Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom’s encryption has links to China, researchers discover

theintercept.com

Post reply on HN
Print view View original

51–60 of 137 posts

Re: Zoom’s encryption has links to China, researchers discover

#51

Post by mattmcknight »

jalk wrote: post #42

OT: My kids school uses zoom atm. Been connecting using the web client at https://zoom.us/wc/join/ without dashes>. Today however those links are returning 403 Forbidden (even tried multi) My knee-jerk reaction was that they have some way of capitalizing on installed software which they can't on the web-client. But of course it could simply be that the web-client requires more server resources and now have to curb it…

There is a maintenance issue up: https://status.zoom.us/incidents/16ll08mmddk6

Re: Zoom’s encryption has links to China, researchers discover

#52

Post by zeveb »

_-___________-_ wrote: post #36
notechback wrote: post #34

Earlier quoted context omitted.

But it only works if everyone has Apple devices, so it absolutely does not "just work" if even one family member doesn't have it. Most video chat apps are straightforward once set up on the phone.

Are you aware of other video chat apps that support e2e-encrypted multi-party videoconference?

If there are no cross-platform apps which support e2e-encrypted multi-party videoconferences, then there simply is currently no solution at all for 'just works' secure videoconferencing, because part of just working is not requiring users to switch to a platform they otherwise would not.

Re: Zoom’s encryption has links to China, researchers discover

#53

Post by s_dev »

t0mas88 wrote: post #5

And another case of lying in marketing: "A security white paper from the company claims that Zoom meetings are protected using 256-bit AES keys, but the Citizen Lab researchers confirmed the keys in use are actually only 128-bit." How do they keep doing this? Do they just put whatever sells best in the documents and implement something else? First the end2end thing, now 128 instead of 256 bits. How many more are we g…

> Do they just put whatever sells best in the documents and implement something else?

Yes.

I've always expected businesses to stretch the truth with their marketing e.g. "Leading Brand of Donut in America", "Award Winning Bread", "Cheapest Gas for 50 miles"

However Zoom are just engaging in straight up false advertising regarding security features. It's not cheeky -- it's wrong.

Re: Zoom’s encryption has links to China, researchers discover

#54

Post by 1over137 »

complex1314 wrote: post #30
_-___________-_ wrote: post #9

Maybe I've been sensitised by all the security flaws, privacy leaks and outright lies on Zoom's part, but I'm starting to really notice how much a lot of public figures are pushing Zoom. Does anyone else find it really weird? Late-night TV hosts, I can understand - maybe they just get paid for it, or have Zoom shares. But for example UK government leaders repeatedly mentioning it by name, e.g. Matt Hancock saying tha…

Maybe they tried Skype first, which works horrible (tried twice, never managed connect all the participants at the same time), and finally relief over something that actually works. I have used Zoom successfully with 70 participants, and then breakout groups. The only alternative I can see that recently came to my attention is Jitsi Meet ( https://jitsi.org/ ), which I will try next time I have the opportunity. But s…

But Jitsi is open source and you can self-host it. Then there's no third party in a hostile country controlling anything.

Re: Zoom’s encryption has links to China, researchers discover

#55

Post by [deleted] »

hash872 wrote: post #45
AsyncAwait wrote: post #16

I've really grown to dislike the "China == bad" thing, yes, they're domestically authoritarian, without excusing any of it, I like to act on hard evidence, not hear say, I am stunned that after the Bloomberg fiasco these kind of stories didn't take a hit. P.S. Personally, I don't consider the NSA having my data as being any better, thank you. EDIT: Just to be clear, I don't think Zoom's encryption claims should be tr…

If encryption keys are stored in a country where the company is required, by law or by force, to turn them over to authorities upon request then that should be noted. And yes that includes the US to a lesser degree. When people say 'the server with the encryption keys is physically located in China, and they have many Chinese employees', the subtext that we should all know at this point is that they're required by Ch…

[deleted]

Re: Zoom’s encryption has links to China, researchers discover

#56

Post by fangorn »

_-___________-_ wrote: post #9

Maybe I've been sensitised by all the security flaws, privacy leaks and outright lies on Zoom's part, but I'm starting to really notice how much a lot of public figures are pushing Zoom. Does anyone else find it really weird? Late-night TV hosts, I can understand - maybe they just get paid for it, or have Zoom shares. But for example UK government leaders repeatedly mentioning it by name, e.g. Matt Hancock saying tha…

There's a history[0] of UK gov pushing through Chinese tech, despite security concerns. Why stop now...

[0] https://www.bbc.com/news/uk-politics-51806704

Re: Zoom’s encryption has links to China, researchers discover

#58

Post by petergatsby »

AsyncAwait wrote: post #16

I've really grown to dislike the "China == bad" thing, yes, they're domestically authoritarian, without excusing any of it, I like to act on hard evidence, not hear say, I am stunned that after the Bloomberg fiasco these kind of stories didn't take a hit. P.S. Personally, I don't consider the NSA having my data as being any better, thank you. EDIT: Just to be clear, I don't think Zoom's encryption claims should be tr…

I've really grown to dislike the "people who presumably consider themselves ethical defending a regime that represses free speech and expression, brutally crushes dissenters, disappears ethical doctors, is led by a 'president for life' dictator, and has literally hauled off 1M muslims to internment campus where their organs are being harvested and their culture is being erased, thing".

Re: Zoom’s encryption has links to China, researchers discover

#59

Post by knolax »

fangorn wrote: post #56
_-___________-_ wrote: post #9

Maybe I've been sensitised by all the security flaws, privacy leaks and outright lies on Zoom's part, but I'm starting to really notice how much a lot of public figures are pushing Zoom. Does anyone else find it really weird? Late-night TV hosts, I can understand - maybe they just get paid for it, or have Zoom shares. But for example UK government leaders repeatedly mentioning it by name, e.g. Matt Hancock saying tha…

There's a history[0] of UK gov pushing through Chinese tech, despite security concerns. Why stop now... [0] https://www.bbc.com/news/uk-politics-51806704

Software by an American Company[0] founded by a man who's been here since the 90s[1] is now "Chinese Tech"? Is everything from Paul Graham "British Tech"? Are Apple Products now "Chinese Tech" because of their keyservers in China[2]?

[0] https://en.m.wikipedia.org/wiki/Zoom_Video_Communications

[1] https://en.m.wikipedia.org/wiki/Eric_Yuan

[2] https://www.reuters.com/article/us-china-apple-icloud-insigh...

Re: Zoom’s encryption has links to China, researchers discover

#60

Post by katzenjam »

Diggsey wrote: post #48
hiq wrote: post #33

Earlier quoted context omitted.

Is there a way to use ECB "correctly"? Is there any non-repeating data apart from noise (if even)?

Yes, as I mentioned, if you include an incrementing counter within each block then the data does not repeat. The data only needs to be non-repeating within a single stream. Different streams will use a different IV and possibly different keys. This is how CTR works.

Including a counter in each UDP packet does not make ECB mode equivalent to CTR mode.

Let's assume the counter is at the start of the packet. An AES block is 16 bytes, so the counter ensures the first 16 bytes of ciphertext are unique across packets. But any patterns in the remainder of the packet are preserved, within and across packets.

Post reply on HN