5 ms·

Zoom Falsely Claims Its Group Video Can Be End-to-End Encrypted

60 points by lladnar 7y ago

pixiemaster 7y ago
marketing mis-uses a buzzword. that’s news now.
- dewey 7y ago
  It's news if you have a track record of privacy violations as it has been with Zoom in the past few days.
  - middleclick 7y ago
    It's also news if your company is gaining traction and increased usage, especially with things like this: https://twitter.com/BorisJohnson/status/1244985949534199808 https://twitter.com/BorisJohnson/status/1244985949534199808
- ryanmcbride 7y ago
  The issue in my eyes is more that they are intentionally redefining what end-to-end encryption is, which is intentionally misleading.
bgentry 7y ago
Link to the source article: https://theintercept.com/2020/03/31/zoom-meeting-encryption/ https://theintercept.com/2020/03/31/zoom-meeting-encryption/ Dupe of https://news.ycombinator.com/item?id=22735746 https://news.ycombinator.com/item?id=22735746
- owenwil 7y ago
  It feels like the URL shouldn't be an aggregator but the actual source in this case for sure...
sunkenvicar 7y ago
Zoom is run by a Chinese national who failed his US visa application 10 times. Of course China gets a copy of your video chat - they are looking for our national security secrets.
jcwayne 7y ago
Maybe I'm missing something, but it seems like they're misusing the term in the same way that Apple does with iMessage.
- olliej 7y ago
  ?? iMessage is fully E2E - Apple does not have any ability to decrypt messages, only the recipient can. There's a full white paper explaining how iMessage works, and how it achieves full E2E. Same for FaceTime. And iMessage group messages.
  - beagle3 7y ago
    That’s true, though IIRC Apple can enroll new devices into any account, so they can eavesdrop if they want (but not decrypt anything from before they started eavesdropping)
  - miles 7y ago
    > iMessage is fully E2E - Apple does not have any ability to decrypt messages, only the recipient can. The iMessage private key is stored by Apple if iCloud Backup is enabled: https://news.ycombinator.com/item?id=22106536 https://news.ycombinator.com/item?id=22106536
  - alasdair_ 7y ago
    >iMessage is fully E2E - Apple does not have any ability to decrypt messages, only the recipient can. This is not true. Apple is deliberately deceptive with their claim that iMessage has "full E2E" as you put it. While it's true that Apple can't decrypt iMessage traffic in transit Apple can absolutely decrypt your messages. For a simple explanation, think about how an iCloud restore works for a brand new iPhone that you've just purchased. All your messages magically appear on the device! But they were all encrypted and Apple claims to use E2E encryption - how is this possible? It's simple - iCloud backup also backs up the encryption key used to read your messages. A restore wouldn't work without it. So in practice, Apple is deceptive when it claims that it can't read your messages (or give them to law enforcement, etc.) - if you are a normal user with iCloud backup turned on and you haven't explicitly taken the extra steps to disable message backups, Apple can read every one of your "E2E" messages.
kaffeemitsahne 7y ago
Where did Zoom come from all of a sudden? I had never heard of it before the pandemic but now all my lecturers at two different universities are using it. They must be doing something right at least. (edit: not to be apologetic for the issue at hand, of course)
- anamexis 7y ago
  They were already one of the leading enterprise web conference providers, alongside Cisco and Microsoft.
- ironmagma 7y ago
  They have a free promotional campaign for educational institutions that started 2020-03-13.
- skizm 7y ago
  From what I gather, they're one of the few video conference solutions that "just work", you don't need to install anything if you don't want (works in the browser), and their user pricing is pretty cheap and straightforward ($15/mo/user). Also, they've scaled well as there haven't been too many (any?) major outages, even though their usage has gone up probably 50x (complete guess) in the last 1-3 months.
- paulhodge 7y ago
  If you're a connoisseur of video chat platforms then you probably already know it. For the past ~5 years it's been one of the best options. Really easy to use and good quality. Within our company we got in a habit of using the free 40-minute Zoom meetings, even though our IT department mandated us to use Skype (which is awful). I think a lot of people came to Zoom from a similar organic path. Although this year, Microsoft came out with Teams which is just as good IMO. So we finally stopped using Zoom here.
gfodor 7y ago
FYI, it's currently impossible to support end to end encryption in WebRTC based video that is browser based (if using a SFU, ie a central server), given the protocols supported in the browser. Zoom isn't, obviously, but that's another red flag if you see such claims.
meritt 7y ago
Another Zoom article, and it's a dupe with one already on the front page! This is insane. I haven't seen HN so virulent over a topic since their blind faith defense on any criticism of Tesla.
- dang 7y ago
  It happens all the time with follow-up posts on hot topics. Maybe we're getting slower or something.
  - meritt 7y ago
    Yeah, just shouldn't be solely a moderator job. You'd think the userbase would stop upvoting the same damn story and/or not flagging the dupes.
    - dang 7y ago
      Alas, statistical clouds don't work that way. No matter how many times something has been posted, the set of users who saw it seems to have measure zero.

60 points by lladnar 7y ago

pixiemaster 7y ago

marketing mis-uses a buzzword. that’s news now.

dewey 7y ago
It's news if you have a track record of privacy violations as it has been with Zoom in the past few days.
- middleclick 7y ago
  It's also news if your company is gaining traction and increased usage, especially with things like this: https://twitter.com/BorisJohnson/status/1244985949534199808 https://twitter.com/BorisJohnson/status/1244985949534199808
ryanmcbride 7y ago
The issue in my eyes is more that they are intentionally redefining what end-to-end encryption is, which is intentionally misleading.

bgentry 7y ago

Link to the source article: https://theintercept.com/2020/03/31/zoom-meeting-encryption/ https://theintercept.com/2020/03/31/zoom-meeting-encryption/ Dupe of https://news.ycombinator.com/item?id=22735746 https://news.ycombinator.com/item?id=22735746

owenwil 7y ago
It feels like the URL shouldn't be an aggregator but the actual source in this case for sure...

sunkenvicar 7y ago

Zoom is run by a Chinese national who failed his US visa application 10 times. Of course China gets a copy of your video chat - they are looking for our national security secrets.

jcwayne 7y ago

Maybe I'm missing something, but it seems like they're misusing the term in the same way that Apple does with iMessage.

olliej 7y ago
?? iMessage is fully E2E - Apple does not have any ability to decrypt messages, only the recipient can. There's a full white paper explaining how iMessage works, and how it achieves full E2E. Same for FaceTime. And iMessage group messages.
- beagle3 7y ago
  That’s true, though IIRC Apple can enroll new devices into any account, so they can eavesdrop if they want (but not decrypt anything from before they started eavesdropping)
- miles 7y ago
  > iMessage is fully E2E - Apple does not have any ability to decrypt messages, only the recipient can. The iMessage private key is stored by Apple if iCloud Backup is enabled: https://news.ycombinator.com/item?id=22106536 https://news.ycombinator.com/item?id=22106536
- alasdair_ 7y ago
  >iMessage is fully E2E - Apple does not have any ability to decrypt messages, only the recipient can. This is not true. Apple is deliberately deceptive with their claim that iMessage has "full E2E" as you put it. While it's true that Apple can't decrypt iMessage traffic in transit Apple can absolutely decrypt your messages. For a simple explanation, think about how an iCloud restore works for a brand new iPhone that you've just purchased. All your messages magically appear on the device! But they were all encrypted and Apple claims to use E2E encryption - how is this possible? It's simple - iCloud backup also backs up the encryption key used to read your messages. A restore wouldn't work without it. So in practice, Apple is deceptive when it claims that it can't read your messages (or give them to law enforcement, etc.) - if you are a normal user with iCloud backup turned on and you haven't explicitly taken the extra steps to disable message backups, Apple can read every one of your "E2E" messages.

kaffeemitsahne 7y ago

Where did Zoom come from all of a sudden? I had never heard of it before the pandemic but now all my lecturers at two different universities are using it. They must be doing something right at least. (edit: not to be apologetic for the issue at hand, of course)

anamexis 7y ago
They were already one of the leading enterprise web conference providers, alongside Cisco and Microsoft.
ironmagma 7y ago
They have a free promotional campaign for educational institutions that started 2020-03-13.
skizm 7y ago
From what I gather, they're one of the few video conference solutions that "just work", you don't need to install anything if you don't want (works in the browser), and their user pricing is pretty cheap and straightforward ($15/mo/user). Also, they've scaled well as there haven't been too many (any?) major outages, even though their usage has gone up probably 50x (complete guess) in the last 1-3 months.
paulhodge 7y ago
If you're a connoisseur of video chat platforms then you probably already know it. For the past ~5 years it's been one of the best options. Really easy to use and good quality. Within our company we got in a habit of using the free 40-minute Zoom meetings, even though our IT department mandated us to use Skype (which is awful). I think a lot of people came to Zoom from a similar organic path. Although this year, Microsoft came out with Teams which is just as good IMO. So we finally stopped using Zoom here.

gfodor 7y ago

FYI, it's currently impossible to support end to end encryption in WebRTC based video that is browser based (if using a SFU, ie a central server), given the protocols supported in the browser. Zoom isn't, obviously, but that's another red flag if you see such claims.

meritt 7y ago

Another Zoom article, and it's a dupe with one already on the front page! This is insane. I haven't seen HN so virulent over a topic since their blind faith defense on any criticism of Tesla.

dang 7y ago
It happens all the time with follow-up posts on hot topics. Maybe we're getting slower or something.
- meritt 7y ago
  Yeah, just shouldn't be solely a moderator job. You'd think the userbase would stop upvoting the same damn story and/or not flagging the dupes.
  - dang 7y ago
    Alas, statistical clouds don't work that way. No matter how many times something has been posted, the set of users who saw it seems to have measure zero.