14 ms·
The fact that they show end users (no pun intended) an "end-to-end encrypted" badge on the meeting window itself, and elsewhere explain how a Zoom server (not Z
by hunter2_ 7y ago
The fact that they show end users (no pun intended) an "end-to-end encrypted" badge on the meeting window itself, and elsewhere explain how a Zoom server (not Zoom client) is what constitutes an "end" despite the whole rest of the electronic communication industry using "end-to-end" to refer exclusively to user agents, is bonkers.
- paulryanrogers 7y agoAgreed. It's unlikely they stumbled onto an industry standard phrase like that alone, then innocently used it without knowing the generally accepted meaning. This is deceptive advertising.
- LeifCarrotson 7y agoNot just "deceptive" nor "unlikely", it's blatant false advertising.
- harry8 7y agoFraudulent is the word i would use.
- diggan 7y ago"Fraudulent", at least as far as I know, is reserved for "intentional deception". It could be that Zoom is indeed doing this intentionally, but without proof of it being intentional, I don't think we should assume so. insert Hanlons razor quote here
- deleted 7y ago[deleted]
- loup-vaillant 7y agoA company this prominent is unlikely to be that incompetent. Malice is more probable at this point, Hanlon's razor notwithstanding.
- diggan 7y agoEh, haven't large companies leaked private details from their customers time and time again, in basic ways like forgetting that they have backups on S3 buckets with zero protection? Being incompetent has nothing to do with the size or prominence of the company. Big/prominent companies fuck up/are sloppy all the time.
- welfare 7y agoThis is not a fuck up or negligence, Zoom deliberately used "end-to-end" with a completely different meaning than the rest of the world. I can't describe this as anything else than malicious and fraudulent. Their intention was to deceive users that the communication was encrypted, when in reality it wasn't.
- diggan 7y agoI guess you don't have experience working in a company with a marketing team that feel they can buzzword things in without checking with IT teams then. I'm in no way saying it's impossible that Zoom did say E2E encryption while knowing that's not true, but I could imagine a scenario where a security person says "Yeah, we're encrypting connections to our backend" and a marketing person researching E2E and then saying to themselves "Yeah, sounds like we're doing E2E, let's write that", because this stuff happens all the time in the industry. > Their intention was to deceive users You sound so sure about their intentions, do you have any actual proof of this that others are missing? Again, I'm not saying it's impossible that their intention was to deceive users, but as an engineer, I always favor proof over guessing.
- trickstra 7y agoThe IT guys in the industry know very well what constitutes an E2E encryption. Those two ends must be "trusted" which means it's either you yourself - your computer, or the other party which you want to talk to. Everything in between is third party and must get only encrypted data. If they redefine one of the "ends" as Zoom server, that's definitely intentional, blatant, and therefore fraudulent.
- diggan 7y agoI'm not disagreeing that they are using E2E wrong, I fully agree with you there. But just because someone uses a word wrong doesn't give you any proof about their intentions. See https://news.ycombinator.com/item?id=22767447 https://news.ycombinator.com/item?id=22767447 for further elaboration on that point. Again, it's harmful to use words incorrectly, _especially_ when it comes to E2E, so they should rightly get flak for getting it wrong. You all seem to be so sure that it was intentional though, while I've seen the same problem so many times before in the industry without it being intentional. If you do have proof it's intentional, please share it with the rest of us so we can be on the same page.
- goatinaboat 7y agoIt’s akin to VW putting claims to be emissions compliant in their ads.
- stevenicr 7y agoThis bothers me so much - as I have personally recommended zoom to many people and customers. People that have likely seen that I spend an unusual amount of time focused on computer security, backups, and care in communications. If I remember correctly, zoom used to have on the front page - use this it's encrypted, and 'even used by us govt something-something' - so I assumed it was completely secure. I actually refused to use other conference services much to the bemoans of many clients who already had other 'goto' software installed, used and understood - and convinced them that in order to talk turkey we needed to use the real secure zoom system. It passed the smell test at the time for me because they also had paid plans which meant to me a legitimate business that did not need to slay privacy with ads and such, as they had a clear path to make money. Now they are tarnished, and my reputation with several clients and doctors and others may be as well - as this is getting mainstream press (I think that's a good thing actually) - I'm livid about this. I agree with below it is also fraud - and another commentator mentioned they changed to "your client connection is encrypted" is still deception imho. Needs a big asterisk and real explanation of the lack of privacy.
- tomcooks 7y agoOnly recommend free software, this way you minimize reputation drama
- criley2 7y agoGenerally speaking, free software UX is so bad that I would never recommend it to most people I talk to because 1) I don't want to train them on it 2) I don't want to support them on it 3) It isn't good enough for them to use without 1-2 So I pick the shiny costly commercial version that comes with training and support. I mean, I've done the recommend my parents and older coworkers use difficult OSS software thing in my past, and I honestly regret it. No one won.
- mmm_grayons 7y agoSadly, my experience has been the opposite, because open-source stuff usually takes more work to run and is seldom as polished, and users hate that. I rarely, if ever, recommend open-source anything for end-user use. Zoom did well because it had the least hassle of any solution, hands-down. I'm not saying it's impossible to subscribe to a hosted open-source service that's as good, but it doesn't exist yet.
- wwweston 7y agoUsing industry standard phrases without a complete understanding of meanings is... well, industry standard. ;)
- ethbro 7y agoLike some sort of distributed, cloud AI dictionary!
- intopieces 7y agoNot defending zoom here -- they done fucked up -- but there is a huge disconnect between the marketing folks and the technical folks. It's possible that E2E Encryption was something they planned on implementing but haven't, and the marketing department either didn't get the memo or didn't understand and still kept the wording.
- bdamm 7y agoThat's not an excuse. Sooner or later it'll become a faux pas to mis-use basic security terminology. Obviously most of the public doesn't care about most of the terminology. But "end to end" has been trending for a decade at least.
- paulryanrogers 7y agoFor how long do we let them slide before the FTC steps in?
- tyre 7y agoIf marketing misuses a term on the website because they didn't understand what it meant, that's their fault. If they listed a feature that hasn't yet shipped, that's their fault. It's natural that there is a divide and marketing isn't expected to understand every engineering thing (nor the other way around.) If your job is to write words, though, you are responsible for the words you right.
- fao_ 7y agoWhy would you trust a company where communication is so poor, though?
- deleted 7y ago[deleted]
- macrael 7y agothey appear to have already changed this to "your client connection is encrypted"
- shrewduser 7y agowhich means fuck all.
- black_puppydog 7y agowell that means it's cryptographically superior to the ICQ client I used beginning of the century.
- jbay808 7y agoUnfortunately, the threats these days are also probably more sophisticated, and most people weren't using ICQ for sensitive business meetings.
- hope-striker 7y agoIt means that it's opaque to your ISP and other people on your network, which is at the very least useful for people using it at McDonald's or a university.
- owl57 7y agoSo, pretty much the opposite of all those people currently using it instead of going together to McDonald's or university? On a more serious note, you would need to trust not one ISP if the video wasn't encrypted, but all the ISPs in the room simultaneously, and that is probably something even less trustworthy than Facebook.
- zeepzeep 7y agoWow like every other serious website on the internet?
- hunter2_ 7y ago
- throw_away 7y agoUsing their definition, one would wonder what non-end-to-end encryption would look like.
- gowld 7y agoEncryption at rest but not in transit.
- hn_throwaway_99 7y agoWhat can that even mean for a videoconferencing platform?
- drdaeman 7y agoThe recordings for your favorite TLA review would be properly encrypted. I bet those agencies take security seriously. /s
- deathhand 7y agoThis is incorrect. It still is encrypted in transit via TLS. There are encryption tunnels from point to point just not 'end to end'.
- Tuxer 7y agoApple does the same thing, where they claim iMessage is ETE encrypted, but the keys (so capabilities to read) are stored on their servers.
- dgcupps 7y agoNo, it doesn't. https://support.apple.com/guide/security/how-imessage-sends-and-receives-messages-sec70e68c949/web https://support.apple.com/guide/security/how-imessage-sends-...
- chance_state 7y agoI think this article is a bit over my head, but if Apple never has possession of users' private keys, how are they able to recover iMessage conversations when a phone is lost/stolen (which I know they can do)?
- bananabreakfast 7y agoThey can only do that if you have backed up your phone. If you haven't they cannot recover your messages.
- modeless 7y agoYes, it does. The messages are 'end to end' encrypted in the iMessage service, but then iMessage backs up its encryption key in the iCloud backup service, defeating the point. "If you have iCloud Backup turned on, your backup includes a copy of the key protecting your Messages. This ensures you can recover your Messages if you lose access to iCloud Keychain and your trusted devices." https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
- dgcupps 7y agoThat is true of any end-to-end solution. If you back up your private keys, anyone who has access to your backup would be able to access the encrypted messages. Remember, you can turn off iCloud backup if you're worried about Apple accessing your keys. Ultimately, it's false to equate iMessage's encryption scheme, which is end-to-end, to an encryption scheme that requires a server to relay decrypted data.
- true_religion 7y agoThey are using the same language as Apple talking about iMessage and FaceTime. Apple talks about end to end encryption, but one end is iCloud which is why you can get your messages simultaneously on all devices.
- hn_throwaway_99 7y agoThere is a big difference there though. In transit, iMessage and FaceTime backups are end-to-end encrypted, it's just the iMessage backups on iCloud that also store the key. FaceTime chats, though, truly are end-to-end encrypted and the calls aren't backed up like iMessages are.
- deleted 7y ago[deleted]
- _-___________-_ 7y agoAnd, backup is optional.
- true_religion 7y agoThank you for providing some clarity on the issue. Apple did not when I read their page here: https://support.apple.com/en-us/HT209110 https://support.apple.com/en-us/HT209110 They merely mention that backups to iCloud happen automatically by default, and not that doing so means the default is that Apple can view and decrypt all your messages.
- lxgr 7y agoThat's not true at all. iMessage is really end-to-end encrypted. Two options impact it: "Messages in iCloud" re-encrypts and uploads messages to the user's iCloud account and stores the key in iCloud Keychain (also end-to-end encrypted). Only when enabling iCloud backup will that key be revealed to Apple.
- _-___________-_ 7y agoIt's entirely possible to do multi-device end-to-end encryption. See Signal or XMPP+OMEMO.
- gowld 7y agoE2E changed meaning since, for example, HIPAA.
- aledthemathguy 7y agoThe Zoom CEO and founder is chinese. He was refused a Visa to the US (8 times!). It's not inspiring, it's scary. https://www.bloomberg.com/news/articles/2019-04-18/u-s-refused-his-visa-eight-times-now-zoom-ceo-is-a-billionaire https://www.bloomberg.com/news/articles/2019-04-18/u-s-refus...
- cma 7y agoWas he denied it for security reasons? Or are you saying it is scary we didn't let him in?
- platinumrad 7y agoHey, you should say the quiet part loud.
- taneq 7y agoThe quiet part? You mean "the only people we should let spy on us is our own government"?
- platinumrad 7y agoThe quiet part is "American citizens of Chinese descent can't be trusted". This is as obvious of a dogwhistle as when people "innocently" point out that the CEO of some maligned Wall Street firm is Jewish and I have no idea why it's getting upvotes on this site.
- taneq 7y agoHuh, I guess I was out of the loop. I never got the thing about Jewish people either so I guess this is normal though. Thanks for explaining!
- Ctd2xUvMAicg 7y agoIt says "connection is encrypted" in the current version. No mention of end-to-end whatsoever.
- zeepzeep 7y agohttps://zoom.us/security https://zoom.us/security still says "Secure a meeting with end-to-end encryption"
- Diggsey 7y agoIf one is to believe their blog post (https://blog.zoom.us/wordpress/2020/04/01/facts-around-zoom-encryption-for-meetings-webinars/ https://blog.zoom.us/wordpress/2020/04/01/facts-around-zoom-...), then they do in fact use end-to-end encryption: > To be clear, in a meeting where all of the participants are using Zoom clients, and the meeting is not being recorded, we encrypt all video, audio, screen sharing, and chat content at the sending client, and do not decrypt it at any point before it reaches the receiving clients. The first problem is: > Zoom currently maintains the key management system for these systems in the cloud. Obviously, this compromises many of the benefits of e2e encryption. Having said that, it doesn't remove all of the benefits, and it's a (bad) precedent that has been set by other companies (eg. apple) where keys for end-to-end encrypted communication are backed up to the cloud. The second problem is that Zoom has a second class of "client" called a "Connector" which runs in the cloud, and also has access to the keys for decrypting the stream. I definitely think that when one of these connectors is being used, it is false advertising to show the "e2e encrypted" status. However, there are clear technical reasons why these connectors are needed. Being able to dial into a meeting from an ordinary phone is important functionality that simply cannot support end-to-end encryption. The interesting section to me is the later paragraph: > For those who want additional control of their keys, an on-premise solution exists today for the entire meeting infrastructure, and a solution will be available later this year to allow organizations to leverage Zoom’s cloud infrastructure but host the key management system within their environment. Additionally, enterprise customers have the option to run certain versions of our connectors within their own data centers if they would like to manage the decryption and translation process themselves. In particular, being able to use your own key management system would make this truly end-to-end encrypted by any definition, even if you are still using Zoom's cloud infrastructure.
- hunter2_ 7y ago> other companies (eg. apple) where keys for end-to-end encrypted communication are backed up to the cloud Backed up for iCloud users who might not know any better, but not backed up for people who take the time to learn how to guarantee the full protection of E2E by keeping iCloud off. The fact that the full benefit is available with little effort, albeit not obvious, creates a contrast to how: > Zoom has never built a mechanism to decrypt live meetings for lawful intercept purposes ...but they easily could. Users can't just search for how to harden the Zoom encryption to the point of lawful intercept becoming impossible and find a simple solution the way they can with Apple. > an on-premise solution exists today for the entire meeting infrastructure ...is not practical for most. So, eliminating the E2E badge was the right move. The fact that it was there until now is shady.