16 ms·

Using Zoom? Here are the privacy issues you need to be aware of

393 points by teekert 7y ago

greatjack613 7y ago
Honestly the points are valid but the solutions stated suck. Use a new version of zoom?????? Seriously, I mean well duh. Use a different device to check email?? Very disappointed with the conclusion, I was expecting some way to go into settings and disable all of the tracking garbage.
xnyhps 7y ago
The macOS version installs itself before you give it permission to install: https://twitter.com/xnyhps/status/1149630190877696001?s=21 https://twitter.com/xnyhps/status/1149630190877696001?s=21. It is basically malware.
- ilikepi 7y ago
  Very interesting. I don't have any experience making .pkg installers nor with verifying code signing on macOS, but I agree in general, the `preinstall` script does a lot of work one would expect the installer itself to do. This is all supporting evidence for my personal preference to never run the Zoom installer, but rather to extract the application bundle by hand.[1] Please consider writing up your findings in more detail. [1]: https://news.ycombinator.com/item?id=20391828 https://news.ycombinator.com/item?id=20391828
teekert 7y ago
I like Jitsi, it works well in my personal setting (kids talk for hours with the grand parents)... Other tips?
- fendy3002 7y ago
  I also like jitsi however haven't had any chance to seriously use it. I wonder if there is any major drawback for jitsi
  - STRML 7y ago
    Jitsi's P2P nature is great for 1:1 or small group conversations if everyone has solid connections. From experience it starts to break down with larger groups, and becomes pretty useless overall if one or two participants have spotty connections.
    - lima 7y ago
      Jitsi is not P2P for group conversations - all streams are multiplexed by the server (the videobridge). 100% agreed about spotty connections, it does not handle them very well. As long as everyone has a decent connection and enough CPU, it handles groups of 10+ participants just fine. My company ended up switching to Google Meet for reliability reasons, but was a year ago so it might be better now.
  - snthd 7y ago
    firefox support isn't all the way there yet. https://github.com/jitsi/jitsi-meet/issues/4758 https://github.com/jitsi/jitsi-meet/issues/4758
    - teekert 7y ago
      Yeah, it's a shame, had to install the Chromium snap only for this (Ubuntu 19.10). But then it did work very well (don't forget to enable the "record and play sound" permission for the snap.)
  - lambertsimnel 7y ago
    Does Jitsi have the option for admins to mute or expel guests?
    - s_gourichon 7y ago
      Yes, admins can mute and kick. And if you allow anonymous channel creation, the first to enter a channel automatically has admin right. I don't know if kicked participants (especially unauthenticated) can re-join at once, after a delay or any other rule.
- jboynyc 7y ago
  Another thing that's great about Jitsi is how easy it is to self-host it. If you are using a system with the apt package manager (such Debian or Ubuntu), you basically only have to run two commands: https://github.com/jitsi/jitsi-meet/blob/master/doc/quick-install.md https://github.com/jitsi/jitsi-meet/blob/master/doc/quick-in...
  - s_gourichon 7y ago
    Well, it is indeed easy to self-host it if you happen to already have a https-reachable server running Debian on a common CPU instruction set. Which I had, yet for maintenance reasons a container-based solution had my preference: https://github.com/jitsi/docker-jitsi-meet https://github.com/jitsi/docker-jitsi-meet
JensRex 7y ago
>"Do not use Facebook to sign in" Aside from being good advice generally, I doubt anyone who's concerned about the violation of privacy Zoom engages in, would have a Facebook account.
- wyattpeak 7y ago
  I'm concerned about all violations of privacy relevant to me, and yet I have a Facebook account. Wanting to be informed about privacy concerns is a world apart from being so single-mindedly concerned that you'll refuse to engage with a company who's bad in that regard, whatever the cost.
- codetrotter 7y ago
  Your doubts might need to be re-examined. I have a Facebook account that I originally registered when I was in high school a little over a decade ago. The reason I've kept it is because I use Facebook Messenger to talk to some people, and because a lot of events use Facebook. The main Facebook app I have not installed, because I don't need it. The Facebook Messenger app I have installed because I use it. I trust iOS to limit this app from being able to do anything too nasty. I never use "log in with Facebook". I clear my cookies regularly, and I often use a different browser for logging into Facebook from the browser I use for most stuff. I try my hardest to be vigilant of my privacy, even though it is a losing battle. The fact that someone has a Facebook account should not be taken as a sign that they think that any of the privacy violation stuff that businesses engage in is ok. As for Zoom, I made a conscious decision to not install the Zoom software on my MacBook Air because of the previous shenanigans that Zoom had been engaging in. When a client expressed desire that we use Zoom for our meetings, I therefore chose to install the Zoom app on iOS rather than on my MacBook Air, because iOS limits apps from being able to do anything too bad, and after we were done with the job I uninstalled the Zoom app from iOS as well.
  - catacombs 7y ago
    > The reason I've kept it is because I use Facebook Messenger to talk to some people, and because a lot of events use Facebook. Nowadays, "some" people isn't worth Facebook harvesting your data. If you really want to keep in touch with those people, you can find a way.
TeluguFilms 7y ago
Yes It works..
donatj 7y ago
It collects "information you upload, provide, or create while using the service" … I mean it kind of has to does it not? That's how it can give it to other people.
- inetknght 7y ago
  Have you heard of encryption?
  - dyeje 7y ago
    Zoom supports encryption: https://support.zoom.us/hc/en-us/articles/201362723-Encryption-for-Meetings https://support.zoom.us/hc/en-us/articles/201362723-Encrypti...
  - h4waii 7y ago
    What exactly does "encryption" solve about this? It could be encrypted from client to server and the main concerns over privacy would still stand. What exactly are you suggesting by randomly throwing out the word "encryption"?
    - inetknght 7y ago
      Encrypt data prior to entering Zoom's services. That shouldn't affect Zoom's ability to deliver your (now-encrypted) data to your peers. It would affect Zoom's ability to usefully "collect" that data for other purposes though.
      - willis936 7y ago
        How are the keys exchanged? At the end of the day zoom holds the keys. What matters, legally, is their privacy policy. If you don’t trust that then you have no business using a program that brokers encryption keys.
        tialaramex 7y ago
        No, key agreement protocols were invented in the 20th century. Two parties can agree a shared secret (such as a key) without an intermediary discovering this secret even though the intermediary knows everything both parties said. We have no mathematical proof that such protocols can exist (they need a trapdoor function and there is no mathematical proof that trapdoor functions are possible), but nevertheless they seem to work fine. Now, working KEx does leave you still not certain who the other party is, you're now communicating securely with someone but you aren't sure who. That's why the Web PKI exists. But choosing to have Zoom hold all the keys is a choice and not as you've portrayed it a necessity, the system could be designed to work just fine without doing that.
matsemann 7y ago
So not even close to what was touted yesterday. And do we really need yet another thread on this? Is there some kind of astroturfing going on or why is this Zoom-hate everywhere lately? https://news.ycombinator.com/item?id=22657384 https://news.ycombinator.com/item?id=22657384
- nkozyra 7y ago
  > why is this Zoom-stuff everywhere lately Um, really? It's probably the #1 conferencing app being introduced to a world of people not used to remote work. A lot of people are encountering it for the first time.
  - hoseja 7y ago
    How is it #1 though? It seems to have come out of nowhere.
    - NortySpock 7y ago
      Zoom IPO'd on April 18, 2019, and was winning market share in the Enterprise video conference space at least a year or two before that. They had a much more reliable product with common-sense features like calling-in via phone line to connect to your meeting, as well as a turn-key solution to rigging a room for video-conferencing. As far as I know other competitors would be Skype (Microsoft) and WebEx, neither of which seemed nearly as polished.
      - wool_gather 7y ago
        I have experience with both Zoom and WebEx. Zoom (on Mac) has a lot of what I consider to be "bad behaviors" UI-wise, especially around window management. And it's ugly in the way mobile apps that get ported to the desktop are. But it gets the job done, and WebEx is definitely worse in these and other ways. So... /me shrugs
    - ajayyy 7y ago
      It was big before too
donohoe 7y ago
This is a very underwhelming article. It talks about an old bug and then some basic features you should be aware of... Shouldn't be on HN front-page. I think this article from EFF is clearer and more comprehensive in general: https://www.eff.org/deeplinks/2020/03/what-you-should-know-about-online-tools-during-covid-19-crisis https://www.eff.org/deeplinks/2020/03/what-you-should-know-a...
- thephyber 7y ago
  This doesn’t seem like an evidence point to shrug off: > It talks about an old bug Previous behavior is highly predictive of future behavior. The point about the web server was not just that is was improperly secured, but that it was done to bypass a user facing pop up in Safari. This kind of decision tells the reader something about company culture.
  - bwb 7y ago
    They admitted they made a mistake and fixed it. The software itself works better than anything else on the market. What else do you need from them? :) I understand being wary, that never hurts, but the company is doing good things and apologized and fixed it.
    - chrisfinazzo 7y ago
      I vaguely remember Zoom back when the story about their clandestine web server came to light, but quickly forgot about it when they patched the bug. Now that it's back in the news as one of the only companies who might financially benefit from COVID-19 (their stock is up significantly, last I checked), they seem to be everywhere. I've seen some large news orgs using WebEx, but that's probably not new for them as they need something that's really enterprise-grade and won't go down on a whim. To that end, why has Zoom caught on so much this time around? iOS has FaceTime and Android - at least Google variants - have Hangouts. They're system apps, and everybody already has credentials sorted out. Does anyone know Zoom's relative marketshare before this hit?
      - 7y ago
virgilp 7y ago
> has already had a major security vulnerability. Oh no!! Unlike any other technology on earth that is actually used by non-trivial amounts of people? > “Does Zoom sell Personal Data?” the policy says, “Depends what you mean by ‘sell.’” That makes it sound like something malefic is happening. What privacy policy says is that they use Google tools (e.g. Google analytics, also used for delivering ads), and they put your data in Google analytics. This is however _their data_, while indeed "shared with Google" it doesn't mean Google is using it in any way, other than aggregate ("Across all our customers, <blah blah blah>") and even that, most likely only for internal statistics. I for one definitely don't see that as "selling data", I'd agree with Zoom here.
- dpwm 7y ago
  The article gave me the impression that the privacy policy literally said "depends what you mean by 'sell'." I didn't find that. I did find: > We do not allow marketing companies, advertisers, or anyone else to access Personal Data in exchange for payment. Except as described above, we do not allow any third parties access to any Personal Data we collect in the course of providing services to users. We do not allow third parties to use any Personal Data obtained from us for their own purposes, unless it is with your consent (e.g. when you download an app from the Marketplace). So in our humble opinion, we don’t think most of our users would see us as selling their information, as that practice is commonly understood. It seems a bit more nuanced than the article would suggest.
philshem 7y ago
Zoom's dark pattern is to obscure that every online meeting can be joined from the browser. They really hide this in order to install software on the client machine, which has been susceptible to bugs in the past. https://support.zoom.us/hc/en-us/articles/214629443 https://support.zoom.us/hc/en-us/articles/214629443 I've had no problems from the browser, although I think on some platforms they suggest (or require?) Chrome over Firefox.
- ilikepi 7y ago
  The Join by Browser feature was also discussed a bit in the other thread: https://news.ycombinator.com/item?id=22657949 https://news.ycombinator.com/item?id=22657949
- manigandham 7y ago
  Most people prefer the desktop software for better UX.
  - treve 7y ago
    Do you have data? Or is this anecdotal?
  - philshem 7y ago
    I had installed the Zoom client on my PC as a local non-admin user, and then had to go to IT to get an admin to uninstall it. Zoom is not alone in doing this. (Or maybe it's a Windows "feature"?)
    - judge2020 7y ago
      Your IT might have set up a group policy object that disables uninstalling software (https://www.windowscentral.com/how-prevent-accidental-uninstall-apps-start-menu-windows-10 https://www.windowscentral.com/how-prevent-accidental-uninst...)
      - philshem 7y ago
internalfx 7y ago
Or just use whereby.com No plugin needed.
ilikepi 7y ago
Regarding the "attention tracking" feature... If your boss/manager/etc is excited about this feature as a way to monitor you, odds are they already have you under surveillance in a bunch of other ways. It's unfortunate that you are in this situation, and I hope you're able to find a way out of it soon (e.g. by switching teams or finding another company that values and trusts you more). This feature is of limited use, though. With my laptop in my lap, it's trivial to hold my phone right in front of the lower half of my screen. It will be outside the field of view of the camera, but there will be no discernible difference between me looking at my laptop screen vs my phone screen. I'm all for fighting against companies chipping away at our privacy, but this one seems pretty far down a rather large list. EDIT: clarification
- AznHisoka 7y ago
  Isn't it also useless if you got multiple monitors? I connect my Macbook to my external monitors, and move the Zoom screen to my monitor instead of my laptop. Thus, I am never directly looking at my laptop screen. Any employer tracking me will always think I am never ever looking at my Zoom screen.
  - bt1a 7y ago
    Correct, if you have Zoom on a secondary monitor and are working on your primary monitor, it will say that you are not paying attention. Thankfully our meeting organizer was quick to understand that most of us work with multiple monitors and decided not to pay the feature much attention.
- catacombs 7y ago
  > If your boss/manager/etc is excited about this feature as a way to monitor you, odds are they already have you under surveillance in a bunch of other ways. It's unfortunate that you are in this situation, and I hope you're able to find a way out of it soon (e.g. by switching teams or finding another company that values and trusts you more). I can't stand people who get excited at the thought of tracking their employees. What's the benefit? Control? Ego?
jscholes 7y ago
Anecdote: much of the software competing with Zoom has really bad accessibility for disabled users, incl. those using a screen reader, screen magnifier, keyboard-only/switch control, speech recognition, etc. This is despite the fact that some of it has been around for 10+ years, or is backed by large companies like Google. I bring this up because that can also cause privacy issues. There are the direct concerns, like not being able to access the text of their policies or accessibly manage your preferences. But the less obvious factor is inaccessible controls to: - verify whether or not you're streaming video; - determine whether your microphone is muted or not; - ... etc. If I don't know what I'm streaming and exposing to meeting participants, I'm losing on the privacy front. So Zoom it will have to be for now, I'm afraid. If you think it has too many issues for you to be a viable product, and have the option of making an alternative more inclusive, I'm open to chat.
- judge2020 7y ago
  > much of the software competing with Zoom has really bad accessibility for disabled users, Does that mean Zoom does in fact perform the necessary legwork on the accessibility front?
  - jscholes 7y ago
    > Does that mean Zoom does in fact perform the necessary legwork on the accessibility front? Pretty much. They're not perfect, but they have put a ton of effort into it. It may be because they do business with governments, so require things like Voluntary Product Accessibility Templates (VPATs)[1]. But it is the only platform I can actively consider using for work, as someone who relies on a screen reader. [1] https://zoom.us/accessibility https://zoom.us/accessibility
hnrodey 7y ago
Any know if Teams has any dark patterns such as this? I haven't heard of anything.
montroser 7y ago
There's no reason why video conferencing should require an installed app in 2020. Standard browser tech in WebRTC is completely sufficient, and well supported at this point. There's even the Picture-in-Picture spec coming into place, which should allow more seamless desktop integration: https://w3c.github.io/picture-in-picture/ https://w3c.github.io/picture-in-picture/ Fully browser-based alternatives to zoom: https://hangouts.google.com https://hangouts.google.com https://whereby.com https://whereby.com https://team.video https://team.video
- zajio1am 7y ago
  > There's no reason why video conferencing should require an installed app in 2020. Much better efficiency and ergonomics? Freedom to choose independent client implementations interoperable by standardized protocols (e.g. SIP)? Independence of client provider and service provider? Interoperability between different providers (i.e. different users can use different service providers)?
  - montroser 7y ago
    If the first two points are supremely important to you, and if you have enough resources, then yes, it's possible you may find more flexibility in an app. On independence and interoperability though, doesn't an open WebRTC stack spec'd by an independent standards body give us our best hope there?
- teekert 7y ago
  Don't forget privacy oriented https://meet.jitsi.net/ https://meet.jitsi.net/
- galad87 7y ago
  It wouldn't be an issue if the app was sandboxed. And I see no reason for a video conferencing to not be sandboxed or to implement similar privilege restrictions.
- logie17 7y ago
  Whereby has come a long way, and I recently started using team.video as well. I like both because I can just send a link and have a meeting instantly.
cdnuzzo 7y ago
Jitsi.org
rdiddly 7y ago
If you have to track people to make sure they pay attention during the meeting, the meeting is pointless and too long. Meetings that are short and packed with useful info nobody wants to miss, are well-attended. Managers, try being a real leader. Or is that too hard?
kryogen1c 7y ago
curious amount of negativity in here. what exactly is the concern? zoom is a corporate product. your electronic business activities are probably governed by lawyer-approved documents you signed like an AUP/NDA/consent to be monitored, so why are you concerned about privacy? dont want attention tracking? thats a feature, not a "privacy" bug (you expect personal privacy and freedom during business meetings?). bosses love this kind of metric, and not without reason. maybe if your meeting "attention" rate is low, theres an issue a boss could solve to make the business and employee's lives better. also you can just turn your camera off in zoom. > According to the company’s privacy policy, Zoom collects reams of data on you, including your name, physical address, email address, phone number, job title, employer. this is nonsense. how would installing zoom, as a meeting participant or host, collect your phone number and physical address? im sure their privacy policy says this, but that is very different than the zoom client actively scavenging computers for personal information. THAT would be a story >it will collect and keep data on what type of device you are using, and your IP address so... like almost every single piece of the internet? most personal IP addresses rotate, and who cares about your corporate ip? this has to be the lowest value and most common data point there is. not great, but not alarming. >Do not use Facebook to sign in hard to see a legitimate use-case for this. the corporate account features of zoom means everyone gets an account with their corporate email address, so why did they ever integrate with facebook? seems likely about scavenging data, but maybe theyre just trying to be trendy. all in all, seems like a hit-piece. hit-pieces arent necessarily wrong, but they are always agenda-based. maybe the agenda is something i agree with, but i dont know richie koch or what protonmail's stake in the game is in order to take this at face value without any actual details and sources.
- decebalus1 7y ago
  > your electronic business activities are probably governed by lawyer-approved documents you signed like an AUP/NDA/consent to be monitored, so why are you concerned about privacy? I did online interviews through Zoom. I did not sign any NDA and was not presented with a privacy policy from the companies using Zoom about the data they collected during the interview.
Ayoub12 7y ago
Top 10 Debunked Myths About Laundry https://culturelworld.blogspot.com/2020/03/top-10-debunked-myths-about-laundry.html https://culturelworld.blogspot.com/2020/03/top-10-debunked-m...
graton 7y ago
The woman in this video has issues with privacy in her Zoom conference call: https://www.youtube.com/watch?v=0xqLjc2y6O4 https://www.youtube.com/watch?v=0xqLjc2y6O4 Okay not the same issue this article is talking about, but do pay attention to if your camera is on and where it is pointing :)
Igelau 7y ago
Let's all pledge to keep a little notepad window open that we click into during Zoom meetings. Pollute attention tracking with false positives. Bonus points if you stare directly into the camera while you do this.
ravenstine 7y ago
Don't forget that Zoom used to have a web server installed in the background that Apple had to send out a patch to disable. I wouldn't ever trust running Zoom for that reason alone. I'm forced to run it at work, but never at home.
chvid 7y ago
"... it will collect and keep data on what type of device you are using, and your IP address ..." Oh dear ...
dang 7y ago
https://news.ycombinator.com/item?id=22657384 https://news.ycombinator.com/item?id=22657384 https://news.ycombinator.com/item?id=22659216 https://news.ycombinator.com/item?id=22659216
- upofadown 7y ago
  If these links are why this is marked as a dupe then that is wrong.
Anthony-G 7y ago
This is the first time I've seen an article on the front page of Hacker News that has the phrase “here are” in the title. I’ve noticed over the last few years this trend to add a superfluous “here is” or “here are” to a headline. Doing so add absolutely zero information, e.g., from the top three current Duck Duck Go search results for “here are”: 1. “Here Are All the Major Concerts Canceled Due to Coronavirus” – could just be “All the Major Concerts Canceled Due to Coronavirus” 2. “Coronavirus: Here Are 10 Misconceptions Being Spread” – this listicle could simply be titled “Coronavirus: 10 Misconceptions Being Spread” or “10 Coronavirus Misconceptions Being Spread” 3. “Have Children? Here Are 3 Tax Credits You Need to Know” – this listicle could be “Have Children? 3 Tax Credits You Need to Know” In two of the above cases, it’s also not just the headline but the text body also. I get the psychology behind listicles (and other clickbait phrases such as ”you need to know”) but I don’t understand the rationale for inserting these two wholly superfluous words that neither inform the reader nor embellish the prose. It’s had the opposite effect on me and I now have an internal heuristic of associating this practice with low quality information and I rarely – if ever – click on such links. Going by the comments on this article, it seems I was right in this case but surely, that’s the opposite of what the publishers intend.
lostmsu 7y ago
I made a simple sandboxed WebView wrapper for Windows, that should address the privacy issue and remove the annoying need to deal with constant "download the app" nagging: https://losttech.software/Downloads/FuZoom/ https://losttech.software/Downloads/FuZoom/
madwhitehatter 7y ago
The U.K. MOD has BANNED zoom what do they know
madwhitehatter 7y ago
https://metro.co.uk/2020/03/25/concern-zoom-video-conferencing-mod-bans-security-fears-12455327/amp/?ito=article.desktop.share.top.twitter&__twitter_impression=true https://metro.co.uk/2020/03/25/concern-zoom-video-conferenci...

393 points by teekert 7y ago

Honestly the points are valid but the solutions stated suck. Use a new version of zoom?????? Seriously, I mean well duh. Use a different device to check email?? Very disappointed with the conclusion, I was expecting some way to go into settings and disable all of the tracking garbage.

xnyhps 7y ago

The macOS version installs itself before you give it permission to install: https://twitter.com/xnyhps/status/1149630190877696001?s=21 https://twitter.com/xnyhps/status/1149630190877696001?s=21. It is basically malware.

ilikepi 7y ago
Very interesting. I don't have any experience making .pkg installers nor with verifying code signing on macOS, but I agree in general, the `preinstall` script does a lot of work one would expect the installer itself to do. This is all supporting evidence for my personal preference to never run the Zoom installer, but rather to extract the application bundle by hand.[1] Please consider writing up your findings in more detail. [1]: https://news.ycombinator.com/item?id=20391828 https://news.ycombinator.com/item?id=20391828

teekert 7y ago

I like Jitsi, it works well in my personal setting (kids talk for hours with the grand parents)... Other tips?

fendy3002 7y ago
I also like jitsi however haven't had any chance to seriously use it. I wonder if there is any major drawback for jitsi
- STRML 7y ago
  Jitsi's P2P nature is great for 1:1 or small group conversations if everyone has solid connections. From experience it starts to break down with larger groups, and becomes pretty useless overall if one or two participants have spotty connections.
  - lima 7y ago
    Jitsi is not P2P for group conversations - all streams are multiplexed by the server (the videobridge). 100% agreed about spotty connections, it does not handle them very well. As long as everyone has a decent connection and enough CPU, it handles groups of 10+ participants just fine. My company ended up switching to Google Meet for reliability reasons, but was a year ago so it might be better now.
- snthd 7y ago
  firefox support isn't all the way there yet. https://github.com/jitsi/jitsi-meet/issues/4758 https://github.com/jitsi/jitsi-meet/issues/4758
  - teekert 7y ago
    Yeah, it's a shame, had to install the Chromium snap only for this (Ubuntu 19.10). But then it did work very well (don't forget to enable the "record and play sound" permission for the snap.)
- lambertsimnel 7y ago
  Does Jitsi have the option for admins to mute or expel guests?
  - s_gourichon 7y ago
    Yes, admins can mute and kick. And if you allow anonymous channel creation, the first to enter a channel automatically has admin right. I don't know if kicked participants (especially unauthenticated) can re-join at once, after a delay or any other rule.
jboynyc 7y ago
Another thing that's great about Jitsi is how easy it is to self-host it. If you are using a system with the apt package manager (such Debian or Ubuntu), you basically only have to run two commands: https://github.com/jitsi/jitsi-meet/blob/master/doc/quick-install.md https://github.com/jitsi/jitsi-meet/blob/master/doc/quick-in...
- s_gourichon 7y ago
  Well, it is indeed easy to self-host it if you happen to already have a https-reachable server running Debian on a common CPU instruction set. Which I had, yet for maintenance reasons a container-based solution had my preference: https://github.com/jitsi/docker-jitsi-meet https://github.com/jitsi/docker-jitsi-meet

JensRex 7y ago

>"Do not use Facebook to sign in" Aside from being good advice generally, I doubt anyone who's concerned about the violation of privacy Zoom engages in, would have a Facebook account.

wyattpeak 7y ago
I'm concerned about all violations of privacy relevant to me, and yet I have a Facebook account. Wanting to be informed about privacy concerns is a world apart from being so single-mindedly concerned that you'll refuse to engage with a company who's bad in that regard, whatever the cost.
codetrotter 7y ago
Your doubts might need to be re-examined. I have a Facebook account that I originally registered when I was in high school a little over a decade ago. The reason I've kept it is because I use Facebook Messenger to talk to some people, and because a lot of events use Facebook. The main Facebook app I have not installed, because I don't need it. The Facebook Messenger app I have installed because I use it. I trust iOS to limit this app from being able to do anything too nasty. I never use "log in with Facebook". I clear my cookies regularly, and I often use a different browser for logging into Facebook from the browser I use for most stuff. I try my hardest to be vigilant of my privacy, even though it is a losing battle. The fact that someone has a Facebook account should not be taken as a sign that they think that any of the privacy violation stuff that businesses engage in is ok. As for Zoom, I made a conscious decision to not install the Zoom software on my MacBook Air because of the previous shenanigans that Zoom had been engaging in. When a client expressed desire that we use Zoom for our meetings, I therefore chose to install the Zoom app on iOS rather than on my MacBook Air, because iOS limits apps from being able to do anything too bad, and after we were done with the job I uninstalled the Zoom app from iOS as well.
- catacombs 7y ago
  > The reason I've kept it is because I use Facebook Messenger to talk to some people, and because a lot of events use Facebook. Nowadays, "some" people isn't worth Facebook harvesting your data. If you really want to keep in touch with those people, you can find a way.

TeluguFilms 7y ago

Yes It works..

donatj 7y ago

It collects "information you upload, provide, or create while using the service" … I mean it kind of has to does it not? That's how it can give it to other people.

inetknght 7y ago
Have you heard of encryption?
- dyeje 7y ago
  Zoom supports encryption: https://support.zoom.us/hc/en-us/articles/201362723-Encryption-for-Meetings https://support.zoom.us/hc/en-us/articles/201362723-Encrypti...
- h4waii 7y ago
  What exactly does "encryption" solve about this? It could be encrypted from client to server and the main concerns over privacy would still stand. What exactly are you suggesting by randomly throwing out the word "encryption"?
  - inetknght 7y ago
    Encrypt data prior to entering Zoom's services. That shouldn't affect Zoom's ability to deliver your (now-encrypted) data to your peers. It would affect Zoom's ability to usefully "collect" that data for other purposes though.
    - willis936 7y ago
      How are the keys exchanged? At the end of the day zoom holds the keys. What matters, legally, is their privacy policy. If you don’t trust that then you have no business using a program that brokers encryption keys.
      - tialaramex 7y ago
        No, key agreement protocols were invented in the 20th century. Two parties can agree a shared secret (such as a key) without an intermediary discovering this secret even though the intermediary knows everything both parties said. We have no mathematical proof that such protocols can exist (they need a trapdoor function and there is no mathematical proof that trapdoor functions are possible), but nevertheless they seem to work fine. Now, working KEx does leave you still not certain who the other party is, you're now communicating securely with someone but you aren't sure who. That's why the Web PKI exists. But choosing to have Zoom hold all the keys is a choice and not as you've portrayed it a necessity, the system could be designed to work just fine without doing that.

matsemann 7y ago

So not even close to what was touted yesterday. And do we really need yet another thread on this? Is there some kind of astroturfing going on or why is this Zoom-hate everywhere lately? https://news.ycombinator.com/item?id=22657384 https://news.ycombinator.com/item?id=22657384

nkozyra 7y ago
> why is this Zoom-stuff everywhere lately Um, really? It's probably the #1 conferencing app being introduced to a world of people not used to remote work. A lot of people are encountering it for the first time.
- hoseja 7y ago
  How is it #1 though? It seems to have come out of nowhere.
  - NortySpock 7y ago
    Zoom IPO'd on April 18, 2019, and was winning market share in the Enterprise video conference space at least a year or two before that. They had a much more reliable product with common-sense features like calling-in via phone line to connect to your meeting, as well as a turn-key solution to rigging a room for video-conferencing. As far as I know other competitors would be Skype (Microsoft) and WebEx, neither of which seemed nearly as polished.
    - wool_gather 7y ago
      I have experience with both Zoom and WebEx. Zoom (on Mac) has a lot of what I consider to be "bad behaviors" UI-wise, especially around window management. And it's ugly in the way mobile apps that get ported to the desktop are. But it gets the job done, and WebEx is definitely worse in these and other ways. So... /me shrugs
  - ajayyy 7y ago
    It was big before too

donohoe 7y ago

This is a very underwhelming article. It talks about an old bug and then some basic features you should be aware of... Shouldn't be on HN front-page. I think this article from EFF is clearer and more comprehensive in general: https://www.eff.org/deeplinks/2020/03/what-you-should-know-about-online-tools-during-covid-19-crisis https://www.eff.org/deeplinks/2020/03/what-you-should-know-a...

thephyber 7y ago
This doesn’t seem like an evidence point to shrug off: > It talks about an old bug Previous behavior is highly predictive of future behavior. The point about the web server was not just that is was improperly secured, but that it was done to bypass a user facing pop up in Safari. This kind of decision tells the reader something about company culture.
- bwb 7y ago
  They admitted they made a mistake and fixed it. The software itself works better than anything else on the market. What else do you need from them? :) I understand being wary, that never hurts, but the company is doing good things and apologized and fixed it.
  - chrisfinazzo 7y ago
    I vaguely remember Zoom back when the story about their clandestine web server came to light, but quickly forgot about it when they patched the bug. Now that it's back in the news as one of the only companies who might financially benefit from COVID-19 (their stock is up significantly, last I checked), they seem to be everywhere. I've seen some large news orgs using WebEx, but that's probably not new for them as they need something that's really enterprise-grade and won't go down on a whim. To that end, why has Zoom caught on so much this time around? iOS has FaceTime and Android - at least Google variants - have Hangouts. They're system apps, and everybody already has credentials sorted out. Does anyone know Zoom's relative marketshare before this hit?
    - 7y ago

virgilp 7y ago

> has already had a major security vulnerability. Oh no!! Unlike any other technology on earth that is actually used by non-trivial amounts of people? > “Does Zoom sell Personal Data?” the policy says, “Depends what you mean by ‘sell.’” That makes it sound like something malefic is happening. What privacy policy says is that they use Google tools (e.g. Google analytics, also used for delivering ads), and they put your data in Google analytics. This is however _their data_, while indeed "shared with Google" it doesn't mean Google is using it in any way, other than aggregate ("Across all our customers, <blah blah blah>") and even that, most likely only for internal statistics. I for one definitely don't see that as "selling data", I'd agree with Zoom here.

dpwm 7y ago
The article gave me the impression that the privacy policy literally said "depends what you mean by 'sell'." I didn't find that. I did find: > We do not allow marketing companies, advertisers, or anyone else to access Personal Data in exchange for payment. Except as described above, we do not allow any third parties access to any Personal Data we collect in the course of providing services to users. We do not allow third parties to use any Personal Data obtained from us for their own purposes, unless it is with your consent (e.g. when you download an app from the Marketplace). So in our humble opinion, we don’t think most of our users would see us as selling their information, as that practice is commonly understood. It seems a bit more nuanced than the article would suggest.

philshem 7y ago

Zoom's dark pattern is to obscure that every online meeting can be joined from the browser. They really hide this in order to install software on the client machine, which has been susceptible to bugs in the past. https://support.zoom.us/hc/en-us/articles/214629443 https://support.zoom.us/hc/en-us/articles/214629443 I've had no problems from the browser, although I think on some platforms they suggest (or require?) Chrome over Firefox.

ilikepi 7y ago
The Join by Browser feature was also discussed a bit in the other thread: https://news.ycombinator.com/item?id=22657949 https://news.ycombinator.com/item?id=22657949
manigandham 7y ago
Most people prefer the desktop software for better UX.
- treve 7y ago
  Do you have data? Or is this anecdotal?
- philshem 7y ago
  I had installed the Zoom client on my PC as a local non-admin user, and then had to go to IT to get an admin to uninstall it. Zoom is not alone in doing this. (Or maybe it's a Windows "feature"?)
  - judge2020 7y ago
    Your IT might have set up a group policy object that disables uninstalling software (https://www.windowscentral.com/how-prevent-accidental-uninstall-apps-start-menu-windows-10 https://www.windowscentral.com/how-prevent-accidental-uninst...)
    - philshem 7y ago

internalfx 7y ago

Or just use whereby.com No plugin needed.

ilikepi 7y ago

Regarding the "attention tracking" feature... If your boss/manager/etc is excited about this feature as a way to monitor you, odds are they already have you under surveillance in a bunch of other ways. It's unfortunate that you are in this situation, and I hope you're able to find a way out of it soon (e.g. by switching teams or finding another company that values and trusts you more). This feature is of limited use, though. With my laptop in my lap, it's trivial to hold my phone right in front of the lower half of my screen. It will be outside the field of view of the camera, but there will be no discernible difference between me looking at my laptop screen vs my phone screen. I'm all for fighting against companies chipping away at our privacy, but this one seems pretty far down a rather large list. EDIT: clarification

AznHisoka 7y ago
Isn't it also useless if you got multiple monitors? I connect my Macbook to my external monitors, and move the Zoom screen to my monitor instead of my laptop. Thus, I am never directly looking at my laptop screen. Any employer tracking me will always think I am never ever looking at my Zoom screen.
- bt1a 7y ago
  Correct, if you have Zoom on a secondary monitor and are working on your primary monitor, it will say that you are not paying attention. Thankfully our meeting organizer was quick to understand that most of us work with multiple monitors and decided not to pay the feature much attention.
catacombs 7y ago
> If your boss/manager/etc is excited about this feature as a way to monitor you, odds are they already have you under surveillance in a bunch of other ways. It's unfortunate that you are in this situation, and I hope you're able to find a way out of it soon (e.g. by switching teams or finding another company that values and trusts you more). I can't stand people who get excited at the thought of tracking their employees. What's the benefit? Control? Ego?

jscholes 7y ago

Anecdote: much of the software competing with Zoom has really bad accessibility for disabled users, incl. those using a screen reader, screen magnifier, keyboard-only/switch control, speech recognition, etc. This is despite the fact that some of it has been around for 10+ years, or is backed by large companies like Google. I bring this up because that can also cause privacy issues. There are the direct concerns, like not being able to access the text of their policies or accessibly manage your preferences. But the less obvious factor is inaccessible controls to: - verify whether or not you're streaming video; - determine whether your microphone is muted or not; - ... etc. If I don't know what I'm streaming and exposing to meeting participants, I'm losing on the privacy front. So Zoom it will have to be for now, I'm afraid. If you think it has too many issues for you to be a viable product, and have the option of making an alternative more inclusive, I'm open to chat.

judge2020 7y ago
> much of the software competing with Zoom has really bad accessibility for disabled users, Does that mean Zoom does in fact perform the necessary legwork on the accessibility front?
- jscholes 7y ago
  > Does that mean Zoom does in fact perform the necessary legwork on the accessibility front? Pretty much. They're not perfect, but they have put a ton of effort into it. It may be because they do business with governments, so require things like Voluntary Product Accessibility Templates (VPATs)[1]. But it is the only platform I can actively consider using for work, as someone who relies on a screen reader. [1] https://zoom.us/accessibility https://zoom.us/accessibility

hnrodey 7y ago

Any know if Teams has any dark patterns such as this? I haven't heard of anything.

montroser 7y ago

There's no reason why video conferencing should require an installed app in 2020. Standard browser tech in WebRTC is completely sufficient, and well supported at this point. There's even the Picture-in-Picture spec coming into place, which should allow more seamless desktop integration: https://w3c.github.io/picture-in-picture/ https://w3c.github.io/picture-in-picture/ Fully browser-based alternatives to zoom: https://hangouts.google.com https://hangouts.google.com https://whereby.com https://whereby.com https://team.video https://team.video

zajio1am 7y ago
> There's no reason why video conferencing should require an installed app in 2020. Much better efficiency and ergonomics? Freedom to choose independent client implementations interoperable by standardized protocols (e.g. SIP)? Independence of client provider and service provider? Interoperability between different providers (i.e. different users can use different service providers)?
- montroser 7y ago
  If the first two points are supremely important to you, and if you have enough resources, then yes, it's possible you may find more flexibility in an app. On independence and interoperability though, doesn't an open WebRTC stack spec'd by an independent standards body give us our best hope there?
teekert 7y ago
Don't forget privacy oriented https://meet.jitsi.net/ https://meet.jitsi.net/
galad87 7y ago
It wouldn't be an issue if the app was sandboxed. And I see no reason for a video conferencing to not be sandboxed or to implement similar privilege restrictions.
logie17 7y ago
Whereby has come a long way, and I recently started using team.video as well. I like both because I can just send a link and have a meeting instantly.

cdnuzzo 7y ago

Jitsi.org

rdiddly 7y ago

If you have to track people to make sure they pay attention during the meeting, the meeting is pointless and too long. Meetings that are short and packed with useful info nobody wants to miss, are well-attended. Managers, try being a real leader. Or is that too hard?

kryogen1c 7y ago

curious amount of negativity in here. what exactly is the concern? zoom is a corporate product. your electronic business activities are probably governed by lawyer-approved documents you signed like an AUP/NDA/consent to be monitored, so why are you concerned about privacy? dont want attention tracking? thats a feature, not a "privacy" bug (you expect personal privacy and freedom during business meetings?). bosses love this kind of metric, and not without reason. maybe if your meeting "attention" rate is low, theres an issue a boss could solve to make the business and employee's lives better. also you can just turn your camera off in zoom. > According to the company’s privacy policy, Zoom collects reams of data on you, including your name, physical address, email address, phone number, job title, employer. this is nonsense. how would installing zoom, as a meeting participant or host, collect your phone number and physical address? im sure their privacy policy says this, but that is very different than the zoom client actively scavenging computers for personal information. THAT would be a story >it will collect and keep data on what type of device you are using, and your IP address so... like almost every single piece of the internet? most personal IP addresses rotate, and who cares about your corporate ip? this has to be the lowest value and most common data point there is. not great, but not alarming. >Do not use Facebook to sign in hard to see a legitimate use-case for this. the corporate account features of zoom means everyone gets an account with their corporate email address, so why did they ever integrate with facebook? seems likely about scavenging data, but maybe theyre just trying to be trendy. all in all, seems like a hit-piece. hit-pieces arent necessarily wrong, but they are always agenda-based. maybe the agenda is something i agree with, but i dont know richie koch or what protonmail's stake in the game is in order to take this at face value without any actual details and sources.

decebalus1 7y ago
> your electronic business activities are probably governed by lawyer-approved documents you signed like an AUP/NDA/consent to be monitored, so why are you concerned about privacy? I did online interviews through Zoom. I did not sign any NDA and was not presented with a privacy policy from the companies using Zoom about the data they collected during the interview.

Ayoub12 7y ago

Top 10 Debunked Myths About Laundry https://culturelworld.blogspot.com/2020/03/top-10-debunked-myths-about-laundry.html https://culturelworld.blogspot.com/2020/03/top-10-debunked-m...

graton 7y ago

The woman in this video has issues with privacy in her Zoom conference call: https://www.youtube.com/watch?v=0xqLjc2y6O4 https://www.youtube.com/watch?v=0xqLjc2y6O4 Okay not the same issue this article is talking about, but do pay attention to if your camera is on and where it is pointing :)

Igelau 7y ago

Let's all pledge to keep a little notepad window open that we click into during Zoom meetings. Pollute attention tracking with false positives. Bonus points if you stare directly into the camera while you do this.

ravenstine 7y ago

Don't forget that Zoom used to have a web server installed in the background that Apple had to send out a patch to disable. I wouldn't ever trust running Zoom for that reason alone. I'm forced to run it at work, but never at home.

chvid 7y ago

"... it will collect and keep data on what type of device you are using, and your IP address ..." Oh dear ...

dang 7y ago

https://news.ycombinator.com/item?id=22657384 https://news.ycombinator.com/item?id=22657384 https://news.ycombinator.com/item?id=22659216 https://news.ycombinator.com/item?id=22659216

upofadown 7y ago
If these links are why this is marked as a dupe then that is wrong.

Anthony-G 7y ago

This is the first time I've seen an article on the front page of Hacker News that has the phrase “here are” in the title. I’ve noticed over the last few years this trend to add a superfluous “here is” or “here are” to a headline. Doing so add absolutely zero information, e.g., from the top three current Duck Duck Go search results for “here are”: 1. “Here Are All the Major Concerts Canceled Due to Coronavirus” – could just be “All the Major Concerts Canceled Due to Coronavirus” 2. “Coronavirus: Here Are 10 Misconceptions Being Spread” – this listicle could simply be titled “Coronavirus: 10 Misconceptions Being Spread” or “10 Coronavirus Misconceptions Being Spread” 3. “Have Children? Here Are 3 Tax Credits You Need to Know” – this listicle could be “Have Children? 3 Tax Credits You Need to Know” In two of the above cases, it’s also not just the headline but the text body also. I get the psychology behind listicles (and other clickbait phrases such as ”you need to know”) but I don’t understand the rationale for inserting these two wholly superfluous words that neither inform the reader nor embellish the prose. It’s had the opposite effect on me and I now have an internal heuristic of associating this practice with low quality information and I rarely – if ever – click on such links. Going by the comments on this article, it seems I was right in this case but surely, that’s the opposite of what the publishers intend.

lostmsu 7y ago

I made a simple sandboxed WebView wrapper for Windows, that should address the privacy issue and remove the annoying need to deal with constant "download the app" nagging: https://losttech.software/Downloads/FuZoom/ https://losttech.software/Downloads/FuZoom/

madwhitehatter 7y ago

The U.K. MOD has BANNED zoom what do they know

madwhitehatter 7y ago

https://metro.co.uk/2020/03/25/concern-zoom-video-conferencing-mod-bans-security-fears-12455327/amp/?ito=article.desktop.share.top.twitter&__twitter_impression=true https://metro.co.uk/2020/03/25/concern-zoom-video-conferenci...