SpaceX bans Zoom over privacy concerns • Hacker News Board

Re: SpaceX bans Zoom over privacy concerns

#281

Post by modeless » Thu, Apr 02, 2020, 4:47 PM UTC

peteretep wrote: post #206

modeless wrote: post #150

Earlier quoted context omitted.

iCloud isn't some separate entity from iMessage. It's all Apple. And you have no option to use a different cloud backup provider. You can decide not to give your keys to Apple, but you can't decide for all your friends to not give their keys to Apple, and the result is the same: Apple can read your messages. And the marketing is so misleading that hardly anyone knows that Apple can read most iMessages.

Sorry, let's be explicit here, as you seem intent on muddying the issue. Where, other than the endpoints, is the message decrypted when people use iMessage? Your succinct answer to that will clear this up for everyone.

I have linked it several times in this thread. Here it is again:

"If you have iCloud Backup turned on, your backup includes a copy of the key protecting your Messages. This ensures you can recover your Messages if you lose access to iCloud Keychain and your trusted devices."

https://support.apple.com/en-us/HT202303

Re: SpaceX bans Zoom over privacy concerns

#282

Post by modeless » Thu, Apr 02, 2020, 4:51 PM UTC

simonh wrote: post #214

modeless wrote: post #141

Earlier quoted context omitted.

But unless everyone you correspond with does this too, Apple can still read your messages to them.

Sure, the security of your communications to someone depends on how well they protect them, not just you. That’s always true.

But most end-to-end encrypted apps aren't configured by most of their users to send their messages and encryption keys directly to the author of the app. iMessage is.

Re: SpaceX bans Zoom over privacy concerns

#283

Post by modeless » Thu, Apr 02, 2020, 4:57 PM UTC

criddell wrote: post #268

modeless wrote: post #97

Earlier quoted context omitted.

Yes, it does. The messages are 'end to end' encrypted in the iMessage service, but then iMessage backs up its encryption key in the iCloud backup service, defeating the point. "If you have iCloud Backup turned on, your backup includes a copy of the key protecting your Messages. This ensures you can recover your Messages if you lose access to iCloud Keychain and your trusted devices." https://support.apple.com/en-us/H…

> defeating the point Have you considered that some people trust Apple but don't trust Zoom? At some point you have to trust somebody, right?

Feel free to trust who you want but I don't think Apple should be able to get away with calling iMessage end-to-end encrypted when they have most iMessages stored on their servers and the keys to decrypt them.

> At some point you have to trust somebody, right?

It's possible to use an actual end to end encrypted app that doesn't have the keys to read your messages stored on their servers.

Re: SpaceX bans Zoom over privacy concerns

#284

Post by _6fmb » Thu, Apr 02, 2020, 5:26 PM UTC

_ph_ wrote: post #204

The problem with Zoom isn't, that it doesn't have end-to-end encryption. If you consider the problem, it is extremely difficult to solve, as in contrast to a 1:1 video call, the server somehow has to to multiplex the streams and thus at least some access to them. With a trustworthy provider, this isn't a big issue. A trustworthy provider will have a clear policy which ensures that only the multiplexer has access to t…

Zoom is sufficiently end-to-end encrypted for me. https://blog.zoom.us/wordpress/2020/04/01/facts-around-zoom-...

Re: SpaceX bans Zoom over privacy concerns

#285

Post by cutemonster » Thu, Apr 02, 2020, 6:25 PM UTC

twomoretime wrote: post #267

stevenicr wrote: post #194

Earlier quoted context omitted.

This bothers me so much - as I have personally recommended zoom to many people and customers. People that have likely seen that I spend an unusual amount of time focused on computer security, backups, and care in communications. If I remember correctly, zoom used to have on the front page - use this it's encrypted, and 'even used by us govt something-something' - so I assumed it was completely secure. I actually refu…

I doubt non-technical users are savvy enough to find out about this problem and they probably won't remember to blame you for something clearly beyond your control. I know it's the kind of thing that can randomly keep a person up at night, but I think you can probably safely forget about this awkwardness and move on.

Especially since so many tech people were taken by surprise by this -- thousands of upvotes for all Zoom topics together now

Re: SpaceX bans Zoom over privacy concerns

#286

Post by Eldt » Thu, Apr 02, 2020, 6:30 PM UTC

stevenicr wrote: post #194

LeifCarrotson wrote: post #45

Earlier quoted context omitted.

Not just "deceptive" nor "unlikely", it's blatant false advertising.

This bothers me so much - as I have personally recommended zoom to many people and customers. People that have likely seen that I spend an unusual amount of time focused on computer security, backups, and care in communications. If I remember correctly, zoom used to have on the front page - use this it's encrypted, and 'even used by us govt something-something' - so I assumed it was completely secure. I actually refu…

Why would you push it so strongly after only giving it a cursory inspection?

Re: SpaceX bans Zoom over privacy concerns

#287

Post by Seirdy » Thu, Apr 02, 2020, 7:23 PM UTC

_ph_ wrote: post #204

The problem with Zoom isn't, that it doesn't have end-to-end encryption. If you consider the problem, it is extremely difficult to solve, as in contrast to a 1:1 video call, the server somehow has to to multiplex the streams and thus at least some access to them. With a trustworthy provider, this isn't a big issue. A trustworthy provider will have a clear policy which ensures that only the multiplexer has access to t…

Matrix/Riot, Jitsi, and Signal seem to have handled E2EE voice/video pretty well while being FOSS (the first of which is a free/open protocol as well as a client).

Re: SpaceX bans Zoom over privacy concerns

#288

Post by stonogo » Thu, Apr 02, 2020, 7:50 PM UTC

ibrault wrote: post #82

stonogo wrote: post #70

Earlier quoted context omitted.

Zoom and Slack are both FedRamp authorized for government use. Zoom is even authorized Moderate, while Slack is still being audited for that rating. https://marketplace.fedramp.gov/#/product/zoom-for-governmen... https://marketplace.fedramp.gov/#/product/slack

I'm not sure what FedRAMP is but I work at an FFRDC and Slack is explicitly banned for all ITAR materials. Mattermost is used, though

FedRAMP Moderate is insufficient for ITAR work, that's true. The problem is that in order to get the appropriate rating, one of the things you have to do is go through the FedRAMP process, and only Slack, Zoom, and MS Teams are even trying.

Mattermost is self-hostable, so as long as you tightly control access, a lot of the SaaS prohibitions don't apply.

Re: SpaceX bans Zoom over privacy concerns

#289

Post by stevenicr » Thu, Apr 02, 2020, 7:54 PM UTC

Eldt wrote: post #286

stevenicr wrote: post #194

Earlier quoted context omitted.

This bothers me so much - as I have personally recommended zoom to many people and customers. People that have likely seen that I spend an unusual amount of time focused on computer security, backups, and care in communications. If I remember correctly, zoom used to have on the front page - use this it's encrypted, and 'even used by us govt something-something' - so I assumed it was completely secure. I actually refu…

Why would you push it so strongly after only giving it a cursory inspection?

Because all the others I have been inspecting failed one of the big checkboxes almost immediately. Is it private? most no - skip. Is it easy to get started? the private private self hosted, not so much.. Zoom - private, encrypted, used by the us govt and easy to use.. So others trust and use, they have a firm business model - and a reputation not to lose. No others I found had this.

Re: SpaceX bans Zoom over privacy concerns

#290

Post by stevenicr » Thu, Apr 02, 2020, 7:56 PM UTC

twomoretime wrote: post #267

stevenicr wrote: post #194

Earlier quoted context omitted.

This bothers me so much - as I have personally recommended zoom to many people and customers. People that have likely seen that I spend an unusual amount of time focused on computer security, backups, and care in communications. If I remember correctly, zoom used to have on the front page - use this it's encrypted, and 'even used by us govt something-something' - so I assumed it was completely secure. I actually refu…

I doubt non-technical users are savvy enough to find out about this problem and they probably won't remember to blame you for something clearly beyond your control. I know it's the kind of thing that can randomly keep a person up at night, but I think you can probably safely forget about this awkwardness and move on.

Thing is - this story is all over the mainstream news. It's got multiple stories on the yahoo front page, it's reported via multiple sources in my fbook feed, but also with our regular tv news station. People are seeing this about zoom that have never seen zoom. People that I suggested use zoom are going to notice the word even if they would normally scroll past some gomeeting story.