4 ms·

You're right. Consider that any Mac app that: * Supports plugins that aren't signed by Apple * Executes scripts or macros from a file would technically have

You're right. Consider that any Mac app that: * Supports plugins that aren't signed by Apple * Executes scripts or macros from a file would technically have the same "problem". That's a heck of a lot of apps. On iOS Apple do insist on a full chain of security, which is why only Apple's own browser app can JIT code. It's an extremely perverse and serious limitation that has no real security justification: consider that Android manages just fine without it. As far as I can tell, Zoom is currently the target of a witchhunt. People are digging for dirt and blowing stuff well out of proportion.

lukeschlather 7y ago
There are a lot of people blowing things out of proportion who don't know what they're talking about. However these things are newsworthy and probably worth Zoom fixing. (I think to a certain extent if I say something like "It's dumb that Zoom doesn't have real e2e encryption and they should fix it." That sounds harsh and I mean it. That said I'm still going to use Zoom unless something with equivalent UX and e2e encryption comes along. (Someday there will be a solid cross-platform native p2p video client with e2e encryption.)
- ptlu 7y ago
  FaceTime? It probably doesn't work at conference scale but it is E2E. > We designed iMessage and FaceTime to use end-to-end encryption, so there’s no way for Apple to decrypt the content of your conversations when they are in transit between devices. https://support.apple.com/en-us/HT209110 https://support.apple.com/en-us/HT209110
  - thu2111 7y ago
    But that's a total lie, isn't it? They can just send your iPhone a public key owned by Apple. Or they can put a backdoor in the app and get you to install an upgrade.
  - mulmen 7y ago
    FaceTime isn’t cross platform.
- thu2111 7y ago
  E2E is snake oil at the moment. Nobody has developed a reasonable UX to let people exchange keys, and closed source clients that can be centrally updated render any such encryption pointless. It could be disabled at a moment's notice and you'd never know. I don't blame Zoom for not investing in it.
  - mulmen 7y ago
    The problem isn’t that Zoom is lacking E2E. The problem is they claim to have it and actually don’t.

lukeschlather 7y ago

There are a lot of people blowing things out of proportion who don't know what they're talking about. However these things are newsworthy and probably worth Zoom fixing. (I think to a certain extent if I say something like "It's dumb that Zoom doesn't have real e2e encryption and they should fix it." That sounds harsh and I mean it. That said I'm still going to use Zoom unless something with equivalent UX and e2e encryption comes along. (Someday there will be a solid cross-platform native p2p video client with e2e encryption.)

ptlu 7y ago
FaceTime? It probably doesn't work at conference scale but it is E2E. > We designed iMessage and FaceTime to use end-to-end encryption, so there’s no way for Apple to decrypt the content of your conversations when they are in transit between devices. https://support.apple.com/en-us/HT209110 https://support.apple.com/en-us/HT209110
- thu2111 7y ago
  But that's a total lie, isn't it? They can just send your iPhone a public key owned by Apple. Or they can put a backdoor in the app and get you to install an upgrade.
- mulmen 7y ago
  FaceTime isn’t cross platform.
thu2111 7y ago
E2E is snake oil at the moment. Nobody has developed a reasonable UX to let people exchange keys, and closed source clients that can be centrally updated render any such encryption pointless. It could be disabled at a moment's notice and you'd never know. I don't blame Zoom for not investing in it.
- mulmen 7y ago
  The problem isn’t that Zoom is lacking E2E. The problem is they claim to have it and actually don’t.