Original title: Zoom's Encryption is “Not Suited for Secrets” and Has Surprising Links to China
Yeah, I only kept the second part of the title when submitting it because it was a) too long and b) too clickbait-y.
Zoom’s encryption has links to China, researchers discover
41–50 of 137 posts
Re: Zoom’s encryption has links to China, researchers discover
#42OT: My kids school uses zoom atm.
Been connecting using the web client at
https://zoom.us/wc/join/ without dashes>.
Today however those links are returning 403 Forbidden (even tried multi)
My knee-jerk reaction was that they have some way of capitalizing on installed software which they can't on the web-client. But of course it could simply be that the web-client requires more server resources and now have to curb its usage.
Re: Zoom’s encryption has links to China, researchers discover
#43I'd recommend reading the original Citizen Lab article as well, which discusses the flaws more specifically. This Intercept article is good, but seems to be aimed at more of a general, less-technical audience. https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto... At the very least, they are validating TLS certificates. (Which I know is the true bare minimum requirement of TLS, but "goto fail" and all...) >W…
The CL article seems to be underplaying the vulnerability of ECB, with the "not recommended" description. Any cryptographer will tell you it's downright trivially broken, with textbook practical attacks taught to undergrads.
Re: Zoom’s encryption has links to China, researchers discover
#44Earlier quoted context omitted.
Zoom is popular. Enough that it's both the default for many people and the tech that gets brought up in discussions. My dance school uses zoom. My work uses zoom. Online courses use zoom. Maybe it's more noticeable when famous people mention it, but really - it's a default now. Even if there was some shady push for it, it's also organically massively popular.
trying to download the (self-installing) app twice _every_ time, whilst you're (actively) trying to join a meeting in your browser is the kind of organic popularity the yahoo toolbar had...
Most people install the app and leave it installed.
Re: Zoom’s encryption has links to China, researchers discover
#45I've really grown to dislike the "China == bad" thing, yes, they're domestically authoritarian, without excusing any of it, I like to act on hard evidence, not hear say, I am stunned that after the Bloomberg fiasco these kind of stories didn't take a hit. P.S. Personally, I don't consider the NSA having my data as being any better, thank you. EDIT: Just to be clear, I don't think Zoom's encryption claims should be tr…
If encryption keys are stored in a country where the company is required, by law or by force, to turn them over to authorities upon request then that should be noted. And yes that includes the US to a lesser degree.
When people say 'the server with the encryption keys is physically located in China, and they have many Chinese employees', the subtext that we should all know at this point is that they're required by Chinese law to turn everything over to the authorities. We have hard evidence & beyond hard evidence of this, so it's kind of assumed that educated people are aware of this. And yes the same goes for say US telecom companies having legally mandated backdoors & the US government exploiting this to conduct unauthorized surveillance or even just purely commercial spying, it's well-documented, everyone should know this. So in the future someone can say 'this telecom company is US-based' and we can all understand the subtext.
So it's OK to just say 'the servers are in China' and we should all know what that means, at this point. TLDR- it's OK to have priors
Re: Zoom’s encryption has links to China, researchers discover
#46I'd recommend reading the original Citizen Lab article as well, which discusses the flaws more specifically. This Intercept article is good, but seems to be aimed at more of a general, less-technical audience. https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto... At the very least, they are validating TLS certificates. (Which I know is the true bare minimum requirement of TLS, but "goto fail" and all...) >W…
The CL article seems to be underplaying the vulnerability of ECB, with the "not recommended" description. Any cryptographer will tell you it's downright trivially broken, with textbook practical attacks taught to undergrads.
An explanation w/ visuals for how/why ECB is a broken mode of operation for cryptography - https://www.crypteron.com/blog/practical-searchable-encrypti...
Re: Zoom’s encryption has links to China, researchers discover
#47Earlier quoted context omitted.
trying to download the (self-installing) app twice _every_ time, whilst you're (actively) trying to join a meeting in your browser is the kind of organic popularity the yahoo toolbar had...
Most people install the app and leave it installed.
you don't say. That way (and autostarting and nagging) you easily get a lot of popularity compared to a web-service (with most people being unaware of bookmarking features in their browser). That was the operating principle of a lot of crappy ad/malware companies back then this was still considered an ethical businessmodel. Seems we are seeing time repeat itself.
Re: Zoom’s encryption has links to China, researchers discover
#48Earlier quoted context omitted.
Many of the alternative modes are unsuitable for this case, as it is being used to encrypt UDP packets which may be lost. There are two commonly used modes which support the random access needed here: - ECB - CTR Note that CTR is still recommended for use and is often used for things like hard-disk encryption where random access is required. Furthermore, the only difference between ECB and CTR is that CTR includes an…
Is there a way to use ECB "correctly"? Is there any non-repeating data apart from noise (if even)?
Yes, as I mentioned, if you include an incrementing counter within each block then the data does not repeat. The data only needs to be non-repeating within a single stream. Different streams will use a different IV and possibly different keys. This is how CTR works.
Re: Zoom’s encryption has links to China, researchers discover
#49I've really grown to dislike the "China == bad" thing, yes, they're domestically authoritarian, without excusing any of it, I like to act on hard evidence, not hear say, I am stunned that after the Bloomberg fiasco these kind of stories didn't take a hit. P.S. Personally, I don't consider the NSA having my data as being any better, thank you. EDIT: Just to be clear, I don't think Zoom's encryption claims should be tr…
They also base a lot of their economy on corporate espionage and stealing technology.
Re: Zoom’s encryption has links to China, researchers discover
#50Original title: Zoom's Encryption is “Not Suited for Secrets” and Has Surprising Links to China
Yeah, I only kept the second part of the title when submitting it because it was a) too long and b) too clickbait-y.
It's using ECB mode. That doesn't even provide confidentiality. "Not suited for secrets" is entirely correct, and actually somewhat mild.