Zoom still don't understand GDPR • Hacker News Board

Re: Zoom still don't understand GDPR

#151

Post by jessaustin » Fri, Aug 28, 2020, 8:34 AM UTC

kelnos wrote: post #83

p1necone wrote: post #67

Earlier quoted context omitted.

Browsers do generally have a limit on simultaneous outgoing connections per domain[1] - it could be related to that. (This is also why e.g. TFS breaks down when you open too many tabs). [1] https://docs.pushtechnology.com/cloud/latest/manual/html/des...

I doubt that has anything to do with it. Zoom almost certainly handles composing the image for gallery view server-side; you're not maintaining a separate connection for each participant.

It's possible that the server just forwards a selection of packets from each participant (hopefully dropping some from those who aren't speaking or moving) and the client stitches them into the view.

Re: Zoom still don't understand GDPR

#152

Post by HenryBemis » Fri, Aug 28, 2020, 8:36 AM UTC

dheera wrote: post #95

arkadiyt wrote: post #30

Earlier quoted context omitted.

> they bury the no-install, run-in-browser link I wrote a browser extension that will transparently redirect all zoom links to user their web client: https://github.com/arkadiyt/zoom-redirector

I thought they removed the in-browser link? Does your extension still work?

Likewise, I could swear that the first couple of times I had to use Zoom there was a clean/clear/large font option to "use web", and after some time they must have removed it (or changd the font to white and set it to 3).

I use WindowsFirewallControl (WFC) by BiniSoft (think ZoneAlarmPro) and "Allow" very specific executables to reach the internet. In that case, the Install/Uninstall.exe would cause an alarm, and I would (of course) "Block" it.

I know this is not a solution for (ahem) elderly, but it can work for the majority of 'us'.

Re: Zoom still don't understand GDPR

#153

Post by andrewnicolalde » Fri, Aug 28, 2020, 8:41 AM UTC

grenoire wrote: post #147

andrewnicolalde wrote: post #105

Earlier quoted context omitted.

As an aside, the Chrome cookies database on Windows is protected using the Windows Data Protection API[1], which ties encryption keys to a specific user. In the case of the Chrome cookie database, each cookie's payload/value is encrypted using a cryptographic key generated by the DPAPI which is only accessible to that Windows user. Of course, (and as is the case with most situations like this), this does absolutely n…

I thought the rule was: If you can see it plaintext on the screen, it's not safe.

Could you elaborate on that? Of course no computer is completely secure against all forms of attack, but I’ve found statements like these to not contribute very much towards solving any practical security problems.

Re: Zoom still don't understand GDPR

#154

Post by tomschwiha » Fri, Aug 28, 2020, 8:45 AM UTC

The author is referring to the ePrivacy directive - its not the same as the GDPR.

Does he mean the ePrivacy regulation?

The ePrivacy regulation (not directive) is no binding law yet.

Re: Zoom still don't understand GDPR

#155

Post by donkeyd » Fri, Aug 28, 2020, 8:47 AM UTC

panpanna wrote: post #149

robomc wrote: post #59

Earlier quoted context omitted.

love this extension. we recommend it for everyone at work as the zoom client is banned.

What do you then do about the horrible performance of zoom in chrome? For me, the sound becomes unintelligible as soon as someone shares his screen.

Try a different browser. On Mac, Safari is much more resource efficient than Chrome for example. On Windows I'm not sure, but it can't hurt t give FF a try.

Re: Zoom still don't understand GDPR

#156

Post by daffy » Fri, Aug 28, 2020, 8:51 AM UTC

If you have run the native programme (for me it keeps breaking up in the browser), run it from a dedicated unpriviledged user, without installing it on the system. (Run ./opt/zoom/ZoomLauncher.) If you have to log in (I couldn't change the input device without logging in), when your browser tries to open the not installed programme, copy the link and give it as a command-line argument to ZoomLauncher.

Looking forward to a working alternative.

Re: Zoom still don't understand GDPR

#157

Post by azepoi » Fri, Aug 28, 2020, 8:51 AM UTC

I really don't like how Zoom forces the download of an executable, how doesn't this trip the antimalware? What a bad practice.

Re: Zoom still don't understand GDPR

#158

Post by currysausage » Fri, Aug 28, 2020, 8:58 AM UTC

robflaherty wrote: post #142

“Zoom cookies are firstly written when the user connects to the website zoom.us and accepts the cookies options.” That was the moment Zoom received your consent to store data transmitted by cookies. Adding a few more cookies to the pile, regardless of expiration date, doesn’t change the agreement. Rummaging round the cookie bin on uninstall is a nice find and deserves a raised eyebrow but this doesn’t really have any…

This is very likely not valid consent under GDPR. Look at specific guidance on valid consent by DPAs: https://ico.org.uk/for-organisations/guide-to-data-protectio...

Re: Zoom still don't understand GDPR

#159

Post by matsemann » Fri, Aug 28, 2020, 9:00 AM UTC

laurent92 wrote: post #128

Why do you guys not use https://whereby.com (formerly appear.in), it’s free for 4 people, in-browser only, no-login, WebRTC, allows sharing the screen alongside faces. But they made the 5+ rooms $9 per month, which is way too expensive. There are not enough competitors for WebRTC conf tools, it should be quite simple and $4-5 a month (WebRTC doesn’t incur data costs on the servers since the data is peer-to-peer).

I don't get your argument about the pricing. If you're 5+ people you can split that cost. If it's for professional use, a few dollars is a blip.

Re: Zoom still don't understand GDPR

#160

Post by theshrike79 » Fri, Aug 28, 2020, 9:12 AM UTC

juped wrote: post #99

andrewnicolalde wrote: post #29

Earlier quoted context omitted.

Same, they were my preferred platform for secure messaging, which is bizarre when you think about the fact that this wasn't even their original purpose. I guess this was indicative of the general lack of a single defined direction the product was going in near the time of the Zoom acquisition. What a shame. Hopefully someone makes something similar.

What was the draw of Keybase? I wasn't interested when it was a "post all your website usernames here, but with crypto somehow" site, and by the time I looked in on it later, it was an unreadable startup homepage and had some kind of cryptocurrency scam attached to it. If it had a good messaging featureset that should be cloned, former Keybase users should speak up!

For me Keybase was a place to collect my public internet profiles in one place, with cryptographic auth that it's actually me.

All the chat, team, storage and crypto crap was just superfluous for me.