Zoom’s encryption has links to China, researchers discover
theintercept.com
Zoom’s encryption has links to China, researchers discover
1–10 of 137 posts
Re: Zoom’s encryption has links to China, researchers discover
#2Original title: Zoom's Encryption is “Not Suited for Secrets” and Has Surprising Links to China
Re: Zoom’s encryption has links to China, researchers discover
#3The story here is that Zoom uses key distribution servers located in China (in addition to several servers in the USA) and that Chinese law might be compelling Zoom to disclose the encryption keys. I think it is a valid concern, but for me it also raises the question of whether this may also be required in the US.
In addition to letting the Chinese (and possibly US) government in on the encryption keys, the encryption scheme is also badly broken (ECB mode of AES). Prof. Matthew Green has written many articles about AES and encryption more generally and I recommend his blog if you are interested (even as a lay person).
https://blog.cryptographyengineering.com/2011/12/01/how-not-...
Re: Zoom’s encryption has links to China, researchers discover
#4Keyservers in China may be a risk, but this sounds like a terrible idea: "The researchers also found that Zoom protects video and audio content using a home-grown encryption scheme"
Re: Zoom’s encryption has links to China, researchers discover
#5And another case of lying in marketing: "A security white paper from the company claims that Zoom meetings are protected using 256-bit AES keys, but the Citizen Lab researchers confirmed the keys in use are actually only 128-bit."
How do they keep doing this? Do they just put whatever sells best in the documents and implement something else? First the end2end thing, now 128 instead of 256 bits. How many more are we going to find in the coming days?
Re: Zoom’s encryption has links to China, researchers discover
#6"home grown encryption scheme" seems to imply Zoom is rolling its own crypto, which is tremendously foolish.
That isn't exactly the case, per the same article. More Zoom is choosing a poor choice among other choices, of implementing AES:
"Furthermore, Zoom encrypts and decrypts with AES using an algorithm called Electronic Codebook (ECB) mode, “which is well-understood to be a bad idea, because this mode of encryption preserves patterns in the input,” according to the Citizen Lab researchers. In fact, ECB is considered the worst of AES’s available modes."
Bad idea but not "rolling own crypto bad"
edit: agree it's bad. this is pointing out inaccuracies in language from tech journalism reporting on security. This continues to be an issue per the miseducation it creates for the general public in infosec concepts, which is already an uphill battle of misconceptions. Since these articles, or AG Barr, are the discussions that actually hit the mainstream, it's an issue that needs to correct.ed Tech journalism, a profession focused on 'getting the facts,' are the direct conduit of this version of miseducation/failure of facts, and should be corrected. See: NY Times Baltimore Ransomware = NSA Tool (false), Bloomberg Supermicro (false, so far), etc.
Re: Zoom’s encryption has links to China, researchers discover
#7"home grown encryption scheme" seems to imply Zoom is rolling its own crypto, which is tremendously foolish. That isn't exactly the case, per the same article. More Zoom is choosing a poor choice among other choices, of implementing AES: "Furthermore, Zoom encrypts and decrypts with AES using an algorithm called Electronic Codebook (ECB) mode, “which is well-understood to be a bad idea, because this mode of encryptio…
Even Wikipedia is stating ECB is a very bad choice. How can someone really use it nowadays without fraudulent intentions?
Re: Zoom’s encryption has links to China, researchers discover
#8"home grown encryption scheme" seems to imply Zoom is rolling its own crypto, which is tremendously foolish. That isn't exactly the case, per the same article. More Zoom is choosing a poor choice among other choices, of implementing AES: "Furthermore, Zoom encrypts and decrypts with AES using an algorithm called Electronic Codebook (ECB) mode, “which is well-understood to be a bad idea, because this mode of encryptio…
> Bad idea but not "rolling own crypto bad"
- misusing cryptographic primitives is one way of rolling one’s own crypto
- ECB really is that bad
Re: Zoom’s encryption has links to China, researchers discover
#9Maybe I've been sensitised by all the security flaws, privacy leaks and outright lies on Zoom's part, but I'm starting to really notice how much a lot of public figures are pushing Zoom.
Does anyone else find it really weird? Late-night TV hosts, I can understand - maybe they just get paid for it, or have Zoom shares. But for example UK government leaders repeatedly mentioning it by name, e.g. Matt Hancock saying that despite being unwell, Boris Johnson is still having "Zoom videoconferences", or saying Johnson addressed his "Zoom cabinet", just feels... weird.
Edited to add: thinking about it more, I remember "FaceTime" being used pretty similarly when it was new. So I guess all the bad news is just sensitising me.
Re: Zoom’s encryption has links to China, researchers discover
#10"home grown encryption scheme" seems to imply Zoom is rolling its own crypto, which is tremendously foolish. That isn't exactly the case, per the same article. More Zoom is choosing a poor choice among other choices, of implementing AES: "Furthermore, Zoom encrypts and decrypts with AES using an algorithm called Electronic Codebook (ECB) mode, “which is well-understood to be a bad idea, because this mode of encryptio…
Using ECB for this is terrible. It's likely that you could quite trivially recover low-fidelity video from the encrypted stream.