4 ms·

That's terrible for national security. Zoom engineers are based in China: https://www.cnbc.com/2019/03/26/zoom-key-profit-driver-ahead-of-ipo-engineers-in-china

That's terrible for national security. Zoom engineers are based in China: https://www.cnbc.com/2019/03/26/zoom-key-profit-driver-ahead-of-ipo-engineers-in-china.html https://www.cnbc.com/2019/03/26/zoom-key-profit-driver-ahead...

davedx 7y ago
Components of the GB 5g network are also being outsourced to China. Some of the ruling party's MP's are not happy about it.
- bogle 7y ago
  The noisy back-benchers are a little silly as all of Huawei's work is scrutenised: https://www.wired.co.uk/article/huawei-gchq-security-evaluation-uk https://www.wired.co.uk/article/huawei-gchq-security-evaluat... Of course, in the UK, calling Tory back-benchers "a little silly" is an understatement.
  - davedx 7y ago
    Are the NATO countries refusing to use Huawei's work for their 5g networks also all "a little silly"? What if Huawei was Russian, would it still be "a little silly"?
krageon 7y ago
It doesn't matter where they're based. What matters is that Zoom isn't safe by any measure and tells you about that if you spend a little time reading critically.
- floatingatoll 7y ago
  It’s certainly no less safe than the backdoored-for-decades phone/fax networks used by medical professionals to discuss medical secrets with patients and send prescriptions to pharmacies. It’d be nice if it was more safe, but it’s hard to sink lower than a telco line.
  - lvh 7y ago
    You can send faxes to someone without the telco running a local webserver on your fax machine, and you don't run thousands of other applications on your fax machine, and your fax machine doesn't usually come with a nifty record feature, nor a camera and a microphone.
    - floatingatoll 7y ago
      I hesitate to point this out, but quite a lot of fax machines come with a microphone. (And, noting the prevalence of articles from a few years ago talking about "update your fax machine firmware", I suspect you could fuzz their telco line-parser for very interesting results!)
      - lvh 7y ago
        Good point--you're talking about the embedded handset or something else? That said, as you hint at: not quite the same thing from a threat model perspective :)
        floatingatoll 7y ago
        Indeed! That depends entirely on whether the handset is physically disconnected by the on-hook switch, or if a firmware exploit could remotely enable it. Threat modeling a fax machine in the era of fuzzing-RCEs is a particularly interesting thing to consider.
- marcus_holmes 7y ago
  If they're based in Australia they can be legally coerced into installing any code the Australian government feels like telling them to insert. So I'm not sure that China is much worse.
  - deleted 7y ago
    [deleted]
throwaway64054 7y ago
Zoom raises the possibility of this perception in their S-1 filing [0]: "we have a high concentration of research and development personnel in China, which could expose us to market scrutiny regarding the integrity of our solution or data security features" [0]: https://www.sec.gov/Archives/edgar/data/1585521/000119312519083351/d642624ds1.htm https://www.sec.gov/Archives/edgar/data/1585521/000119312519...
couchridr 7y ago
Charles tells me that when I installed Zoom, my iPhone made four HTTPS connections to zoom.com.cn/69.174.108.252

davedx 7y ago

Components of the GB 5g network are also being outsourced to China. Some of the ruling party's MP's are not happy about it.

bogle 7y ago
The noisy back-benchers are a little silly as all of Huawei's work is scrutenised: https://www.wired.co.uk/article/huawei-gchq-security-evaluation-uk https://www.wired.co.uk/article/huawei-gchq-security-evaluat... Of course, in the UK, calling Tory back-benchers "a little silly" is an understatement.
- davedx 7y ago
  Are the NATO countries refusing to use Huawei's work for their 5g networks also all "a little silly"? What if Huawei was Russian, would it still be "a little silly"?

krageon 7y ago

It doesn't matter where they're based. What matters is that Zoom isn't safe by any measure and tells you about that if you spend a little time reading critically.

floatingatoll 7y ago
It’s certainly no less safe than the backdoored-for-decades phone/fax networks used by medical professionals to discuss medical secrets with patients and send prescriptions to pharmacies. It’d be nice if it was more safe, but it’s hard to sink lower than a telco line.
- lvh 7y ago
  You can send faxes to someone without the telco running a local webserver on your fax machine, and you don't run thousands of other applications on your fax machine, and your fax machine doesn't usually come with a nifty record feature, nor a camera and a microphone.
  - floatingatoll 7y ago
    I hesitate to point this out, but quite a lot of fax machines come with a microphone. (And, noting the prevalence of articles from a few years ago talking about "update your fax machine firmware", I suspect you could fuzz their telco line-parser for very interesting results!)
    - lvh 7y ago
      Good point--you're talking about the embedded handset or something else? That said, as you hint at: not quite the same thing from a threat model perspective :)
      - floatingatoll 7y ago
        Indeed! That depends entirely on whether the handset is physically disconnected by the on-hook switch, or if a firmware exploit could remotely enable it. Threat modeling a fax machine in the era of fuzzing-RCEs is a particularly interesting thing to consider.
marcus_holmes 7y ago
If they're based in Australia they can be legally coerced into installing any code the Australian government feels like telling them to insert. So I'm not sure that China is much worse.
- deleted 7y ago
  [deleted]

throwaway64054 7y ago

Zoom raises the possibility of this perception in their S-1 filing [0]: "we have a high concentration of research and development personnel in China, which could expose us to market scrutiny regarding the integrity of our solution or data security features" [0]: https://www.sec.gov/Archives/edgar/data/1585521/000119312519083351/d642624ds1.htm https://www.sec.gov/Archives/edgar/data/1585521/000119312519...

couchridr 7y ago

Charles tells me that when I installed Zoom, my iPhone made four HTTPS connections to zoom.com.cn/69.174.108.252