Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom lied to users about end-to-end encryption for years, FTC says

arstechnica.com

Post reply on HN
Print view View original

411–420 of 438 posts

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#411

Post by SAI_Peregrinus »

FridgeSeal wrote: post #356
zelphirkalt wrote: post #252

Earlier quoted context omitted.

And there are even modern tree based approaches, that beat some of the modern artificial neural network approaches! It's not like it has become an absolutely unusable class of algorithms.

People seem to think that the presence of neural nets and deep learning means that most of types of models are practically superseded whereas in my experience if some non-deep-learning model even gets you mostly there, then the efficiency and explain-ability wins make it worth it. At my previous job I had a ML-based service that used a basic random-forest model instead of a neural net because it was faster to train a…

And you can even do both. Decision tree to get to a smaller problem space, then NN on the output. You end up with a bunch of neural nets, each of which performs better than a single monolithic net due to solving a simpler problem.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#412

Post by FridgeSeal »

SAI_Peregrinus wrote: post #411
FridgeSeal wrote: post #356

Earlier quoted context omitted.

People seem to think that the presence of neural nets and deep learning means that most of types of models are practically superseded whereas in my experience if some non-deep-learning model even gets you mostly there, then the efficiency and explain-ability wins make it worth it. At my previous job I had a ML-based service that used a basic random-forest model instead of a neural net because it was faster to train a…

And you can even do both. Decision tree to get to a smaller problem space, then NN on the output. You end up with a bunch of neural nets, each of which performs better than a single monolithic net due to solving a simpler problem.

Yeah! Stacking models and playing on each types strength is a great strategy.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#413

Post by bo1024 »

mcrittenden wrote: post #272
bo1024 wrote: post #264

Earlier quoted context omitted.

How about Jitsi? https://meet.jit.si/ https://jitsi.org/

They said: "I got them to try Jitsi once, which simply didn't work."

Ah thanks, I didn't see that was the same person higher up.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#414

Post by _-___________-_ »

BlueTemplar wrote: post #395
_-___________-_ wrote: post #80

Earlier quoted context omitted.

I mean, I agree with you, and I guess the "surely Apple is not blatantly lying about being unable to read the content of your communication" argument has eroded a bit after Zoom's behaviour. But the penalties (both in terms of reputation and in terms of monetary fines) for this kind of misbehaviour are already large, and are likely to increase over time, and it seems an unnecessarily extreme risk for these companies…

What penalties? The NSA boasted (internally) about how much they were spying on Skype, and I'm not aware of Microsoft having been penalized in any way for lying about it, probably even the opposite?

Skype's been in decline for a long time, so it's hard to say if any of that decline is attributable to loss of trust.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#415

Post by _-___________-_ »

orestarod wrote: post #145
_-___________-_ wrote: post #48

Earlier quoted context omitted.

Apple claims that FaceTime is end-to-end encrypted (and makes some pretty strong statements about not having access to the content of communications). Facebook similarly claims that WhatsApp is end-to-end encrypted. Whilst I have little love for either company, do you have any evidence that these claims are lies?

Whatsup is "end to end encrypted", but I had seen an article here on HN about how Whatsup would snatch your data before it begun transit, if needed - for "security reasons" - after performing a local analysis on the messages. I don't know if this has been implemented as of yet, but you can see the intent for circumventing actual encryption - they can do it, and since e2e has become a bother, they certainly will.

With WhatsApp it's even simpler; they just constantly nag you to "back up" your chats to the cloud.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#416

Post by _-___________-_ »

intricatedetail wrote: post #201
_-___________-_ wrote: post #77

Earlier quoted context omitted.

Yes, but the servers only transfer encrypted payloads for which the servers do not have the decryption keys, and you can verify that just by looking at the clients (which are open source in this scenario). That is the entire point of end-to-end encryption.

Are you saying that MITM is not possible? For example your client will receive a key prepared by rogue server and it will decrypt and encrypt conversations on the fly. You wouldn't be able to tell unless you find a way to verify the person on the other side tried to exchange different keys.

Resisting MITM is the entire point of end-to-end encryption.

Verification can be made with the security code that WhatsApp uses, and the safety number that Signal uses (same thing, different name). Other systems have other, similar methods.

You can verify that they match in order to verify that you're not communicating with a man-in-the-middle, and if the key changes then both apps show a prominent warning.

Granted, a lot of people may not actually bother to verify.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#417

Post by tony101 »

desilentio wrote: post #408
bhauer wrote: post #359

Earlier quoted context omitted.

> The reason that people went with Zoom is "because it worked." As other products improve it's hard to see what Zoom's moat is and why we should continue to pay for it. Ironically, I would say Google Meet defines "it just works" for me way more than does Zoom. Joining a Google Meet: 1. Enter the URL in your browser. 2. Click join. Joining a Zoom: 1. Enter the URL in your browser. 2. Accept launching an executable. 3.…

It's not necessary for everyone to have a Google account?

"You don't need a Google Account to participate in Meet video meetings. However, if you don’t have a Google Account, the meeting organizer or someone from the organization must grant you access to the meeting."

https://support.google.com/meet/answer/9303069

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#418

Post by bborud »

TwoBit wrote: post #352
bborud wrote: post #196

Over the past decade I've had to deal with a lot of executives and security people who don't actually understand security all that well. Or at all. (Not that I'm a security expert, but that hardly makes it better when even I can see that something is nonsense). Right now I know of at least half a dozen products that are marketed as having E2E encryption but do not actually implement this (no, I'm not going to out the…

Disagree. Engineers of that system surely knew it wasn't E2E and voiced it, but marketing purposely lied. I will bet my farm on that.

For Zoom I suspect you are right. I think the engineers know what it means. But I have met a disturbing number of engineers (in security oriented jobs) who do not understand what the term means.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#419

Post by Drakim »

soulofmischief wrote: post #324
WalterBright wrote: post #298

Earlier quoted context omitted.

> Regulation should prevent this from occurring. It already exists. It's called "fraud".

On one level, yes. On the other hand, I think things involving cryptography at scale ought to come with regulations on language For example, look at how the word "bank" is specially regulated by most governments. I can't just call myself a bank without meeting specific guidelines or else it's not just typical fraud, it's major financial fraud coupled with putting sensitive customer data at risk. Same here. We need sp…

Exactly. Look at what Zoom is doing, they simply redefined end2end to mean something else so that they could brag about having it.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#420

Post by BlueTemplar »

_-___________-_ wrote: post #414
BlueTemplar wrote: post #395

Earlier quoted context omitted.

What penalties? The NSA boasted (internally) about how much they were spying on Skype, and I'm not aware of Microsoft having been penalized in any way for lying about it, probably even the opposite?

Skype's been in decline for a long time, so it's hard to say if any of that decline is attributable to loss of trust.

We're talking about legal penalties here.
Post reply on HN