Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom lied to users about end-to-end encryption for years, FTC says

arstechnica.com

Post reply on HN
Print view View original

421–430 of 438 posts

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#421

Post by wesleywt »

bborud wrote: post #196

Over the past decade I've had to deal with a lot of executives and security people who don't actually understand security all that well. Or at all. (Not that I'm a security expert, but that hardly makes it better when even I can see that something is nonsense). Right now I know of at least half a dozen products that are marketed as having E2E encryption but do not actually implement this (no, I'm not going to out the…

It doesn't make sense to a computer savvy hacker news poster perspective. But to everyone else, the reason they use it because they don't really care or thought about it. It will continue to be the most popular meeting app despite the wailing and gnashing from Hacker News.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#422

Post by sdoering »

wesleywt wrote: post #421
bborud wrote: post #196

Over the past decade I've had to deal with a lot of executives and security people who don't actually understand security all that well. Or at all. (Not that I'm a security expert, but that hardly makes it better when even I can see that something is nonsense). Right now I know of at least half a dozen products that are marketed as having E2E encryption but do not actually implement this (no, I'm not going to out the…

It doesn't make sense to a computer savvy hacker news poster perspective. But to everyone else, the reason they use it because they don't really care or thought about it. It will continue to be the most popular meeting app despite the wailing and gnashing from Hacker News.

I see my significant other using it on a nearly daily basis. She started a uiversity course in her 30ies and due to Corona is in her second semester from home.

The university has a MS365 license free for all students, but for video lectures nobody uses it. Why? Because it is really, really cumbersome to use compared to zoom. Teachers and students alike love the functionality, the quality of video/sound and esp. the ease of use.

Compared to all other solutions available to students and teachers - in terms of what they all want to use Zoom just blows the competition out of the water.

And who is to blame them? These are regular folks. They wouldn't even care, if the lectures were tranmitted in the clear, without any encryption. Most regular students fresh out of school I talked to don't even know the difference between https/http, why it is important to have encryption or what end-to-end means.

It has no meaning to nearly all of them.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#423

Post by MayeulC »

vngzs wrote: post #357
NDizzle wrote: post #286

Earlier quoted context omitted.

Oh man I had a great one last week. We're migrating stuff to a cloud provider, and they wanted to expose an internal only API to the internet so that the things could reach it. I was strongly against that, as it has no security involved at all. Fast and loose and all of that. Two, count them, two people wanted to "just change it to use port 443, that way it's encrypted". I had to explain that you could pick any valid…

If it's AWS, the quickest path to doing this securely is AWS API Gateway mTLS authN[0]. You generate some certs, stuff the public halves in S3, slap an ACM cert on the Gateway, and you're done. I have also used certificate authentication on TLS-terminating reverse proxies (e.g., this is easy to do with HAProxy) to do the same in other environments. You can pin the API's certificate on the client end in order to furth…

I'd just like to point out that it's also very easy to do on most reverse proxies. Client cert, or even regular password protection.

Client certs are quite easy to setup. Create a CA cert, sign client certs with it, and allow only clients who have a cert signed by you.

Client cert on Nginx: https://fardog.io/blog/2017/12/30/client-side-certificate-au...

Bonus about client certs: https://drewdevault.com/2020/06/12/Can-we-talk-about-client-...

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#424

Post by upofadown »

mr_mitm wrote: post #370
DaiPlusPlus wrote: post #368

Earlier quoted context omitted.

That still requires you to trust the client software. I trust Telegram’s E2E, but not Zoom - unless Zoom’s client is on GitHub with deterministic build steps?

Telegram's crypto is shoddy [1]. It may not be a complete train wreck, but if you value good crypto and privacy, Signal is probably your only option. It also offers E2EE group chats, unlike Telegram. [1] https://security.stackexchange.com/a/49802/29703 (a bit dated but AFAIK nothing changed)

>a bit dated...

A lot dated. The current thing is described here:

* https://core.telegram.org/mtproto

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#425

Post by mensetmanusman »

hackmiester wrote: post #318
mensetmanusman wrote: post #311

Earlier quoted context omitted.

You can set up channels in a ‘team’ and use those for breakouts.

This would require all the attendees to be members of the team ahead of the meeting; this isn't how we use Zoom.

Ya, definitely requires more pre-planning, but maybe it’s still a hack that could be used. Just delete the ‘team’ afterwards.

Maybe there is a way to automate this with some VB/Python script?

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#426

Post by rational_indian »

NeutronStar wrote: post #348
dheera wrote: post #342

Earlier quoted context omitted.

Unless there was a gag order. We should make gag orders unconstitutional.

Gag orders don't force you to state wrong facts about your products in the first place.

What if they do?

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#427

Post by TheCoelacanth »

Mary-Jane wrote: post #200
airstrike wrote: post #172

Earlier quoted context omitted.

Well, corporations aren't humans, contrary to what some might try to argue.

True enough. But they are comprised entirely of people. To change their behavior you must appeal to the people running them.

A corporation is an AI that uses people for it's computing resources. It doesn't in any way behave like a person.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#428

Post by dspillett »

rational_indian wrote: post #426
NeutronStar wrote: post #348

Earlier quoted context omitted.

Gag orders don't force you to state wrong facts about your products in the first place.

What if they do?

Then it is not a gag order. A gag order means "don't say anything about X" and is not concerned with what you might or might not say instead.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#429

Post by franga2000 »

crazygringo wrote: post #193
carapace wrote: post #177

Earlier quoted context omitted.

That's kind of the point isn't it? You can't know, because it wasn't actually e2ee, eh? That's the harm. Also, think of the competitors of zoom who lost customers to them due to their lying, that's a harm too, eh? These are hard to quantify but they're not nothing.

Well, we can know. It was encrypted, but not E2EE, so the only person who could have spied was Zoom itself, and we know the how too - by the same mechanism it performs a video recording, for example. We just don't know if . But seeing as we've had zero reports of any real-world consequences that could only have come about by Zoom spying, combined with the fact that "spying on your customers" is anathema to your busin…

"Zoom itself" spying sounds quite unlikely, "bribed underpaid Zoom intern" sounds a lot more likely, "the gvt. sending one of those silent warrants" sounds almost unavoidable.

Non-E2E encryption doesn't give access to just "the company" (which probably doesn't care to spy on you, true), but absolutely anyone who can bribe/trick/coerse anyone in their "supply chain" (from the CEO to the sysadmins, hosting provider, even janitor...). Not to mention a data leak due to a vulnerability in any part of their stack.

The company has shown complrte disregard for security multiple times in the past and I wouldn't be at all surprised if they had major security holes. And since they already lied about E2EE, it would be entirely safe to assume they would not have disclosed a breach either.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#430

Post by anticensor »

bhauer wrote: post #359
aaisola wrote: post #302

Earlier quoted context omitted.

Google's Meet has improved considerably and most importantly it comes free with G-Suite. They are also pushing it quite hard as every calendar invite has a Google Meet link automatically included. The reason that people went with Zoom is "because it worked." As other products improve it's hard to see what Zoom's moat is and why we should continue to pay for it.

> The reason that people went with Zoom is "because it worked." As other products improve it's hard to see what Zoom's moat is and why we should continue to pay for it. Ironically, I would say Google Meet defines "it just works" for me way more than does Zoom. Joining a Google Meet: 1. Enter the URL in your browser. 2. Click join. Joining a Zoom: 1. Enter the URL in your browser. 2. Accept launching an executable. 3.…

Joining a BigBlueButton/Jitsi meeting:

1. Enter the URL in your browser.

2. Choose a nickname or log in.

3. Click join.

4. Decide if you're using video or not.

5. See a video test.

6. Decide if you're using audio or not.

7. See an audio test.

(steps 5 and 7 are absent in a Jitsi meeting)

Post reply on HN