Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom’s encryption has links to China, researchers discover

theintercept.com

Post reply on HN
Print view View original

71–80 of 137 posts

Re: Zoom’s encryption has links to China, researchers discover

#71

Post by prophesi »

auiya wrote: post #46
fulafel wrote: post #43

Earlier quoted context omitted.

The CL article seems to be underplaying the vulnerability of ECB, with the "not recommended" description. Any cryptographer will tell you it's downright trivially broken, with textbook practical attacks taught to undergrads.

An explanation w/ visuals for how/why ECB is a broken mode of operation for cryptography - https://www.crypteron.com/blog/practical-searchable-encrypti...

The exact same explanation + visual are already in The Intercept's article (and CitizenLab's). The rest of it is flaunting Crypteron's searchable encryption.

Re: Zoom’s encryption has links to China, researchers discover

#72

Post by jaywalk »

knolax wrote: post #59
fangorn wrote: post #56

Earlier quoted context omitted.

There's a history[0] of UK gov pushing through Chinese tech, despite security concerns. Why stop now... [0] https://www.bbc.com/news/uk-politics-51806704

Software by an American Company[0] founded by a man who's been here since the 90s[1] is now "Chinese Tech"? Is everything from Paul Graham "British Tech"? Are Apple Products now "Chinese Tech" because of their keyservers in China[2]? [0] https://en.m.wikipedia.org/wiki/Zoom_Video_Communications [1] https://en.m.wikipedia.org/wiki/Eric_Yuan [2] https://www.reuters.com/article/us-china-apple-icloud-insigh...

Zoom also has over 700 employees in China.

Re: Zoom’s encryption has links to China, researchers discover

#73

Post by tiborsaas »

turowicz wrote: post #66

I always knew that the "zoom.us" is a dodgy name for an installation file. As if someone was going an extra length to make sure you think its a US company.

It is a US company and the founder is american too.

https://www.bloomberg.com/profile/company/ZM:US

Re: Zoom’s encryption has links to China, researchers discover

#74

Post by lawnchair_larry »

floathub wrote: post #65
ComputerGuru wrote: post #63

Earlier quoted context omitted.

Who the hell still uses ECB?

That is truly amazing. I know precious little about encryption, but I assumed everyone knows that ECB is bad and that CBC is the only sensible way to do AES. [edited for typo]

Your first point is correct, second is definitely not.

Re: Zoom’s encryption has links to China, researchers discover

#75

Post by xtian »

upofadown wrote: post #69

OK, this makes things clearer. Zoom does in fact encrypt their streams from client to client but they have easy access to the keys. In their recent post about this question they apologize for what they admit to be an incorrect use of the phrase "end to end encryption". They base this on the existence of things like the gateways used to the regular telephone network. It seems like an odd way to spin this. Why didn't t…

Apple does not have access to FaceTime keys or iMessage keys for that matter. They are truly end-to-end encrypted, and I don’t think there is any need to cheapen or muddy the term for the sake of marketers.

Re: Zoom’s encryption has links to China, researchers discover

#76

Post by jplayer01 »

tiborsaas wrote: post #73
turowicz wrote: post #66

I always knew that the "zoom.us" is a dodgy name for an installation file. As if someone was going an extra length to make sure you think its a US company.

It is a US company and the founder is american too. https://www.bloomberg.com/profile/company/ZM:US

Aren’t most of their developers in China?

Re: Zoom’s encryption has links to China, researchers discover

#77

Post by prophesi »

cvwright wrote: post #67
fulafel wrote: post #43

Earlier quoted context omitted.

The CL article seems to be underplaying the vulnerability of ECB, with the "not recommended" description. Any cryptographer will tell you it's downright trivially broken, with textbook practical attacks taught to undergrads.

Is ECB any worse than any other deterministic encryption? Deterministic encryption can be ok if the data that you’re encrypting is already really random (high min-entropy). Compressed audio and video streams have a decent amount of entropy. Probably not enough to satisfy a cryptographer, but it’s probably enough to make it very difficult to learn much from 128-bit AES ECB blocks. Note that everyone’s favorite ECB exa…

> Is ECB any worse than any other deterministic encryption?

Yes, it's objectively worse than literally any other AES mode. You wouldn't need to depend on compression to protect your data.

Re: Zoom’s encryption has links to China, researchers discover

#78

Post by knolax »

jaywalk wrote: post #72
knolax wrote: post #59

Earlier quoted context omitted.

Software by an American Company[0] founded by a man who's been here since the 90s[1] is now "Chinese Tech"? Is everything from Paul Graham "British Tech"? Are Apple Products now "Chinese Tech" because of their keyservers in China[2]? [0] https://en.m.wikipedia.org/wiki/Zoom_Video_Communications [1] https://en.m.wikipedia.org/wiki/Eric_Yuan [2] https://www.reuters.com/article/us-china-apple-icloud-insigh...

Zoom also has over 700 employees in China.

So does Apple.

Re: Zoom’s encryption has links to China, researchers discover

#79

Post by lawnchair_larry »

cvwright wrote: post #67
fulafel wrote: post #43

Earlier quoted context omitted.

The CL article seems to be underplaying the vulnerability of ECB, with the "not recommended" description. Any cryptographer will tell you it's downright trivially broken, with textbook practical attacks taught to undergrads.

Is ECB any worse than any other deterministic encryption? Deterministic encryption can be ok if the data that you’re encrypting is already really random (high min-entropy). Compressed audio and video streams have a decent amount of entropy. Probably not enough to satisfy a cryptographer, but it’s probably enough to make it very difficult to learn much from 128-bit AES ECB blocks. Note that everyone’s favorite ECB exa…

This is dangerously wrong. ECB is a non-starter no matter the entropy of the plaintext. Trivially broken is accurate. I hope you are not teaching students that it is ever ok.
Post reply on HN