5 ms·
The story here is that Zoom uses key distribution servers located in China (in addition to several servers in the USA) and that Chinese law might be compelling
by itcrowd 7y ago
The story here is that Zoom uses key distribution servers located in China (in addition to several servers in the USA) and that Chinese law might be compelling Zoom to disclose the encryption keys. I think it is a valid concern, but for me it also raises the question of whether this may also be required in the US.
In addition to letting the Chinese (and possibly US) government in on the encryption keys, the encryption scheme is also badly broken (ECB mode of AES). Prof. Matthew Green has written many articles about AES and encryption more generally and I recommend his blog if you are interested (even as a lay person).
https://blog.cryptographyengineering.com/2011/12/01/how-not-to-use-symmetric-encryption/ https://blog.cryptographyengineering.com/2011/12/01/how-not-...
- ComputerGuru 7y agoWho the hell still uses ECB?
- floathub 7y agoThat is truly amazing. I know precious little about encryption, but I assumed everyone knows that ECB is bad and that CBC is the only sensible way to do AES. [edited for typo]
- lawnchair_larry 7y agoYour first point is correct, second is definitely not.
- floathub 7y agoSee how precious little I know about encryption? And yet even I know that ECB is a terrible choice! (In minor defense of self, I should have said CBC or "later").
- reader_1000 7y agoHint: copy-pasters* * from internet or from old codebases of one’s company
- tych0 7y agoWikipedia has a great visualization of this for those who are curious: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Electronic_Codebook_(ECB) https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation...
- kerng 7y agoThey are using EBC mode? I don't know of a single crypto library that would pick that as a default, so someone actually made this decision (like actively lowered encryption capability). I thought of some of the previous issues of not being too bad, but this leaves me wondering...
- s_y_n_t_a_x 7y ago> but for me it also raises the question of whether this may also be required in the US The difference is the US is a democracy and Chinese Communist Party is an oppressive authoritarian regime. I do not do business or install apps based or ran out of China or any other bad state actor because I do not trust or support their government. The CPC is truly evil and any information they can harvest is a weapon in their hand. These people run concentration camps, harvest organs, and silence the people who talk ill of them. https://www.cnn.com/2018/10/10/asia/xinjiang-china-reeducation-camps-intl/index.html https://www.cnn.com/2018/10/10/asia/xinjiang-china-reeducati... https://nypost.com/2019/06/01/chinese-dissidents-are-being-executed-for-their-organs-former-hospital-worker-says/ https://nypost.com/2019/06/01/chinese-dissidents-are-being-e...
- dang 7y agoIf you keep taking HN threads further into political, nationalistic, or ideological flamewar, we are going to have to ban you. That's not because we agree or disagree. It's because such threads are predictable, therefore tedious, therefore boring, therefore off topic here. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- s_y_n_t_a_x 7y agoI'm really finding it hard to please this rule. Would it be okay to say just: > The difference is the US is a democracy and there are many more checks and balances vs the Chinese authoritarian government.
- dang 7y agoSure. I mean, it's not a particularly substantive comment but at least it gets the flamebait below whatever parts-per-million level should be the maximum here. I wouldn't have posted a moderation reply if you'd posted that instead.
- drevil-v2 7y agoDon’t forget the straight up lying about using 256bit keys when they are actually using 128bit keys