Live data from Hacker News

Zoom’s encryption has links to China, researchers discover

theintercept.com

61–70 of 137 posts

Re: Zoom’s encryption has links to China, researchers discover

#61
post #42

OT: My kids school uses zoom atm. Been connecting using the web client at https://zoom.us/wc/join/ without dashes>. Today however those links are returning 403 Forbidden (even tried multi) My knee-jerk reaction was that they have some way of capitalizing on installed software which they can't on the web-client. But of course it could simply be that the web-client requires more server resources and now have to curb it…

There is a maintenance issue up: https://status.zoom.us/incidents/16ll08mmddk6

I know, but my knee still jerked

Re: Zoom’s encryption has links to China, researchers discover

#62

I've really grown to dislike the "China == bad" thing, yes, they're domestically authoritarian, without excusing any of it, I like to act on hard evidence, not hear say, I am stunned that after the Bloomberg fiasco these kind of stories didn't take a hit. P.S. Personally, I don't consider the NSA having my data as being any better, thank you. EDIT: Just to be clear, I don't think Zoom's encryption claims should be tr…

I've really grown to dislike the "people who presumably consider themselves ethical defending a regime that represses free speech and expression, brutally crushes dissenters, disappears ethical doctors, is led by a 'president for life' dictator, and has literally hauled off 1M muslims to internment campus where their organs are being harvested and their culture is being erased, thing".

"has literally hauled off 1M muslims to internment campus where their organs are being harvested and their culture is being erased, thing"

Citation needed on the '1M', 'organs...harvested', 'culture...erased'.

Re: Zoom’s encryption has links to China, researchers discover

#63
post #3

The story here is that Zoom uses key distribution servers located in China (in addition to several servers in the USA) and that Chinese law might be compelling Zoom to disclose the encryption keys. I think it is a valid concern, but for me it also raises the question of whether this may also be required in the US. In addition to letting the Chinese (and possibly US) government in on the encryption keys, the encryptio…

Who the hell still uses ECB?

Re: Zoom’s encryption has links to China, researchers discover

#65
post #3

The story here is that Zoom uses key distribution servers located in China (in addition to several servers in the USA) and that Chinese law might be compelling Zoom to disclose the encryption keys. I think it is a valid concern, but for me it also raises the question of whether this may also be required in the US. In addition to letting the Chinese (and possibly US) government in on the encryption keys, the encryptio…

Who the hell still uses ECB?

That is truly amazing. I know precious little about encryption, but I assumed everyone knows that ECB is bad and that CBC is the only sensible way to do AES.

[edited for typo]

Re: Zoom’s encryption has links to China, researchers discover

#67
post #43

I'd recommend reading the original Citizen Lab article as well, which discusses the flaws more specifically. This Intercept article is good, but seems to be aimed at more of a general, less-technical audience. https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto... At the very least, they are validating TLS certificates. (Which I know is the true bare minimum requirement of TLS, but "goto fail" and all...) >W…

The CL article seems to be underplaying the vulnerability of ECB, with the "not recommended" description. Any cryptographer will tell you it's downright trivially broken, with textbook practical attacks taught to undergrads.

Is ECB any worse than any other deterministic encryption?

Deterministic encryption can be ok if the data that you’re encrypting is already really random (high min-entropy). Compressed audio and video streams have a decent amount of entropy. Probably not enough to satisfy a cryptographer, but it’s probably enough to make it very difficult to learn much from 128-bit AES ECB blocks.

Note that everyone’s favorite ECB example with the picture of Tux the Linux penguin is not very realistic, because the plaintext is not compressed. If you ECB a JPEG or a PNG, you won’t see the same patterns.

I teach the attacks on ECB in my network security class. It’s bad, but AES is not the Caesar cipher. I’m not sure “trivially broken” is quite right.

That said, I am really curious what Zoom is actually doing here. Going to have to take a look today. My guess is that the real fail from using ECB mode is more likely to come from using it on audio/video metadata, or on other more structured parts of the protocol.

Re: Zoom’s encryption has links to China, researchers discover

#68
post #3

The story here is that Zoom uses key distribution servers located in China (in addition to several servers in the USA) and that Chinese law might be compelling Zoom to disclose the encryption keys. I think it is a valid concern, but for me it also raises the question of whether this may also be required in the US. In addition to letting the Chinese (and possibly US) government in on the encryption keys, the encryptio…

Who the hell still uses ECB?

Hint: copy-pasters*

* from internet or from old codebases of one’s company

Re: Zoom’s encryption has links to China, researchers discover

#69
OK, this makes things clearer. Zoom does in fact encrypt their streams from client to client but they have easy access to the keys.

In their recent post about this question they apologize for what they admit to be an incorrect use of the phrase "end to end encryption". They base this on the existence of things like the gateways used to the regular telephone network.

It seems like an odd way to spin this. Why didn't they just state that the data is encrypted "end to end" and then leave it at that? Apple supposedly has access to the keys used to encrypt FaceTime calls but they happily involve the "end to end encryption" marketing phrase. I don't see why Zoom couldn't do the same. The way Zoom has handled this could of been a lot better.

I think the world needs a consumer standard for cryptography. Something like:

* Level 1 for the case where any eavesdropper can get the plain text.

* Level 2 for when just the provider can get the plain text.

* Level 3 for when just the users can get the plain text.

Most of what is being described as "end to end encrypted" these days is really just level 2 even in the case where the provider does not have the keys due to the fact that the provider can trivially MITM the traffic. The general public should be made aware of the distinction without having to dig into the technical details.

Re: Zoom’s encryption has links to China, researchers discover

#70
post #43

I'd recommend reading the original Citizen Lab article as well, which discusses the flaws more specifically. This Intercept article is good, but seems to be aimed at more of a general, less-technical audience. https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto... At the very least, they are validating TLS certificates. (Which I know is the true bare minimum requirement of TLS, but "goto fail" and all...) >W…

The CL article seems to be underplaying the vulnerability of ECB, with the "not recommended" description. Any cryptographer will tell you it's downright trivially broken, with textbook practical attacks taught to undergrads.

If you scroll down, they go into more detail, with the classic Linux penguin example.
Post reply on HN