Keyservers in China may be a risk, but this sounds like a terrible idea: "The researchers also found that Zoom protects video and audio content using a home-grown encryption scheme"
[deleted]
Zoom’s encryption has links to China, researchers discover
11–20 of 137 posts
Re: Zoom’s encryption has links to China, researchers discover
#12"home grown encryption scheme" seems to imply Zoom is rolling its own crypto, which is tremendously foolish. That isn't exactly the case, per the same article. More Zoom is choosing a poor choice among other choices, of implementing AES: "Furthermore, Zoom encrypts and decrypts with AES using an algorithm called Electronic Codebook (ECB) mode, “which is well-understood to be a bad idea, because this mode of encryptio…
Using ECB for this is terrible. It's likely that you could quite trivially recover low-fidelity video from the encrypted stream.
It works like that if you're encrypting a bitmap, but a compressed video stream is already fairly randomised. The encryption is broken, but low-res video extraction seems unlikely.
Re: Zoom’s encryption has links to China, researchers discover
#13"home grown encryption scheme" seems to imply Zoom is rolling its own crypto, which is tremendously foolish. That isn't exactly the case, per the same article. More Zoom is choosing a poor choice among other choices, of implementing AES: "Furthermore, Zoom encrypts and decrypts with AES using an algorithm called Electronic Codebook (ECB) mode, “which is well-understood to be a bad idea, because this mode of encryptio…
Even Wikipedia is stating ECB is a very bad choice. How can someone really use it nowadays without fraudulent intentions?
Most of Zoom's security problems seem like the kind of things a novice programmer who didn't know any better would do. Which may mean that they hire inexperienced programmers, or may mean that they wanted that as an excuse if they got caught. The former is probably more likely. After all, never attribute to malice what can adequately be explained by incompetence.
Re: Zoom’s encryption has links to China, researchers discover
#14And another case of lying in marketing: "A security white paper from the company claims that Zoom meetings are protected using 256-bit AES keys, but the Citizen Lab researchers confirmed the keys in use are actually only 128-bit." How do they keep doing this? Do they just put whatever sells best in the documents and implement something else? First the end2end thing, now 128 instead of 256 bits. How many more are we g…
Maybe they had GPT-2 write their marketing copy, starting with "A secure video conferencing service" and just ran with whatever that produced.
Re: Zoom’s encryption has links to China, researchers discover
#15Maybe I've been sensitised by all the security flaws, privacy leaks and outright lies on Zoom's part, but I'm starting to really notice how much a lot of public figures are pushing Zoom. Does anyone else find it really weird? Late-night TV hosts, I can understand - maybe they just get paid for it, or have Zoom shares. But for example UK government leaders repeatedly mentioning it by name, e.g. Matt Hancock saying tha…
Zoom is popular. Enough that it's both the default for many people and the tech that gets brought up in discussions. My dance school uses zoom. My work uses zoom. Online courses use zoom. Maybe it's more noticeable when famous people mention it, but really - it's a default now. Even if there was some shady push for it, it's also organically massively popular.
Re: Zoom’s encryption has links to China, researchers discover
#16I've really grown to dislike the "China == bad" thing, yes, they're domestically authoritarian, without excusing any of it, I like to act on hard evidence, not hear say, I am stunned that after the Bloomberg fiasco these kind of stories didn't take a hit.
P.S. Personally, I don't consider the NSA having my data as being any better, thank you.
EDIT: Just to be clear, I don't think Zoom's encryption claims should be trusted, but it's not because CHINAAA, it's because they're misleading people into thinking TLS means E2E.
Re: Zoom’s encryption has links to China, researchers discover
#17Earlier quoted context omitted.
Even Wikipedia is stating ECB is a very bad choice. How can someone really use it nowadays without fraudulent intentions?
Most of Zoom's security problems seem like the kind of things a novice programmer who didn't know any better would do. Which may mean that they hire inexperienced programmers, or may mean that they wanted that as an excuse if they got caught. The former is probably more likely. After all, never attribute to malice what can adequately be explained by incompetence.
Incompetence can enable malice
Re: Zoom’s encryption has links to China, researchers discover
#18Maybe I've been sensitised by all the security flaws, privacy leaks and outright lies on Zoom's part, but I'm starting to really notice how much a lot of public figures are pushing Zoom. Does anyone else find it really weird? Late-night TV hosts, I can understand - maybe they just get paid for it, or have Zoom shares. But for example UK government leaders repeatedly mentioning it by name, e.g. Matt Hancock saying tha…
[deleted]
Re: Zoom’s encryption has links to China, researchers discover
#19Maybe I've been sensitised by all the security flaws, privacy leaks and outright lies on Zoom's part, but I'm starting to really notice how much a lot of public figures are pushing Zoom. Does anyone else find it really weird? Late-night TV hosts, I can understand - maybe they just get paid for it, or have Zoom shares. But for example UK government leaders repeatedly mentioning it by name, e.g. Matt Hancock saying tha…
well another thing is that zoom is a great name, on a marketing level.
It implies speed, and thus implies power.
Since you zoom in on things to see them better it implies attention to detail.
The productivity of the prime minister is in no way hampered, people, he Zooms!
Re: Zoom’s encryption has links to China, researchers discover
#20And another case of lying in marketing: "A security white paper from the company claims that Zoom meetings are protected using 256-bit AES keys, but the Citizen Lab researchers confirmed the keys in use are actually only 128-bit." How do they keep doing this? Do they just put whatever sells best in the documents and implement something else? First the end2end thing, now 128 instead of 256 bits. How many more are we g…
"We never meant to mislead people but we realise we don't use the terminology in the way it is normally understood. We added up the keys on both sides of the conversation to reach 256 bits." Is probably what they'll say