7 ms·

Zoom! What are you doing?! > To be clear, in a meeting where all of the participants are using Zoom clients, and the meeting is not being recorded, we encrypt

Zoom! What are you doing?! > To be clear, in a meeting where all of the participants are using Zoom clients, and the meeting is not being recorded, we encrypt all video, audio, screen sharing, and chat content at the sending client, and do not decrypt it at any point before it reaches the receiving clients. That is still not what "end-to-end encryption" means. From wikipedia[1]: > End-to-end encryption (E2EE) is a system of communication where only the communicating users can read the messages. In principle, it prevents potential eavesdroppers – including telecom providers, Internet providers, and even the provider of the communication service – from being able to access the cryptographic keys needed to decrypt the conversation. The fact that it's possible to decrypt is what makes this not "end-to-end encryption". Personally, I am totally fine with their implementation, I just wish they'd stop misusing the term. For the vast majority of users, everything being encrypted over-the-wire coupled with a reasonable policy (eg, employees cannot listen in on random meetings) should be totally acceptable. If there are people that that actually needed true end-to-end encryption and choose Zoom based on their marketing saying they had it, without doing validation, that's on them (though they're probably right to be upset with Zoom, too, for being misleading). Frankly, that set of people shouldn't be choosing anything they don't control and trust completely (code, hosting, updates, etc) which pretty much rules out any SaaS, so I suspect this set doesn't actually exist in the first place. Bottom line: Don't call it "end-to-end encryption" if you have access to the keys and can decrypt, even if you choose not to. Market that you encrypt everything in transit, and that employees aren't allowed to access streams. Be realistic in the potential weak points (someone hijacking or able to modify the Zoom infrastructure, PSTN interconnects, non-Zoom clients, etc) and what you do to mitigate those risks. [1] https://en.wikipedia.org/wiki/End-to-end_encryption https://en.wikipedia.org/wiki/End-to-end_encryption

kreetx 7y ago
This. They really should look into what end-to-end encryption means. As the parent says, they can implement their app however they please, but they should get their feature list straight.
- TwoBit 7y ago
  Zoom knows exactly what end-to-end encryption means, and always has. Most likely their marketing group didn't like their engineering group telling them this nice buzzword didn't apply and intentionally chose to misuse it.
  - SkyPuncher 7y ago
    You see the exact same thing with HIPAA. "End-to-end" is often (incorrectly) used to simply describe SSL/TLS protection from web browser to server. Not technically wrong, but also not how most developers understand the term.
lern_too_spel 7y ago
> The fact that it's possible to decrypt is what makes this not "end-to-end encryption". By that definition, iMessage is also not end-to-end encrypted because Apple can decrypt the messages due to controlling the key servers and the relay servers, but few people bat an eye when Apple claims iMessage is end-to-end encrypted on its privacy marketing page. https://blog.cryptographyengineering.com/2013/06/26/can-apple-read-your-imessages/ https://blog.cryptographyengineering.com/2013/06/26/can-appl... https://www.apple.com/privacy/features/ https://www.apple.com/privacy/features/
- saagarjha 7y ago
  Oh, come on, that’s not the same thing at all. Here Zoom actively decrypts the stream so that it’s compatible with non-Zoom clients and then advertises it as end-to-end, a fault in the protocol itself, while you’re comparing it to (outdated, FYI) information where Apple could possibly decrypt messages if they sent out fake keys.
  - ThePowerOfFuet 7y ago
    It's not outdated; Apple still controls the key distribution and the users cannot verify how many recipient key sets there are.
    - saagarjha 7y ago
      For one, iMessage (and FaceTime) will now tell you if a new device is added.
      - dingo_bat 7y ago
        If you believe them.
  - lern_too_spel 7y ago
    > Oh, come on, that’s not the same thing at all. Here Zoom actively decrypts the stream so that it’s compatible with non-Zoom clients and then advertises it as end-to-end I took issue with a specific definition that precludes both products. I didn't say that both products use the same protocol. > you’re comparing it to (outdated, FYI) information Has the implementation changed in any way that makes it meet the definition? No? Then the information is not outdated for our purposes.
sameyepatch 7y ago
What I understand from that statement is that the data travels encrypted and each client does the encryption/decryption duty, not that they are able to decrypt the data at any point but decide not to. I guess that using "we" in their statement is a tad misleading and can make people arrive at conclusions. But that's just my point of view, it could still mean they can decrypt at any point. EDIT: Someone else made the point of the other channels that do not support Zoom's encryption. I read about it in the article but I did not put two and two together. I guess I spoke too soon, seems Zoom can decrypt data at will after all.
- uoaei 7y ago
  > What I understand from that statement is that the data travels encrypted and each client does the encryption/decryption duty, not that they are able to decrypt the data at any point but decide not to. Those two things are not mutually exclusive. It reads to me like they are implicitly acknowledging that client-side "private" security keys aren't really private but are also stored elsewhere in Zoom's system.
sneak 7y ago
> Zoom! What are you doing?! Continuing to lie. Did you expect differently from this malware company?

kreetx 7y ago

This. They really should look into what end-to-end encryption means. As the parent says, they can implement their app however they please, but they should get their feature list straight.

TwoBit 7y ago
Zoom knows exactly what end-to-end encryption means, and always has. Most likely their marketing group didn't like their engineering group telling them this nice buzzword didn't apply and intentionally chose to misuse it.
- SkyPuncher 7y ago
  You see the exact same thing with HIPAA. "End-to-end" is often (incorrectly) used to simply describe SSL/TLS protection from web browser to server. Not technically wrong, but also not how most developers understand the term.

lern_too_spel 7y ago

> The fact that it's possible to decrypt is what makes this not "end-to-end encryption". By that definition, iMessage is also not end-to-end encrypted because Apple can decrypt the messages due to controlling the key servers and the relay servers, but few people bat an eye when Apple claims iMessage is end-to-end encrypted on its privacy marketing page. https://blog.cryptographyengineering.com/2013/06/26/can-apple-read-your-imessages/ https://blog.cryptographyengineering.com/2013/06/26/can-appl... https://www.apple.com/privacy/features/ https://www.apple.com/privacy/features/

saagarjha 7y ago
Oh, come on, that’s not the same thing at all. Here Zoom actively decrypts the stream so that it’s compatible with non-Zoom clients and then advertises it as end-to-end, a fault in the protocol itself, while you’re comparing it to (outdated, FYI) information where Apple could possibly decrypt messages if they sent out fake keys.
- ThePowerOfFuet 7y ago
  It's not outdated; Apple still controls the key distribution and the users cannot verify how many recipient key sets there are.
  - saagarjha 7y ago
    For one, iMessage (and FaceTime) will now tell you if a new device is added.
    - dingo_bat 7y ago
      If you believe them.
- lern_too_spel 7y ago
  > Oh, come on, that’s not the same thing at all. Here Zoom actively decrypts the stream so that it’s compatible with non-Zoom clients and then advertises it as end-to-end I took issue with a specific definition that precludes both products. I didn't say that both products use the same protocol. > you’re comparing it to (outdated, FYI) information Has the implementation changed in any way that makes it meet the definition? No? Then the information is not outdated for our purposes.

sameyepatch 7y ago

What I understand from that statement is that the data travels encrypted and each client does the encryption/decryption duty, not that they are able to decrypt the data at any point but decide not to. I guess that using "we" in their statement is a tad misleading and can make people arrive at conclusions. But that's just my point of view, it could still mean they can decrypt at any point. EDIT: Someone else made the point of the other channels that do not support Zoom's encryption. I read about it in the article but I did not put two and two together. I guess I spoke too soon, seems Zoom can decrypt data at will after all.

uoaei 7y ago
> What I understand from that statement is that the data travels encrypted and each client does the encryption/decryption duty, not that they are able to decrypt the data at any point but decide not to. Those two things are not mutually exclusive. It reads to me like they are implicitly acknowledging that client-side "private" security keys aren't really private but are also stored elsewhere in Zoom's system.

sneak 7y ago

> Zoom! What are you doing?! Continuing to lie. Did you expect differently from this malware company?