5 ms·

Not just "deceptive" nor "unlikely", it's blatant false advertising.

by LeifCarrotson 7y ago

harry8 7y ago
Fraudulent is the word i would use.
- diggan 7y ago
  "Fraudulent", at least as far as I know, is reserved for "intentional deception". It could be that Zoom is indeed doing this intentionally, but without proof of it being intentional, I don't think we should assume so. insert Hanlons razor quote here
  - deleted 7y ago
    [deleted]
  - loup-vaillant 7y ago
    A company this prominent is unlikely to be that incompetent. Malice is more probable at this point, Hanlon's razor notwithstanding.
    - diggan 7y ago
      Eh, haven't large companies leaked private details from their customers time and time again, in basic ways like forgetting that they have backups on S3 buckets with zero protection? Being incompetent has nothing to do with the size or prominence of the company. Big/prominent companies fuck up/are sloppy all the time.
      - welfare 7y ago
        This is not a fuck up or negligence, Zoom deliberately used "end-to-end" with a completely different meaning than the rest of the world. I can't describe this as anything else than malicious and fraudulent. Their intention was to deceive users that the communication was encrypted, when in reality it wasn't.
        diggan 7y ago
        I guess you don't have experience working in a company with a marketing team that feel they can buzzword things in without checking with IT teams then. I'm in no way saying it's impossible that Zoom did say E2E encryption while knowing that's not true, but I could imagine a scenario where a security person says "Yeah, we're encrypting connections to our backend" and a marketing person researching E2E and then saying to themselves "Yeah, sounds like we're doing E2E, let's write that", because this stuff happens all the time in the industry. > Their intention was to deceive users You sound so sure about their intentions, do you have any actual proof of this that others are missing? Again, I'm not saying it's impossible that their intention was to deceive users, but as an engineer, I always favor proof over guessing.
  - trickstra 7y ago
    The IT guys in the industry know very well what constitutes an E2E encryption. Those two ends must be "trusted" which means it's either you yourself - your computer, or the other party which you want to talk to. Everything in between is third party and must get only encrypted data. If they redefine one of the "ends" as Zoom server, that's definitely intentional, blatant, and therefore fraudulent.
    - diggan 7y ago
      I'm not disagreeing that they are using E2E wrong, I fully agree with you there. But just because someone uses a word wrong doesn't give you any proof about their intentions. See https://news.ycombinator.com/item?id=22767447 https://news.ycombinator.com/item?id=22767447 for further elaboration on that point. Again, it's harmful to use words incorrectly, _especially_ when it comes to E2E, so they should rightly get flak for getting it wrong. You all seem to be so sure that it was intentional though, while I've seen the same problem so many times before in the industry without it being intentional. If you do have proof it's intentional, please share it with the rest of us so we can be on the same page.
- goatinaboat 7y ago
  It’s akin to VW putting claims to be emissions compliant in their ads.
stevenicr 7y ago
This bothers me so much - as I have personally recommended zoom to many people and customers. People that have likely seen that I spend an unusual amount of time focused on computer security, backups, and care in communications. If I remember correctly, zoom used to have on the front page - use this it's encrypted, and 'even used by us govt something-something' - so I assumed it was completely secure. I actually refused to use other conference services much to the bemoans of many clients who already had other 'goto' software installed, used and understood - and convinced them that in order to talk turkey we needed to use the real secure zoom system. It passed the smell test at the time for me because they also had paid plans which meant to me a legitimate business that did not need to slay privacy with ads and such, as they had a clear path to make money. Now they are tarnished, and my reputation with several clients and doctors and others may be as well - as this is getting mainstream press (I think that's a good thing actually) - I'm livid about this. I agree with below it is also fraud - and another commentator mentioned they changed to "your client connection is encrypted" is still deception imho. Needs a big asterisk and real explanation of the lack of privacy.
- tomcooks 7y ago
  Only recommend free software, this way you minimize reputation drama
  - criley2 7y ago
    Generally speaking, free software UX is so bad that I would never recommend it to most people I talk to because 1) I don't want to train them on it 2) I don't want to support them on it 3) It isn't good enough for them to use without 1-2 So I pick the shiny costly commercial version that comes with training and support. I mean, I've done the recommend my parents and older coworkers use difficult OSS software thing in my past, and I honestly regret it. No one won.
  - mmm_grayons 7y ago
    Sadly, my experience has been the opposite, because open-source stuff usually takes more work to run and is seldom as polished, and users hate that. I rarely, if ever, recommend open-source anything for end-user use. Zoom did well because it had the least hassle of any solution, hands-down. I'm not saying it's impossible to subscribe to a hosted open-source service that's as good, but it doesn't exist yet.

Not just "deceptive" nor "unlikely", it's blatant false advertising.

harry8 7y ago

Fraudulent is the word i would use.

diggan 7y ago
"Fraudulent", at least as far as I know, is reserved for "intentional deception". It could be that Zoom is indeed doing this intentionally, but without proof of it being intentional, I don't think we should assume so. insert Hanlons razor quote here
- deleted 7y ago
  [deleted]
- loup-vaillant 7y ago
  A company this prominent is unlikely to be that incompetent. Malice is more probable at this point, Hanlon's razor notwithstanding.
  - diggan 7y ago
    Eh, haven't large companies leaked private details from their customers time and time again, in basic ways like forgetting that they have backups on S3 buckets with zero protection? Being incompetent has nothing to do with the size or prominence of the company. Big/prominent companies fuck up/are sloppy all the time.
    - welfare 7y ago
      This is not a fuck up or negligence, Zoom deliberately used "end-to-end" with a completely different meaning than the rest of the world. I can't describe this as anything else than malicious and fraudulent. Their intention was to deceive users that the communication was encrypted, when in reality it wasn't.
      - diggan 7y ago
        I guess you don't have experience working in a company with a marketing team that feel they can buzzword things in without checking with IT teams then. I'm in no way saying it's impossible that Zoom did say E2E encryption while knowing that's not true, but I could imagine a scenario where a security person says "Yeah, we're encrypting connections to our backend" and a marketing person researching E2E and then saying to themselves "Yeah, sounds like we're doing E2E, let's write that", because this stuff happens all the time in the industry. > Their intention was to deceive users You sound so sure about their intentions, do you have any actual proof of this that others are missing? Again, I'm not saying it's impossible that their intention was to deceive users, but as an engineer, I always favor proof over guessing.
- trickstra 7y ago
  The IT guys in the industry know very well what constitutes an E2E encryption. Those two ends must be "trusted" which means it's either you yourself - your computer, or the other party which you want to talk to. Everything in between is third party and must get only encrypted data. If they redefine one of the "ends" as Zoom server, that's definitely intentional, blatant, and therefore fraudulent.
  - diggan 7y ago
    I'm not disagreeing that they are using E2E wrong, I fully agree with you there. But just because someone uses a word wrong doesn't give you any proof about their intentions. See https://news.ycombinator.com/item?id=22767447 https://news.ycombinator.com/item?id=22767447 for further elaboration on that point. Again, it's harmful to use words incorrectly, _especially_ when it comes to E2E, so they should rightly get flak for getting it wrong. You all seem to be so sure that it was intentional though, while I've seen the same problem so many times before in the industry without it being intentional. If you do have proof it's intentional, please share it with the rest of us so we can be on the same page.
goatinaboat 7y ago
It’s akin to VW putting claims to be emissions compliant in their ads.

stevenicr 7y ago

This bothers me so much - as I have personally recommended zoom to many people and customers. People that have likely seen that I spend an unusual amount of time focused on computer security, backups, and care in communications. If I remember correctly, zoom used to have on the front page - use this it's encrypted, and 'even used by us govt something-something' - so I assumed it was completely secure. I actually refused to use other conference services much to the bemoans of many clients who already had other 'goto' software installed, used and understood - and convinced them that in order to talk turkey we needed to use the real secure zoom system. It passed the smell test at the time for me because they also had paid plans which meant to me a legitimate business that did not need to slay privacy with ads and such, as they had a clear path to make money. Now they are tarnished, and my reputation with several clients and doctors and others may be as well - as this is getting mainstream press (I think that's a good thing actually) - I'm livid about this. I agree with below it is also fraud - and another commentator mentioned they changed to "your client connection is encrypted" is still deception imho. Needs a big asterisk and real explanation of the lack of privacy.

tomcooks 7y ago
Only recommend free software, this way you minimize reputation drama
- criley2 7y ago
  Generally speaking, free software UX is so bad that I would never recommend it to most people I talk to because 1) I don't want to train them on it 2) I don't want to support them on it 3) It isn't good enough for them to use without 1-2 So I pick the shiny costly commercial version that comes with training and support. I mean, I've done the recommend my parents and older coworkers use difficult OSS software thing in my past, and I honestly regret it. No one won.
- mmm_grayons 7y ago
  Sadly, my experience has been the opposite, because open-source stuff usually takes more work to run and is seldom as polished, and users hate that. I rarely, if ever, recommend open-source anything for end-user use. Zoom did well because it had the least hassle of any solution, hands-down. I'm not saying it's impossible to subscribe to a hosted open-source service that's as good, but it doesn't exist yet.