Zoom rolled their own encryption scheme, transmit keys through servers in China

Post by Justsignedup » Fri, Apr 03, 2020, 9:50 PM UTC

dhosek wrote: post #101

AshamedCaptain wrote: post #62

Seriously, all people who are surprised about this type of news should really understand that most "successful" (as in, popular) tech/.com/SV "startups" these days are like this. If you "waste" time on the real important stuff such as a good design, user security, or the like, you will lose over to a competitor who didn't and therefore was able to spend more time on marketing. If you waste your time on user privacy y…

But when I see "roll their own encryption," it tells me that they went out of their way to create something subpar. There are some things that one should never* roll one's own of, and encryption has to be the top of the list. * OK, if you're an encryption expert, you obviously would roll your own to advance the state of the art, but Zoom are quite obviously not encryption experts.

Post by uoaei » Fri, Apr 03, 2020, 9:53 PM UTC

Justsignedup wrote: post #111

dhosek wrote: post #101

Earlier quoted context omitted.

But when I see "roll their own encryption," it tells me that they went out of their way to create something subpar. There are some things that one should never* roll one's own of, and encryption has to be the top of the list. * OK, if you're an encryption expert, you obviously would roll your own to advance the state of the art, but Zoom are quite obviously not encryption experts.

"Roll your own" is such a oversimplification. Usually it is: I can spend all this time making things right, or bob here knows how to do this other simple way that is good enough in a week.

Post by [deleted] » Fri, Apr 03, 2020, 9:57 PM UTC

rzimmerman wrote: post #25

Using AES in ECB mode is clearly a bad choice, but honestly it's not that horrible for high entropy data like compressed audio/video. I'm sure someone could prove me wrong one day, but it seems hard to extract any useful patterns out of compressed audio/video. It does check the box of "uses encryption" for regulatory reasons (while missing the intent). It's pretty egregious considering how easy this is to get right.…

Post by jtdev » Fri, Apr 03, 2020, 10:02 PM UTC

ziyao_w wrote: post #19

013a wrote: post #10

> Zoom’s most recent SEC filing shows that the company (through its Chinese affiliates) employs at least 700 employees in China that work in “research and development.” Wow. What could all of these people possibly be doing? It can't be development and QA; what's going on over there?

You do realize development include software engineering, right? 700 people doing programming isn't even remotely surprising. Not to defend them against the recent security fiasco, but innuendos such as this that links "employees working in China" directly with "shady business" makes me at least uncomfortable.

Post by jtdev » Fri, Apr 03, 2020, 10:04 PM UTC