that. Two, count them, two people wanted to "just change it to use port 443, that way it's encrypted". I had to explain that you could pick any valid…

If it's AWS, the quickest path to doing this securely is AWS API Gateway mTLS authN[0]. You generate some certs, stuff the public halves in S3, slap an ACM cert on the Gateway, and you're done.

I have also used certificate authentication on TLS-terminating reverse proxies (e.g., this is easy to do with HAProxy) to do the same in other environments. You can pin the API's certificate on the client end in order to further reduce MITM risks.

If you don't want to supply a client certificate in your client application, Stunnel[1] is an acceptable wrapper that lets your clients remain TLS-unaware. You could use it for both ends of the tunnel, if you felt like it.

Either way, you end up with a secure tunnel through the internet to the proxy, at which point you're back inside private networks.

(Source: I build this kind of thing for a living.)

[0]: https://aws.amazon.com/blogs/compute/introducing-mutual-tls-...

[1]: https://www.stunnel.org/auth.html

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#358

Post by mjevans »

whomst wrote: post #295
nsgi wrote: post #293

Earlier quoted context omitted.

> As for Zoom, I don't understand why people trust them or still use their product if they are at all concerned about security. It makes very little sense. Phone calls and text messages aren't particularly secure either, doesn't stop people using them

At least phone calls are protected by law in some capacities (HIPAA allows for faxing but not email, warrants are supposed to be required for tapping phone lines but not email, etc)

Faxes are "exempt", not secure. The intent was that they die off sooner rather than later.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#359

Post by bhauer »

aaisola wrote: post #302
desilentio wrote: post #211

Earlier quoted context omitted.

> As for Zoom, I don't understand why people trust them or still use their product if they are at all concerned about security. It makes very little sense. I certainly don't trust them, but I do use Zoom (from a dedicated unprivileged user, so it can't do any harm beyond recording my conversations), because my colleagues use Zoom, and because there doesn't seem to be any working alternative. I got them to try Jitsi o…

Google's Meet has improved considerably and most importantly it comes free with G-Suite. They are also pushing it quite hard as every calendar invite has a Google Meet link automatically included. The reason that people went with Zoom is "because it worked." As other products improve it's hard to see what Zoom's moat is and why we should continue to pay for it.

> The reason that people went with Zoom is "because it worked." As other products improve it's hard to see what Zoom's moat is and why we should continue to pay for it.

Ironically, I would say Google Meet defines "it just works" for me way more than does Zoom.

Joining a Google Meet:

1. Enter the URL in your browser.

2. Click join.

Joining a Zoom:

1. Enter the URL in your browser.

2. Accept launching an executable.

3. Watch a window or two pop up and close.

4. Decide if you're using video or not.

5. Watch more windows pop up and close.

6. See the main Zoom window appear.

7. Decide if you're using audio or not.

Perhaps part of my beef with Zoom is how many times its window shuffling steals focus during the several seconds needed to join a meeting. If I'm trying to get work done while waiting for a meeting to start, the focus stealing is very obnoxious.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#360

Post by jdright »

mqus wrote: post #355
jdright wrote: post #235

Earlier quoted context omitted.

What does not work with jitsi? I've been using a lot recently and it is by far the easiest one to use. One link and done. I have lots of video and audio issues with zoom. Now, if you're a company, bluejeans may be the best one.

If you're going to have 10+ People in the meeting, there will be issues. Video/Audio getting bad, People loose have signal, etc. There is also a very noticable load on even more powerful PCs once you have some more people in the call. So jitsi might work for one-on-ones but slightly bigger conference calls are a no-go.

I tried this and can confirm! I always had about 6-8 persons and never got this issue before. Well, this actually explains a lot of comments I see about Jitsi.
Post reply on HN