Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom’s encryption has links to China, researchers discover

theintercept.com

Post reply on HN
Print view View original

21–30 of 137 posts

Re: Zoom’s encryption has links to China, researchers discover

#21

Post by Diggsey »

tpetry wrote: post #7
dogman144 wrote: post #6

"home grown encryption scheme" seems to imply Zoom is rolling its own crypto, which is tremendously foolish. That isn't exactly the case, per the same article. More Zoom is choosing a poor choice among other choices, of implementing AES: "Furthermore, Zoom encrypts and decrypts with AES using an algorithm called Electronic Codebook (ECB) mode, “which is well-understood to be a bad idea, because this mode of encryptio…

Even Wikipedia is stating ECB is a very bad choice. How can someone really use it nowadays without fraudulent intentions?

Many of the alternative modes are unsuitable for this case, as it is being used to encrypt UDP packets which may be lost. There are two commonly used modes which support the random access needed here:

- ECB - CTR

Note that CTR is still recommended for use and is often used for things like hard-disk encryption where random access is required. Furthermore, the only difference between ECB and CTR is that CTR includes an incrementing counter in the input to the encryption algorithm to ensure that each encryption is unique. Do you know what else starts with an incrementing counter? UDP packets intended to form an audio or video stream.

So yes: ECB can be bad, but there's no evidence that Zoom are actually using it incorrectly. Using CTR when you already have a non-repeating data stream would only add overhead and potentially negatively impact the amount of useful data that can be streamed.

Re: Zoom’s encryption has links to China, researchers discover

#22

Post by tzm »

_-___________-_ wrote: post #9

Maybe I've been sensitised by all the security flaws, privacy leaks and outright lies on Zoom's part, but I'm starting to really notice how much a lot of public figures are pushing Zoom. Does anyone else find it really weird? Late-night TV hosts, I can understand - maybe they just get paid for it, or have Zoom shares. But for example UK government leaders repeatedly mentioning it by name, e.g. Matt Hancock saying tha…

It's becoming a verb (vs brand) which reflects rising popularity and use.

Re: Zoom’s encryption has links to China, researchers discover

#23

Post by MobileVet »

_-___________-_ wrote: post #9

Maybe I've been sensitised by all the security flaws, privacy leaks and outright lies on Zoom's part, but I'm starting to really notice how much a lot of public figures are pushing Zoom. Does anyone else find it really weird? Late-night TV hosts, I can understand - maybe they just get paid for it, or have Zoom shares. But for example UK government leaders repeatedly mentioning it by name, e.g. Matt Hancock saying tha…

Zoom is now ‘Kleenex’ or ‘Coke’ for video conferencing. Skype was the same when it came out... but they had far less competition at the time.

This is a huge win for Zoom on a marketing front.

Re: Zoom’s encryption has links to China, researchers discover

#24

Post by dvfjsdhgfv »

bryanrasmussen wrote: post #19
_-___________-_ wrote: post #9

Maybe I've been sensitised by all the security flaws, privacy leaks and outright lies on Zoom's part, but I'm starting to really notice how much a lot of public figures are pushing Zoom. Does anyone else find it really weird? Late-night TV hosts, I can understand - maybe they just get paid for it, or have Zoom shares. But for example UK government leaders repeatedly mentioning it by name, e.g. Matt Hancock saying tha…

well another thing is that zoom is a great name, on a marketing level. It implies speed, and thus implies power. Since you zoom in on things to see them better it implies attention to detail. The productivity of the prime minister is in no way hampered, people, he Zooms!

> It implies speed

on far too many lenses I've owned it's simply not true

Re: Zoom’s encryption has links to China, researchers discover

#25

Post by HumblyTossed »

t0mas88 wrote: post #5

And another case of lying in marketing: "A security white paper from the company claims that Zoom meetings are protected using 256-bit AES keys, but the Citizen Lab researchers confirmed the keys in use are actually only 128-bit." How do they keep doing this? Do they just put whatever sells best in the documents and implement something else? First the end2end thing, now 128 instead of 256 bits. How many more are we g…

> How do they keep doing this?

Hard to say. Could be cultural where sales and engineering butt heads. Could be "sell it first, develop it later so we can beat the market" mentality.

Either way, Zoom is going to go down as either a company that did everything right and won the market or did everything wrong and won the market. Depending on who you talk to.

Re: Zoom’s encryption has links to China, researchers discover

#26

Post by dogman144 »

tpetry wrote: post #7
dogman144 wrote: post #6

"home grown encryption scheme" seems to imply Zoom is rolling its own crypto, which is tremendously foolish. That isn't exactly the case, per the same article. More Zoom is choosing a poor choice among other choices, of implementing AES: "Furthermore, Zoom encrypts and decrypts with AES using an algorithm called Electronic Codebook (ECB) mode, “which is well-understood to be a bad idea, because this mode of encryptio…

Even Wikipedia is stating ECB is a very bad choice. How can someone really use it nowadays without fraudulent intentions?

ECB is a standard mode on many crypto libraries. Devs don't know better, or are intimidated by IVs

Re: Zoom’s encryption has links to China, researchers discover

#27

Post by kossTKR »

_-___________-_ wrote: post #9

Maybe I've been sensitised by all the security flaws, privacy leaks and outright lies on Zoom's part, but I'm starting to really notice how much a lot of public figures are pushing Zoom. Does anyone else find it really weird? Late-night TV hosts, I can understand - maybe they just get paid for it, or have Zoom shares. But for example UK government leaders repeatedly mentioning it by name, e.g. Matt Hancock saying tha…

It is curious, and post revelations in the recent decade nothing is too weird to suspect - but don't underestimate the immense social value of jumping on the technological bandwagon and the free "hip" PR that it produces in media. And when more people do it, more people do it, i.e the bandwagon effect.

People then look at the articles written in the media and say "hey i use that app too, cool, we are part of the same tribe".

Showing of knowledge of the tech-zeitgeist is an easy way for a politician or anyone for that matter to appear being both with the times", "tech-savvy" and just the same as regular folk.

Re: Zoom’s encryption has links to China, researchers discover

#30

Post by complex1314 »

_-___________-_ wrote: post #9

Maybe I've been sensitised by all the security flaws, privacy leaks and outright lies on Zoom's part, but I'm starting to really notice how much a lot of public figures are pushing Zoom. Does anyone else find it really weird? Late-night TV hosts, I can understand - maybe they just get paid for it, or have Zoom shares. But for example UK government leaders repeatedly mentioning it by name, e.g. Matt Hancock saying tha…

Maybe they tried Skype first, which works horrible (tried twice, never managed connect all the participants at the same time), and finally relief over something that actually works. I have used Zoom successfully with 70 participants, and then breakout groups. The only alternative I can see that recently came to my attention is Jitsi Meet (https://jitsi.org/), which I will try next time I have the opportunity. But seems like it has at least one of the same weaknesses as zoom, with no end to end encryption (https://www.reddit.com/r/privacy/comments/7syt0s/jitsi_meet_...)
Post reply on HN