4 ms·

No. "End-to-end encryption" does not protect metadata necessary to route the data over a network, just the contents of the communication. The clients could nego

No. "End-to-end encryption" does not protect metadata necessary to route the data over a network, just the contents of the communication. The clients could negotiate keys to protect the contents of a meeting end-to-end. In other words, Zoom servers could deduce who was speaking, when they spoke, and for how long, but not what they said. Your internet service provider can deduce the same about your HTTPS connections.

deleted 7y ago
[deleted]
IshKebab 7y ago
> The clients could negotiate keys to protect the contents of a meeting end-to-end. Not really because Zoom makes fairly extensive use of the decrypted video streams on their servers, e.g. to detect who is talking, pause video for people with slow connections, etc. You could maybe do it for meetings with a few people in, but good luck doing it for meetings with 100 people. Hell the cryptography of group end-to-end encryption hasn't really been worked out yet. WhatsApp doesn't do it and that's just for text. I'm pretty sure Signal doesn't either. There's really nothing bad with not having end-to-end encryption for group video conferencing apps. The shitty thing is that they pretended that they did.
- dwaite 7y ago
  > Not really because Zoom makes fairly extensive use of the decrypted video streams on their servers, e.g. to detect who is talking, pause video for people with slow connections, etc. You could maybe do it for meetings with a few people in, but good luck doing it for meetings with 100 people. You encrypt audio and video streams separately. If your connection is slow you stop grabbing the video stream. Detecting who is talking is a local function because you are receiving audio packets from them. Encryption doesn't have to change the amount of data sent. > Hell the cryptography of group end-to-end encryption hasn't really been worked out yet. WhatsApp doesn't do it and that's just for text. I'm pretty sure Signal doesn't either. Two ways: 1. Your password does not need to be shared with Zoom for entry into the meeting room. That password and the meeting room number are converted into a symmetric encryption key, so everyone who is able to join the meeting successfully has the same group shared secret for both sending and receiving video and audio. 2. You have an invitation system where the host of the meeting approves people. This approval causes the symmetric key of the meeting to be shared with the person seeking approval, encrypted to their public key. People who can supply a proof of possession of the password or whose public keys were associated with the meeting get invited without requiring confirmation by the host, although the participants in the room becomes a log of who was able to view the meeting. These get harder if you want to say have a periodic key rotation while a meeting is going, for sure. They also get harder if you try to encrypt routing metadata or disguise that the traffic is audio/video in general. The real thing that kills E2E for a corporate product like Zoom are the phone dial-ins. Hardly a point for all that security if you have one person calling in having the now unencrypted voice traffic bounced all over the place. > There's really nothing bad with not having end-to-end encryption for group video conferencing apps. The shitty thing is that they pretended that they did. 100% agreed within Zoom's market because of integration of external services like dial-in/dial-out voice.
  - iguy 7y ago
    I presume they also resize video, so that you download small streams for thumbnails, plus a bigger one for the main view. If it's just two sizes you could do it before uploading, but this would be harder if it's actually 10 different qualities.
    - genocidicbunny 7y ago
      Zoom also has a feature that lets people join a meeting by phone. There's no way they could do that without being able to access the unencrypted stream.
- sneak 7y ago
  All communication via Signal is e2e. They have not shipped anything that does not.
- unicornwizard 7y ago
  > WhatsApp doesn't do it and that's just for text. I'm pretty sure Signal doesn't either. Wow this is news to me. Glad I'm not using whatsapp since forever. Signal definitely encrypts group chats since forever: https://signal.org/blog/the-new-textsecure/ https://signal.org/blog/the-new-textsecure/
  - IshKebab 7y ago
    Turns out I was wrong about that - might have been true in the past but it is e2e now.
- alexhutcheson 7y ago
  > Hell the cryptography of group end-to-end encryption hasn't really been worked out yet. WhatsApp doesn't do it and that's just for text. That doesn't seem to be accurate: https://faq.whatsapp.com/en/android/28030015/ https://faq.whatsapp.com/en/android/28030015/ Maybe you're thinking of this issue?: https://medium.com/@haniahshafi/are-whatsapp-group-chats-vulnerable-to-spying-despite-end-to-end-encryption-ab0e522fa8d9 https://medium.com/@haniahshafi/are-whatsapp-group-chats-vul...

deleted 7y ago

[deleted]

IshKebab 7y ago

> The clients could negotiate keys to protect the contents of a meeting end-to-end. Not really because Zoom makes fairly extensive use of the decrypted video streams on their servers, e.g. to detect who is talking, pause video for people with slow connections, etc. You could maybe do it for meetings with a few people in, but good luck doing it for meetings with 100 people. Hell the cryptography of group end-to-end encryption hasn't really been worked out yet. WhatsApp doesn't do it and that's just for text. I'm pretty sure Signal doesn't either. There's really nothing bad with not having end-to-end encryption for group video conferencing apps. The shitty thing is that they pretended that they did.

dwaite 7y ago
> Not really because Zoom makes fairly extensive use of the decrypted video streams on their servers, e.g. to detect who is talking, pause video for people with slow connections, etc. You could maybe do it for meetings with a few people in, but good luck doing it for meetings with 100 people. You encrypt audio and video streams separately. If your connection is slow you stop grabbing the video stream. Detecting who is talking is a local function because you are receiving audio packets from them. Encryption doesn't have to change the amount of data sent. > Hell the cryptography of group end-to-end encryption hasn't really been worked out yet. WhatsApp doesn't do it and that's just for text. I'm pretty sure Signal doesn't either. Two ways: 1. Your password does not need to be shared with Zoom for entry into the meeting room. That password and the meeting room number are converted into a symmetric encryption key, so everyone who is able to join the meeting successfully has the same group shared secret for both sending and receiving video and audio. 2. You have an invitation system where the host of the meeting approves people. This approval causes the symmetric key of the meeting to be shared with the person seeking approval, encrypted to their public key. People who can supply a proof of possession of the password or whose public keys were associated with the meeting get invited without requiring confirmation by the host, although the participants in the room becomes a log of who was able to view the meeting. These get harder if you want to say have a periodic key rotation while a meeting is going, for sure. They also get harder if you try to encrypt routing metadata or disguise that the traffic is audio/video in general. The real thing that kills E2E for a corporate product like Zoom are the phone dial-ins. Hardly a point for all that security if you have one person calling in having the now unencrypted voice traffic bounced all over the place. > There's really nothing bad with not having end-to-end encryption for group video conferencing apps. The shitty thing is that they pretended that they did. 100% agreed within Zoom's market because of integration of external services like dial-in/dial-out voice.
- iguy 7y ago
  I presume they also resize video, so that you download small streams for thumbnails, plus a bigger one for the main view. If it's just two sizes you could do it before uploading, but this would be harder if it's actually 10 different qualities.
  - genocidicbunny 7y ago
    Zoom also has a feature that lets people join a meeting by phone. There's no way they could do that without being able to access the unencrypted stream.
sneak 7y ago
All communication via Signal is e2e. They have not shipped anything that does not.
unicornwizard 7y ago
> WhatsApp doesn't do it and that's just for text. I'm pretty sure Signal doesn't either. Wow this is news to me. Glad I'm not using whatsapp since forever. Signal definitely encrypts group chats since forever: https://signal.org/blog/the-new-textsecure/ https://signal.org/blog/the-new-textsecure/
- IshKebab 7y ago
  Turns out I was wrong about that - might have been true in the past but it is e2e now.
alexhutcheson 7y ago
> Hell the cryptography of group end-to-end encryption hasn't really been worked out yet. WhatsApp doesn't do it and that's just for text. That doesn't seem to be accurate: https://faq.whatsapp.com/en/android/28030015/ https://faq.whatsapp.com/en/android/28030015/ Maybe you're thinking of this issue?: https://medium.com/@haniahshafi/are-whatsapp-group-chats-vulnerable-to-spying-despite-end-to-end-encryption-ab0e522fa8d9 https://medium.com/@haniahshafi/are-whatsapp-group-chats-vul...