Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SpaceX bans Zoom over privacy concerns

reuters.com

Post reply on HN
Print view View original

241–250 of 301 posts

Re: SpaceX bans Zoom over privacy concerns

#241

Post by [deleted] »

mdavidn wrote: post #224
_ph_ wrote: post #204

The problem with Zoom isn't, that it doesn't have end-to-end encryption. If you consider the problem, it is extremely difficult to solve, as in contrast to a 1:1 video call, the server somehow has to to multiplex the streams and thus at least some access to them. With a trustworthy provider, this isn't a big issue. A trustworthy provider will have a clear policy which ensures that only the multiplexer has access to t…

No. "End-to-end encryption" does not protect metadata necessary to route the data over a network, just the contents of the communication. The clients could negotiate keys to protect the contents of a meeting end-to-end. In other words, Zoom servers could deduce who was speaking, when they spoke, and for how long, but not what they said. Your internet service provider can deduce the same about your HTTPS connections.

[deleted]

Re: SpaceX bans Zoom over privacy concerns

#242

Post by IshKebab »

mdavidn wrote: post #224
_ph_ wrote: post #204

The problem with Zoom isn't, that it doesn't have end-to-end encryption. If you consider the problem, it is extremely difficult to solve, as in contrast to a 1:1 video call, the server somehow has to to multiplex the streams and thus at least some access to them. With a trustworthy provider, this isn't a big issue. A trustworthy provider will have a clear policy which ensures that only the multiplexer has access to t…

No. "End-to-end encryption" does not protect metadata necessary to route the data over a network, just the contents of the communication. The clients could negotiate keys to protect the contents of a meeting end-to-end. In other words, Zoom servers could deduce who was speaking, when they spoke, and for how long, but not what they said. Your internet service provider can deduce the same about your HTTPS connections.

> The clients could negotiate keys to protect the contents of a meeting end-to-end.

Not really because Zoom makes fairly extensive use of the decrypted video streams on their servers, e.g. to detect who is talking, pause video for people with slow connections, etc. You could maybe do it for meetings with a few people in, but good luck doing it for meetings with 100 people.

Hell the cryptography of group end-to-end encryption hasn't really been worked out yet. WhatsApp doesn't do it and that's just for text. I'm pretty sure Signal doesn't either.

There's really nothing bad with not having end-to-end encryption for group video conferencing apps. The shitty thing is that they pretended that they did.

Re: SpaceX bans Zoom over privacy concerns

#243

Post by IshKebab »

grahamburger wrote: post #68
allover wrote: post #49

Earlier quoted context omitted.

To be fair it does perform better than everything else, which is why people are so forgiving of it, but it still doesn't excuse their ineptitude on privacy and security.

In my experience Google's Hangout Meetings have been at least as good or better quality and the interface is far superior in my opinion. For example it works in the browser without any plugins (even in Firefox.)

Zoom also works in the browser (though they really push you to the app).

I tried Hangouts recently and the quality was terrible compared to Zoom. Discord was far better than Zoom though.

Re: SpaceX bans Zoom over privacy concerns

#244

Post by dwaite »

diebeforei485 wrote: post #211
dgcupps wrote: post #105

Earlier quoted context omitted.

That is true of any end-to-end solution. If you back up your private keys, anyone who has access to your backup would be able to access the encrypted messages. Remember, you can turn off iCloud backup if you're worried about Apple accessing your keys. Ultimately, it's false to equate iMessage's encryption scheme, which is end-to-end, to an encryption scheme that requires a server to relay decrypted data.

Turning off iCloud backup is not a genuine choice, because it means you lose everything if you lose or break your phone (there is no other way to back up your phone except iCloud backup, Apple does not allow third-party phone backup services).

You can do local encrypted backups to a Mac, either via to iTunes (<10.15) or Finder (10.15).

Re: SpaceX bans Zoom over privacy concerns

#246

Post by circular_logic »

ajmurmann wrote: post #145
grahamburger wrote: post #68

Earlier quoted context omitted.

In my experience Google's Hangout Meetings have been at least as good or better quality and the interface is far superior in my opinion. For example it works in the browser without any plugins (even in Firefox.)

I haven't used Hangouts on a professional setting in a while. Does it finally support tile view? Another feature I find really valuable is allowing two windows. One for participant view and a separate one for shared screen.

it does on the hangouts for business (ie google meet) but then only for up to 4 other users

Re: SpaceX bans Zoom over privacy concerns

#247

Post by fulafel »

_ph_ wrote: post #204

The problem with Zoom isn't, that it doesn't have end-to-end encryption. If you consider the problem, it is extremely difficult to solve, as in contrast to a 1:1 video call, the server somehow has to to multiplex the streams and thus at least some access to them. With a trustworthy provider, this isn't a big issue. A trustworthy provider will have a clear policy which ensures that only the multiplexer has access to t…

The server does not have to decrypt or process the video, it can just send the same encrypted video to other clients (or you can use p2p communication without a server involved).

There may be advantages to processing video at the server, but it's definitely not a hard requirement.

Re: SpaceX bans Zoom over privacy concerns

#248

Post by dwaite »

IshKebab wrote: post #242
mdavidn wrote: post #224

Earlier quoted context omitted.

No. "End-to-end encryption" does not protect metadata necessary to route the data over a network, just the contents of the communication. The clients could negotiate keys to protect the contents of a meeting end-to-end. In other words, Zoom servers could deduce who was speaking, when they spoke, and for how long, but not what they said. Your internet service provider can deduce the same about your HTTPS connections.

> The clients could negotiate keys to protect the contents of a meeting end-to-end. Not really because Zoom makes fairly extensive use of the decrypted video streams on their servers, e.g. to detect who is talking, pause video for people with slow connections, etc. You could maybe do it for meetings with a few people in, but good luck doing it for meetings with 100 people. Hell the cryptography of group end-to-end en…

> Not really because Zoom makes fairly extensive use of the decrypted video streams on their servers, e.g. to detect who is talking, pause video for people with slow connections, etc. You could maybe do it for meetings with a few people in, but good luck doing it for meetings with 100 people.

You encrypt audio and video streams separately. If your connection is slow you stop grabbing the video stream. Detecting who is talking is a local function because you are receiving audio packets from them. Encryption doesn't have to change the amount of data sent.

> Hell the cryptography of group end-to-end encryption hasn't really been worked out yet. WhatsApp doesn't do it and that's just for text. I'm pretty sure Signal doesn't either.

Two ways: 1. Your password does not need to be shared with Zoom for entry into the meeting room. That password and the meeting room number are converted into a symmetric encryption key, so everyone who is able to join the meeting successfully has the same group shared secret for both sending and receiving video and audio.

2. You have an invitation system where the host of the meeting approves people. This approval causes the symmetric key of the meeting to be shared with the person seeking approval, encrypted to their public key. People who can supply a proof of possession of the password or whose public keys were associated with the meeting get invited without requiring confirmation by the host, although the participants in the room becomes a log of who was able to view the meeting.

These get harder if you want to say have a periodic key rotation while a meeting is going, for sure. They also get harder if you try to encrypt routing metadata or disguise that the traffic is audio/video in general.

The real thing that kills E2E for a corporate product like Zoom are the phone dial-ins. Hardly a point for all that security if you have one person calling in having the now unencrypted voice traffic bounced all over the place.

> There's really nothing bad with not having end-to-end encryption for group video conferencing apps. The shitty thing is that they pretended that they did.

100% agreed within Zoom's market because of integration of external services like dial-in/dial-out voice.

Re: SpaceX bans Zoom over privacy concerns

#249

Post by _ph_ »

fulafel wrote: post #247
_ph_ wrote: post #204

The problem with Zoom isn't, that it doesn't have end-to-end encryption. If you consider the problem, it is extremely difficult to solve, as in contrast to a 1:1 video call, the server somehow has to to multiplex the streams and thus at least some access to them. With a trustworthy provider, this isn't a big issue. A trustworthy provider will have a clear policy which ensures that only the multiplexer has access to t…

The server does not have to decrypt or process the video, it can just send the same encrypted video to other clients (or you can use p2p communication without a server involved). There may be advantages to processing video at the server, but it's definitely not a hard requirement.

The problem is, that then you have to send all video streams to all client, that doesn't scale very well.

Re: SpaceX bans Zoom over privacy concerns

#250

Post by fulafel »

_ph_ wrote: post #249
fulafel wrote: post #247

Earlier quoted context omitted.

The server does not have to decrypt or process the video, it can just send the same encrypted video to other clients (or you can use p2p communication without a server involved). There may be advantages to processing video at the server, but it's definitely not a hard requirement.

The problem is, that then you have to send all video streams to all client, that doesn't scale very well.

The clients could control which video streams they want to subscribe to without the server decrypting them.

If you want to support thumbnail/fullscreen versions of streams, the clients could just send along two streams or use a codec that supports this kind, like h.264 SVC.

Post reply on HN