Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom lied to users about end-to-end encryption for years, FTC says

arstechnica.com

Post reply on HN
Print view View original

41–50 of 438 posts

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#41

Post by londons_explore »

velcro wrote: post #21
londons_explore wrote: post #8

If Zoom made clear to users that connections were not secured to the same standards as competitors, and that potentially hundreds of employees could be silently listening in on any call, I think that would have prevented them becoming a leader in video conference tech. So the right fine here is their entire market cap. That would put them back at square one, which is where an honest competitor would be right now.

Not defending them in any way - but don't think security was the primary reason for Zoom taking off. It was stability - it just worked and at the same time competitors didn't. Everybody used to have Skype and I would have gladly handed over my data to MS if only it would have been able to do stable video calls. It was often a disaster for just 2-way calls, let alone group.

> don't think security was the primary reason for Zoom taking off. It was stability

Stability was the main draw, but company IT departments would have had more power to ban it if there were bigger and clearer risks of corporate secrets escaping.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#42

Post by _-___________-_ »

smokey_circles wrote: post #25

I don't understand how the FTC arrived at the conclusion they're not E2E? Or have I missed something? >Despite promising end-to-end encryption, the FTC said that "Zoom maintained the cryptographic keys that could allow Zoom to access the content of its customers' meetings, and secured its Zoom Meetings, in part, with a lower level of encryption than promised." Not wonderful but that still, technically, is an E2E encr…

Most videoconferencing systems are not E2E-encrypted. They encrypt the link between each participant and the central server. This makes implementation simpler in a few ways.

A good E2E-encrypted system would involve Zoom never having the keys at all, so "key storage" would be irrelevant.

The issue here is merely that Zoom claimed to be E2E-encrypted when they were not. They could have simply said "encrypted" and there would be no issue.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#43

Post by intricatedetail »

aofeisheng wrote: post #17

All E2E encryption claims in closed source software are untrustworthy. What're you expecting?

Even with open source software you will never know what is actually running on the servers. It's best to assume none of the services are e2e encrypted and you should provide your own encryption on top of the medium you communicate with if you require privacy. By own encryption I mean exchanging keys and encrypting offline using oss tools.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#44

Post by user5994461 »

eddieoz wrote: post #16
londons_explore wrote: post #8

If Zoom made clear to users that connections were not secured to the same standards as competitors, and that potentially hundreds of employees could be silently listening in on any call, I think that would have prevented them becoming a leader in video conference tech. So the right fine here is their entire market cap. That would put them back at square one, which is where an honest competitor would be right now.

Some reports say the whole video conferencing market, being very optimistic, will reach $50B in 2026 (considering Covid-19 - https://www.gminsights.com/industry-analysis/video-conferenc... ) But Zoom, alone, already has a marketcap of $117.534B ( https://finance.yahoo.com/quote/ZM/ ) I really think there is an unsustainable distortion happening.

The market being $50B means there are $50B of sales to do per year.

Market cap is a multiplier of revenues, easily 10 or 20 for a tech company, that means a $1T market cap to be taken across the videoconference companies.

Wondering how numbers can be so high? Count $10 per month * 12 months in a year * 100 million employees in the US... that is $12B per year going to video software!

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#45

Post by _-___________-_ »

intricatedetail wrote: post #43
aofeisheng wrote: post #17

All E2E encryption claims in closed source software are untrustworthy. What're you expecting?

Even with open source software you will never know what is actually running on the servers. It's best to assume none of the services are e2e encrypted and you should provide your own encryption on top of the medium you communicate with if you require privacy. By own encryption I mean exchanging keys and encrypting offline using oss tools.

> Even with open source software you will never know what is actually running on the servers.

If the clients are open-source and properly implement end-to-end encryption, and you verify that they are not sending your keys to the servers, then what is running on the servers is irrelevant.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#46

Post by DangerousPie »

vaccinator wrote: post #38
velcro wrote: post #21

Earlier quoted context omitted.

Not defending them in any way - but don't think security was the primary reason for Zoom taking off. It was stability - it just worked and at the same time competitors didn't. Everybody used to have Skype and I would have gladly handed over my data to MS if only it would have been able to do stable video calls. It was often a disaster for just 2-way calls, let alone group.

Skype was better before the MS aquisition... and it used to be P2P. It'd be nice if the pre-MS source would leak somehow.

I think you may be viewing history through slightly rose-tinted glasses there - I used pre-MS Skype a lot and it was never anywhere near as reliable as Zoom is and didn't support group video chat at all. And the fact that it was P2P meant that some features that everyone would expect to work these days (offline messages, mobile support) were simply not possible at all.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#47

Post by user5994461 »

thesimon wrote: post #26
johannes1234321 wrote: post #14

Earlier quoted context omitted.

Is it really different from competitors like Cisco (webex, jabber, ...)? A big selling point of all those is phone dial in which can't be done with e2e encryption (the phone gateway run by the operator has to have the keys)

The thing is: Our team doesn't use phone dial-in, haven't even seen the feature so I guess it's not enabled, but still we don't have e2e encryption. That doesn't make sense.

Phone dial-in is always a paid addon.

I guess it's the same on Zoom and your company doesn't pay for it.

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#48

Post by _-___________-_ »

roenxi wrote: post #18

Pretty scandalous stuff. But to be fair it seems pretty likely that any or all of the major players (Apple, Google, MS, Facebook, AWS, etc) to be maintaining some sort of back-door access to the channels they control for spying purposes. I suppose the risk with Zoom is leaks due to incompetence rather than leaks due to government intervention.

Apple claims that FaceTime is end-to-end encrypted (and makes some pretty strong statements about not having access to the content of communications). Facebook similarly claims that WhatsApp is end-to-end encrypted. Whilst I have little love for either company, do you have any evidence that these claims are lies?

Re: Zoom lied to users about end-to-end encryption for years, FTC says

#49

Post by DangerousPie »

_-___________-_ wrote: post #45
intricatedetail wrote: post #43

Earlier quoted context omitted.

Even with open source software you will never know what is actually running on the servers. It's best to assume none of the services are e2e encrypted and you should provide your own encryption on top of the medium you communicate with if you require privacy. By own encryption I mean exchanging keys and encrypting offline using oss tools.

> Even with open source software you will never know what is actually running on the servers. If the clients are open-source and properly implement end-to-end encryption, and you verify that they are not sending your keys to the servers, then what is running on the servers is irrelevant.

... if you have the technical expertise to audit the full source code, and run and audit your own build (on both ends).
Post reply on HN