22 ms·

Zoom rolled their own encryption scheme, transmit keys through servers in China

1248 points by gasull 7y ago

gen3 7y ago
This is honestly the best “Zoom is bad” summery I’ve seen so far. While I certainly believe some of the Zoom hate is blown out of proportion, this article does a good job explaining to someone who isn't a security expert what the issues are. I've been getting questions about the company from family and friends, and will be forwarding this to them. Well done.
- jasonv 7y ago
  I think of it as a warning to future companies who take these kind of liberties...
  - thedudeabides5 7y ago
    I mean, isn't this stuff they can fix? Like good that the market is stressing them on their security, at $30bn they should be able to engage with that feedback and then loop. On the other hand, tried to use Skype lately? Product has barely evolved since they were bought out by MSFT. Guess google does videoconferencing too, but they know enough about us all already....
    - lutorm 7y ago
      They can fix the code, but would people trust them when they say that the code is fixed? Trust needs to be earned.
      - dividedbyzero 7y ago
        People trust them even though their security is broken. Lots of people don't know, lot don't care, quite a few probably don't get it anyway.
    - discordance 7y ago
      It’ll take a new CEO before people will trust them again, kind of like what happened at Uber.
      - Igelau 7y ago
        Who are you hoping picks up this little unit of opinion? Are you hoping to see it quoted, or just vaguely referred to as "growing discontent" and know that you were in there? Such a strangely extreme viewpoint to suddenly jump to.
  - matthewaveryusa 7y ago
    The warning being that it doesn't matter because it doesn't affect their share price right? So far I haven't seen any tangible damage to them when it comes to $$.
    - snazz 7y ago
      It's been a somewhat noticeable hit, but they're still doing great overall: https://www.google.com/search?q=zm+stock https://www.google.com/search?q=zm+stock
    - mbesto 7y ago
      Share price aside...it's the most reliable video conferencing app while others are crumbling to infrastructure pressure (UberConf, GotoMeeting, etc). Their downloads are through the roof right now: https://www.msn.com/en-us/news/technology/zoom-tops-weekly-download-charts/ar-BB124jNe https://www.msn.com/en-us/news/technology/zoom-tops-weekly-d...
    - jasonv 7y ago
      Let's see where they are in 6 or 12 month's time and what they go through to get there. Other nascent companies will tip their "We want to grow like Zoom" hat and it'll serve as a warning sign as to what the growth mentality is. Anyway, my point was... I don't think they've taken too much grief yet, for what they've done. They deserve all the lumps they're getting, and that may (hopefully) be instructive. [And yeah, there are always companies that do this kind of thing... some are Facebook, and some trip into a hole.]
      - amachefe 7y ago
        This sounds like Zoom hate, which I am seeing a lot nowadays. The irony is that it is coming from tech while the av Joe's doesn't really care.
- consonaut 7y ago
  This is a great article, but as an educational provider it fails to answer one question: Why should I care? The only concerning thing for me is, why would they lie about using AES-256 when none of my users (and I assume most of their users) would care in any way about AES-256 vs. AES-128 in ECB mode. Why would they lie? Even after this, having my users conducting university lessons over something that might be decrypted in China is honestly not that big of an issue. I would of course prefer it if these meetings would be private from the PRCs scrutiny but at least in my situation (and I think most educational contexts) this is not really that important.
  - basch 7y ago
    Because a company doing an RFP with a checklist of features is going to rank them against their competitors, and it would look bad in the spreadsheet.
    - consonaut 7y ago
      I assume this is your answer to "why would they lie?". It does not answer the question to why should an educational provider care though. And assuming I'll consider switching to webex the response to encryption in webex is this: https://www.webex.com/content/dam/Webex/eopi/Americas/USA/en_us/documents/pdf/security_Webex.pdf https://www.webex.com/content/dam/Webex/eopi/Americas/USA/en... Which 404's and basically represents my experience with Cisco: "We don't give a shit about you, you already payed us.". Frankly Webex could host the next coming of Jesus and I would not give them any more money.
      - google234123 7y ago
        lol, nice job finding a link that 404s and basing your entire argument on it. Here is another one for your next post: https://www.webex.com/sdvfebdwq3433t8hjaxcxqadxe https://www.webex.com/sdvfebdwq3433t8hjaxcxqadxe
        consonaut 7y ago
stefan_ 7y ago
Keynote: Zoom’s encryption and decryption use AES in ECB mode
- deleted 7y ago
  [deleted]
- ummonk 7y ago
  Jesus, that's a textbook example of a bad encryption mode.
  - cassalian 7y ago
    Makes you wonder how someone could approve that pull request...
    - gregcoombe 7y ago
      It's possible it comes from a corporate culture that is focused on ease-of-use over security. This is not the first time that they've done some questionable things to reduce friction. See for example https://www.theverge.com/2019/7/9/20688113/zoom-apple-mac-patch-vulnerability-emergency-fix-web-server-remove https://www.theverge.com/2019/7/9/20688113/zoom-apple-mac-pa..., where they installed a secret webserver to save Mac users a single click.
tibbydudeza 7y ago
Zoom just works great ... just focus on making a better product (aggh Google Hangouts) than hyping up the hysteria by adding China to the mix. It is rather suspicious to see all the articles of late.
- umeshunni 7y ago
  Nothing suspicious. Zoom is in the news lately, so there are more researchers and others looking at their security practices. Bloggers know that they'll get clicks by writing about Zoom. China is just thrown in since they're the Boogieman in the US these days.
remarkEon 7y ago
Is there any reasonable explanation for why this scheme was designed in this manner?
- rzimmerman 7y ago
  It's possible some protocol issues prohibit the use of other stream cipher modes like AES-GCM. I can't think of any but maybe: * Dropped packets/out of order packets. You should be able to include the IV/counter with the packet but maybe the protocol prohibits that. * Avoiding reusing counters between participants - seems like you could just use the participant ID as part of the counter and avoid this * Concerns about partial packet loss - shouldn't happen with UDP and GCM would handle this just as well I'm trying but I can't think of a good reason to do it this way.
- jonmartinwest 7y ago
  Maybe, it makes the "Ministry of State Security of the People's Republic of China" job easier? It would allow them to easily access lots of data.
dstroot 7y ago
Zoom deserves a lot of animosity for its privacy issues like sharing data with Facebook. On the other hand I am mystified by all the security hype. Yes I might be able to guess a Zoom meeting ID, just as if I might guess your phone number and prank call you. In a Zoom meeting you can see who is connected. In the old days of conference calls do you remember asking “who’s on the line?”. What are you talking about that requires encryption? If so there are tools for that - signal, etc.
- stordoff 7y ago
  > What are you talking about that requires encryption? The UK are using it for Cabinet meetings - https://www.bbc.co.uk/news/technology-52126534 https://www.bbc.co.uk/news/technology-52126534
  - NikolaeVarius 7y ago
    > In a crisis, communication at speed is the priority. And UK officials say the risks of not communicating in the middle of fast-moving events far outweigh the possible security risks of using such a system. They add most government work to do with the coronavirus is unclassified and anything highly classified is communicated over secure systems Government meetings use the paid-for version of the system and are password protected to prevent "Zoom-bombing", when uninvited individuals intrude on calls. The UK Ministry of Defence also said Zoom should not be used for classified conversations. And it is understood Nato's policy not to use Zoom for any meetings, briefings or conversations between member state ambassadors if classified or sensitive information is shared. Nato staff are understood to be using "more stable and secure" means of communication. ===== They seem to be perfectly well aware of their threat model
- ikiris 7y ago
  Oh please. They used the fb auth sdk without realizing the implications. That's hardly malicious just incompetent and rushed.
  - catalogia 7y ago
songshuu 7y ago
Could we fix the title of this post please? There is a GULF of difference between 'transmit keys through servers in China' and the actual text from the article, " We suspect that keys may be distributed through these servers." Implication is fine, but it should not be declarative without proof.
- dmitrygr 7y ago
  The article is quite direct: key directly sent to client in USA directly from a server in china. what is unclear?
  - songshuu 7y ago
    Have read the whole article myself, I did not see that explicitly stated. Could you provide the quote?
    - saagarjha 7y ago
      > In addition, we identify potential areas of concern in Zoom’s infrastructure, including observing the transmission of meeting encryption keys through China.
      - songshuu 7y ago
        Thanks! Indeed that was in their opener, but their clarifying statement is broader. FTA "We suspect that keys may be distributed through these servers. A company primarily catering to North American clients that sometimes distributes encryption keys through servers in China is potentially concerning, given that Zoom may be legally obligated to disclose these keys to authorities in China." "We suspect" is not the same as "we are certain".
        gregcoombe 7y ago
        They observed keys being transmitted to Chinese servers, which makes them to suspect that Zoom is distributing keys via these servers. They have worded this very carefully to avoid claiming something that they cannot confirm (distribution to multiple users).
013a 7y ago
> Zoom’s most recent SEC filing shows that the company (through its Chinese affiliates) employs at least 700 employees in China that work in “research and development.” Wow. What could all of these people possibly be doing? It can't be development and QA; what's going on over there?
- polishdude20 7y ago
  Machine learning on everyone's video feeds to make better deep fakes of common people? You get the face and the voice of people talking directly to the camera. You get the people who they constantly talk to so you know their relations. You know the content of what they are saying.
  - otachack 7y ago
    Deep fakes can only work for so long. When it becomes ubiquitous people will naturally learn that anything can be deep faked. We would need some process of verification, then.
- crazygringo 7y ago
  That's actually the most interesting fact about Zoom I feel like I've learned so far! Edit: I looked it up... thought it seemed crazy high but it obviously includes all the support staff too. So they might have only 300 engineers total, for example. I guess that's more reasonable. [1] "As of January 31, 2020, we had 2,532 full-time employees. Of these employees, 1,396 are in the United States and 1,136 are in our international locations." "We also operate research and development centers in China, employing more than 700 employees as of January 31, 2020." [1] https://investors.zoom.us/static-files/09a01665-5f33-4007-8e90-de02219886aa https://investors.zoom.us/static-files/09a01665-5f33-4007-8e...
  - 013a 7y ago
    Is "Support" traditionally categorized under research & development? Possibly enterprise support or solutions engineers?
- 7y ago
NikolaeVarius 7y ago
I really don't think this counts as rolling your own crypto. They just used a weak implementation of existing methods. No more rolling your own crypto than if I were to use DES.
- wrs 7y ago
  It's "rolling your own crypto", not "rolling your own encryption algorithm". That includes using "secure" low-level primitives incorrectly to build an insecure higher-level protocol. In this case, using ECB mode has been known for years (decades?) to be a bad move regardless of the underlying encryption algorithm. As the classic article says, if you type the letters A-E-S, you're doing it wrong.
  - Enginerrrd 7y ago
    Yeah, in fact, that is USUALLY the way people screw up and roll their own crypto.
- rzimmerman 7y ago
  I agree - all security is assembled from lower level primitives and can be insecure despite using good building blocks. AES (even AES-128) is a fine choice, ECB mode is even okay in some contexts, but using that a stream cipher is not appropriate.
  - noahtallen 7y ago
    Definitely. Some other places (I think Telegram iirc) do actually create their own encryption algorithms without using existing ones. That’s what I thought rolling your own crypto scheme was. If the problem with Zoom is that they chose a poor mode for the algorithm, why doesn’t the headline say that? Creating your own encryption algorithm is way worse. If rolling your own encryption scheme is just choosing what algorithm you use — every system does that. So it’s not headline worthy. :/ I get that zoom needs to make better choices, but the rhetoric around it has been pretty poor and unhelpful.
- Skunkleton 7y ago
rzimmerman 7y ago
Using AES in ECB mode is clearly a bad choice, but honestly it's not that horrible for high entropy data like compressed audio/video. I'm sure someone could prove me wrong one day, but it seems hard to extract any useful patterns out of compressed audio/video. It does check the box of "uses encryption" for regulatory reasons (while missing the intent). It's pretty egregious considering how easy this is to get right. The 128-bit key is not inherently wrong if they were rotating these out during the stream. That being said, there's no reason not to do it right and use a mode like GCM with a longer key - most hardware supports acceleration for AES-256 these days. It can actually be slower to use a 128-bit key on 64-bit systems. While I respect the decision not to disclose the waiting room vulnerability, it's pretty obvious what's going on given the context. They probably shouldn't have mentioned where the vulnerability is. I'm honestly surprised anyone with technical knowledge thought that Zoom was actually doing end-to-end encryption given how the software works. All of the video transcoding/downconversion is clearly happening on the server. Your client is not sending multiple compressed streams for varying connection bandwidths. That's the main reason a lot of people like Zoom - it actually works well with dozens or hundreds of participants.
- phendrenad2 7y ago
  Is compressed audio/video actually high-entropy (in the time domain) though?
  - rongenre 7y ago
    Compressed anything is high entropy
    - jldugger 7y ago
      Depends on the compression. Lossy compression discards a lot of noise vs the signal we care about and would in a sense reduce entropy.
    - sudosysgen 7y ago
      Untrue. Many performance trade-offs have to be made and the entropy has to vary drastically with time. See for example B-Frames vs I-frames in compressed video. Couple that with the very low entropy video conference data and bam.
maest 7y ago
Was this done in the interest of convenience, as most Zoom appologists have been clamining?
- api 7y ago
  This looks like either incompetence or intentionally weak crypto.
  - rzimmerman 7y ago
    I agree, it's probably lack of appropriate expertise. There are much more subtle and useful ways to make this intentionally weak (like subtle nonce reuse with GCM). Or just giving Chinese authorities access to the key like the article implies.
api 7y ago
Why can't people bother to construct a minimally secure encryption system given that there are so many good documents and code examples out there? I don't mean anything with ratcheting, forward secrecy, replay protection, nonce reuse resistance, or any other bells and whistles, just basic competent symmetric encryption without gaping holes or ridiculous bizarre design choices? It's not hard! (1) Generate 12 bytes of random nonce using a good secure random source, prepend to message. (2) Use nonce to initialize AES-GCM. (3) Run it through AES-GCM, append tag. (4) Done. That's not hard and it's secure enough for common use cases.
- rzimmerman 7y ago
  The only thing I can think if is that maybe the protocol Zoom is using precludes prepending the nonce due to the packet format. But surely there's some way to do this with packet counters and user IDs. It's possible this was an intermediate step but I'm really stretching for excuses here.
  - api 7y ago
    Yes you can construct an IV from other state, though it's not ideal. Another good fit might be modes designed for disk encryption as those are designed for cases where you can't pad (e.g. disk blocks). There's also AES-GCM-SIV and its relatives which construct the nonce from a MAC of the plaintext and technically do not require a separate IV, though if you don't use one any duplicate message will be obvious. Those are somewhat more complex but honestly even if you don't get those perfect it's almost definitely better than ECB.
- restingrobot 7y ago
  Or use TLS end to end like a normal company...
  - api 7y ago
    Yeah I wasn't saying that because it's obvious. I was just saying if you really want to DIY crypto it's not that hard to do better than dumb ECB.
dang 7y ago
The Intercept article about this has a thread here: https://news.ycombinator.com/item?id=22767807 https://news.ycombinator.com/item?id=22767807
bedros 7y ago
always wondered why zoom.us url not zoom.com which they both own. it's basically to give the perception it's US company and assumed trustworthy.
- huslage 7y ago
  It is a US company. It’s a US Public company.
AshamedCaptain 7y ago
Seriously, all people who are surprised about this type of news should really understand that most "successful" (as in, popular) tech/.com/SV "startups" these days are like this. If you "waste" time on the real important stuff such as a good design, user security, or the like, you will lose over to a competitor who didn't and therefore was able to spend more time on marketing. If you waste your time on user privacy you will be totally crushed by that competitor whose definition of "privacy" was "how much can I pester this user until he gives me access to his address book so I can spam his friends?". I don't think this is good. I think this is very sad. But it is what it is. I still remember the Whatsapp founders coming into the jabber mailing lists with "please let me configure my server"-type questions, for god's sake.
- herodotus 7y ago
  Agree, but I want to add something: the usability of Zoom is good, even for casual computer users. Strategically, they focussed on what they considered to be the things that would give them sales. Not saying it is good, but it certainly worked for them (at least until now).
  - sdoering 7y ago
    I agree. My SO ist currently studying from home due to the pandemic. A lot of professors and tutors use what they find first. There is no standard. She already had to use MS Teams, Slack, Jitsu and Zoom. Her take was that Zoom was by far the most usable tool. And most of her 20 years younger co-students agree. Sadly most people don't even know about the problematic status of Zoom. And if one tells them, most do not understand what's so problematic about that.
    - fossuser 7y ago
      Partly because it isn't really problematic for students and teachers that are trying to use VTC. When the alternatives don't work, it doesn't really matter how secure the alternatives are.
    - sneak 7y ago
thinkingemote 7y ago
On Ubuntu would installing Zoom via Snap be preferable than as a normal package when it comes to security / sandboxing, should the case be that they turn evil?
- stubish 7y ago
  Yes, that would be vastly preferable. Normally, the client would still have access to quite a bit (Lots of $HOME for example, minus security sensitive files). It would be possible for the packager to turn off that access too and completely lock it down, turning off those interfaces and providing a fake $HOME etc. A good reason for the packager to not be Zoom Corp, but getting a distribution license might be tricky.
daffy 7y ago
Is it possible to use Zoom on Linux from an ordinary user without sudo rights?
- nerdkid93 7y ago
  Use or install? I can run Zoom post installation without sudo.
  - daffy 7y ago
    Use. The only way I'm willing to use it is from a dedicated user that has access to nothing else. I don't want it installed in the system.
- a-nikolaev 7y ago
  I just downloaded their binary build and it worked without sudo (you need to run "ZoomLauncher" file). That being said, I did not get the impression of an easy to use app that "just works" (at least with my tiling window manager), things were confusing, clunky and rather idiosyncratic (e.g. sharing a screen was weird, and the whiteboard did not work).
  - daffy 7y ago
    Did you use it to talk to someone? I ran it too, but wanted to make sure it really works without being installed.
    - a-nikolaev 7y ago
      Yeah, I used it for calls, did not install anything.
jtdev 7y ago
Is it possible that China is actually gleaning foreign IP from Zoom customers?
- est 7y ago
  Is it possible that China is actually part of routable public Internet at all? Should ICANN give each assigned IP block a flag to indicate whether it's capitalist or communist, so vendors can connect more carefully?
HashThis 7y ago
Zoom has betrayed us all! Congress must require zoom to explain why they are sending encryption keys to China when all participants are USA citizens. Zoom is betraying USA citizens and their customers. We must pressure USA zoom execs to explain exactly why they are doing this.
dang 7y ago
Matthew Green's article on this is has a thread here: https://news.ycombinator.com/item?id=22771193 https://news.ycombinator.com/item?id=22771193 The Intercept article on it has a thread here: https://news.ycombinator.com/item?id=22767807 https://news.ycombinator.com/item?id=22767807 It's probably too much of a stretch to merge all these, because many comments are about specifics of those posts, and the ones that aren't are kind of generic and so maybe not worth merging anyway (https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=by%3Adang%20generic%20discussion&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...).
- Judgmentality 7y ago
  Hi dang, Thanks in advance for all your moderation efforts that make HN the site we all love to use on a regular basis. I'm curious if you've ever considered writing a blog post about some of the things you've learned from your years of moderation? You spend so much time on HN, you must have seen lots of patterns and have lots of insights on...well, everything that gets posted on HN to everybody that posts on HN. I'd genuinely be interested in reading it if you ever did. Cheers, a semi-anonymous HN user
  - Leary 7y ago
    While you wait for his response: https://www.newyorker.com/news/letter-from-silicon-valley/the-lonely-work-of-moderating-hacker-news https://www.newyorker.com/news/letter-from-silicon-valley/th...
    - threatofrain 7y ago
      I wonder how that approach can continue to make sense unless they hire more Lisp moderators.
      - dang 7y ago
        I don't understand your point but I relate to the idea of hiring more Lisp moderators.
pvijeh 7y ago
https://classicprogrammerpaintings.com/post/148027314949/we-rolled-our-own-crypto-pieter-bruegel-the https://classicprogrammerpaintings.com/post/148027314949/we-...
smsm42 7y ago
Looks like Zoom to video conference security is like Flash to web browser security.
tptacek 7y ago
The serverside key handling stuff is bad, but generally known (Zoom has features whose natural implementation require them to keep keys serverside). People are dunking on Zoom for rolling their own crypto and coming up with AES-128-ECB. This is also bad, but people should be aware that it's a lot more complicated than "you can see penguins through it". You can see penguins through an ECB-encrypted bitmap because discrete blocks of the bitmap image repeat, and thus have the same ciphertext, and these correspondences carry obvious meaning in a bitmap. The same is not automatically true of video or audio data with normal codecs. Aaron Toponce points out that sensor noise will likely scramble ECB ciphertexts, for instance. Colm MacCárthaigh makes an even more important point, which is that it's already very trick to reliably encrypt voice tracks, because common encoding and transmission techniques make them susceptible to traffic analysis. So, for instance, you can quickly find papers about exploiting silence suppression to make predictions about speech in an encrypted audio channel. The point here being, cryptanalytic attacks on ECB are unlikely to be anyone's first recourse. Obviously, the 128 bit AES key thing doesn't really have any practical impact. Designers should religiously avoid ECB mode, but the real danger of ECB is in interactive settings, where we as attackers get to induce plaintext patterns, and use chosen boundaries to isolate targeted ciphertext. Bulk video and audio transmission isn't that kind of interactive setting. You still don't want to read people saying that ECB is OK; it's bad. Essentially: it seems like Zoom's cryptography is bad, but not in a way that really matters compared to brochure-level badness of non-end-to-end-encryption.
- ghostpepper 7y ago
  As a total novice to crypto stuff, is there any way that someone with access to unencrypted audio/video from the sensor could work out some sort of "baseline" and then factor it into their cryptanalysis of encrypted content produced from the characterized sensor?
  - tptacek 7y ago
    I don't know audio well enough to answer this, but you can play with it directly; it took about 7 minutes for me to throw a trivial Go program together to AAC-encode a WAV of half a minute of speech; the only repeated 16-byte blocks I got were a couple runs of zeroes. The trick with ECB is that you're relying on 128-bit blocks of plaintext repeating with perfect alignment, and, to do anything useful with it, those repeats leaking useful information. In a bitmap image of a penguin, those repeats are easy: they're blocks of pixels of uniform color, and all ECB is doing is permuting their colors. That's less intuitively true of audio (where I'm not really seeing repeats at all, but, again, you should just play with it).
WheelsAtLarge 7y ago
"Zoom, a Silicon Valley-based company, appears to own three companies in China through which at least 700 employees are paid to develop Zoom’s software. This arrangement is ostensibly an effort at labor arbitrage: Zoom can avoid paying US wages while selling to US customers, thus increasing their profit margin. However, this arrangement may make Zoom responsive to pressure from Chinese authorities." I'm not here to defend zoom but any and all companies that can do this have and are doing the very same thing to minimize costs. It's not great but it's the expected way of managing a software company in 2020. It would be hard to do business otherwise. Whether it's good or bad that's a question that will need to be reexamined given the current situation.
awaythrower 7y ago
And this is why you don't use unproven apps that come out of nowhere simply because they are "popular."
deleted 7y ago
[deleted]
duxup 7y ago
>However, this arrangement may make Zoom responsive to pressure from Chinese authorities. Zoom doesn't even have to be responsive to pressure, just a developer has to be. And they live there so yah they'll be understandably responsive.
thesausageking 7y ago
Given Zoom is blocked in China, what reason is there for the main key server to be there? Even ignoring the appearances, for latency and the fault tolerance reasons, China is the last place you'd want to put it a critical server for an app used in the West.
- physicles 7y ago
  Zoom is no longer blocked in China.
badrabbit 7y ago
Just a pet-peeve here: I am well aware if the CCP and how they run things in China as well as their hostilities against the west. But sending traffic or anything to or through China in itself is not a security risk. If the data goes through the US and you are european, whatever protocol weakness exists should also worry you because of possible network and server-side adversaries in the US. "China" is a threat not a vulnerability is all I meant, and using it for hype-training seems dishonest. I've had meetings with people in different companies using webex,goto meeting,skype , zoom,teams and hangouts. I found hangouts to be the most worrysome with regards to privacy (not security). A lot of the issues that keep popping up about zoom this week might also apply to the others (looking at you webex!). Zoom became popular because you can see everyone's video all at once. They had a betterr product. Vulnerabilities don't make a product bad, how you handle them does! If anything, I would like someone to show me how the free security audit zoom received by the hype crowd this week does not make it a superior alternative (provided they continue patching it).
3xblah 7y ago
Just out of curiousity I decided to check for a particular representation on the Zoom website. There must be some "magic" in these words because so many tech companies use them. "We take security seriously and we are proud to exceed industry standards when it comes to your organizations communications." https://zoom.us/security https://zoom.us/security
someonehere 7y ago
Is there any validity to the claim from earlier in the week (comments here on HN) that they Have engineers based out of China and it’s essentially tied to the CCP?
737min 7y ago
A Chinese founder cooperating with Chinese government is not something to be critical about, there is different political perspective.
chvid 7y ago
If I were to design a video conference platform my focus would be usability, video quality, speed. Because those are the things that matters to end-users; if it gives up some security because there is a server somewhere that decrypts, converts and reencrypt the traffic then that is a trade-off but so be it if the goal is to create a popular widely used platform.
DeathArrow 7y ago
I didn't use Zoom. What advantages does it have over Microsoft Teams, Webex or Skype?
bitwize 7y ago
What'd I tell you? This is either malice, or sufficient incompetence as to be indistinguishable from malice.
heyguys 7y ago
I do not give a shit

1248 points by gasull 7y ago

gen3 7y ago

This is honestly the best “Zoom is bad” summery I’ve seen so far. While I certainly believe some of the Zoom hate is blown out of proportion, this article does a good job explaining to someone who isn't a security expert what the issues are. I've been getting questions about the company from family and friends, and will be forwarding this to them. Well done.

jasonv 7y ago
I think of it as a warning to future companies who take these kind of liberties...
- thedudeabides5 7y ago
  I mean, isn't this stuff they can fix? Like good that the market is stressing them on their security, at $30bn they should be able to engage with that feedback and then loop. On the other hand, tried to use Skype lately? Product has barely evolved since they were bought out by MSFT. Guess google does videoconferencing too, but they know enough about us all already....
  - lutorm 7y ago
    They can fix the code, but would people trust them when they say that the code is fixed? Trust needs to be earned.
    - dividedbyzero 7y ago
      People trust them even though their security is broken. Lots of people don't know, lot don't care, quite a few probably don't get it anyway.
  - discordance 7y ago
    It’ll take a new CEO before people will trust them again, kind of like what happened at Uber.
    - Igelau 7y ago
      Who are you hoping picks up this little unit of opinion? Are you hoping to see it quoted, or just vaguely referred to as "growing discontent" and know that you were in there? Such a strangely extreme viewpoint to suddenly jump to.
- matthewaveryusa 7y ago
  The warning being that it doesn't matter because it doesn't affect their share price right? So far I haven't seen any tangible damage to them when it comes to $$.
  - snazz 7y ago
    It's been a somewhat noticeable hit, but they're still doing great overall: https://www.google.com/search?q=zm+stock https://www.google.com/search?q=zm+stock
  - mbesto 7y ago
    Share price aside...it's the most reliable video conferencing app while others are crumbling to infrastructure pressure (UberConf, GotoMeeting, etc). Their downloads are through the roof right now: https://www.msn.com/en-us/news/technology/zoom-tops-weekly-download-charts/ar-BB124jNe https://www.msn.com/en-us/news/technology/zoom-tops-weekly-d...
  - jasonv 7y ago
    Let's see where they are in 6 or 12 month's time and what they go through to get there. Other nascent companies will tip their "We want to grow like Zoom" hat and it'll serve as a warning sign as to what the growth mentality is. Anyway, my point was... I don't think they've taken too much grief yet, for what they've done. They deserve all the lumps they're getting, and that may (hopefully) be instructive. [And yeah, there are always companies that do this kind of thing... some are Facebook, and some trip into a hole.]
    - amachefe 7y ago
      This sounds like Zoom hate, which I am seeing a lot nowadays. The irony is that it is coming from tech while the av Joe's doesn't really care.
consonaut 7y ago
This is a great article, but as an educational provider it fails to answer one question: Why should I care? The only concerning thing for me is, why would they lie about using AES-256 when none of my users (and I assume most of their users) would care in any way about AES-256 vs. AES-128 in ECB mode. Why would they lie? Even after this, having my users conducting university lessons over something that might be decrypted in China is honestly not that big of an issue. I would of course prefer it if these meetings would be private from the PRCs scrutiny but at least in my situation (and I think most educational contexts) this is not really that important.
- basch 7y ago
  Because a company doing an RFP with a checklist of features is going to rank them against their competitors, and it would look bad in the spreadsheet.
  - consonaut 7y ago
    I assume this is your answer to "why would they lie?". It does not answer the question to why should an educational provider care though. And assuming I'll consider switching to webex the response to encryption in webex is this: https://www.webex.com/content/dam/Webex/eopi/Americas/USA/en_us/documents/pdf/security_Webex.pdf https://www.webex.com/content/dam/Webex/eopi/Americas/USA/en... Which 404's and basically represents my experience with Cisco: "We don't give a shit about you, you already payed us.". Frankly Webex could host the next coming of Jesus and I would not give them any more money.
    - google234123 7y ago
      lol, nice job finding a link that 404s and basing your entire argument on it. Here is another one for your next post: https://www.webex.com/sdvfebdwq3433t8hjaxcxqadxe https://www.webex.com/sdvfebdwq3433t8hjaxcxqadxe
      - consonaut 7y ago

stefan_ 7y ago

Keynote: Zoom’s encryption and decryption use AES in ECB mode

deleted 7y ago
[deleted]
ummonk 7y ago
Jesus, that's a textbook example of a bad encryption mode.
- cassalian 7y ago
  Makes you wonder how someone could approve that pull request...
  - gregcoombe 7y ago
    It's possible it comes from a corporate culture that is focused on ease-of-use over security. This is not the first time that they've done some questionable things to reduce friction. See for example https://www.theverge.com/2019/7/9/20688113/zoom-apple-mac-patch-vulnerability-emergency-fix-web-server-remove https://www.theverge.com/2019/7/9/20688113/zoom-apple-mac-pa..., where they installed a secret webserver to save Mac users a single click.

tibbydudeza 7y ago

Zoom just works great ... just focus on making a better product (aggh Google Hangouts) than hyping up the hysteria by adding China to the mix. It is rather suspicious to see all the articles of late.

umeshunni 7y ago
Nothing suspicious. Zoom is in the news lately, so there are more researchers and others looking at their security practices. Bloggers know that they'll get clicks by writing about Zoom. China is just thrown in since they're the Boogieman in the US these days.

remarkEon 7y ago

Is there any reasonable explanation for why this scheme was designed in this manner?

rzimmerman 7y ago
It's possible some protocol issues prohibit the use of other stream cipher modes like AES-GCM. I can't think of any but maybe: * Dropped packets/out of order packets. You should be able to include the IV/counter with the packet but maybe the protocol prohibits that. * Avoiding reusing counters between participants - seems like you could just use the participant ID as part of the counter and avoid this * Concerns about partial packet loss - shouldn't happen with UDP and GCM would handle this just as well I'm trying but I can't think of a good reason to do it this way.
jonmartinwest 7y ago
Maybe, it makes the "Ministry of State Security of the People's Republic of China" job easier? It would allow them to easily access lots of data.

dstroot 7y ago

Zoom deserves a lot of animosity for its privacy issues like sharing data with Facebook. On the other hand I am mystified by all the security hype. Yes I might be able to guess a Zoom meeting ID, just as if I might guess your phone number and prank call you. In a Zoom meeting you can see who is connected. In the old days of conference calls do you remember asking “who’s on the line?”. What are you talking about that requires encryption? If so there are tools for that - signal, etc.

stordoff 7y ago
> What are you talking about that requires encryption? The UK are using it for Cabinet meetings - https://www.bbc.co.uk/news/technology-52126534 https://www.bbc.co.uk/news/technology-52126534
- NikolaeVarius 7y ago
  > In a crisis, communication at speed is the priority. And UK officials say the risks of not communicating in the middle of fast-moving events far outweigh the possible security risks of using such a system. They add most government work to do with the coronavirus is unclassified and anything highly classified is communicated over secure systems Government meetings use the paid-for version of the system and are password protected to prevent "Zoom-bombing", when uninvited individuals intrude on calls. The UK Ministry of Defence also said Zoom should not be used for classified conversations. And it is understood Nato's policy not to use Zoom for any meetings, briefings or conversations between member state ambassadors if classified or sensitive information is shared. Nato staff are understood to be using "more stable and secure" means of communication. ===== They seem to be perfectly well aware of their threat model
ikiris 7y ago
Oh please. They used the fb auth sdk without realizing the implications. That's hardly malicious just incompetent and rushed.
- catalogia 7y ago

songshuu 7y ago

Could we fix the title of this post please? There is a GULF of difference between 'transmit keys through servers in China' and the actual text from the article, " We suspect that keys may be distributed through these servers." Implication is fine, but it should not be declarative without proof.

dmitrygr 7y ago
The article is quite direct: key directly sent to client in USA directly from a server in china. what is unclear?
- songshuu 7y ago
  Have read the whole article myself, I did not see that explicitly stated. Could you provide the quote?
  - saagarjha 7y ago
    > In addition, we identify potential areas of concern in Zoom’s infrastructure, including observing the transmission of meeting encryption keys through China.
    - songshuu 7y ago
      Thanks! Indeed that was in their opener, but their clarifying statement is broader. FTA "We suspect that keys may be distributed through these servers. A company primarily catering to North American clients that sometimes distributes encryption keys through servers in China is potentially concerning, given that Zoom may be legally obligated to disclose these keys to authorities in China." "We suspect" is not the same as "we are certain".
      - gregcoombe 7y ago
        They observed keys being transmitted to Chinese servers, which makes them to suspect that Zoom is distributing keys via these servers. They have worded this very carefully to avoid claiming something that they cannot confirm (distribution to multiple users).

013a 7y ago

> Zoom’s most recent SEC filing shows that the company (through its Chinese affiliates) employs at least 700 employees in China that work in “research and development.” Wow. What could all of these people possibly be doing? It can't be development and QA; what's going on over there?

polishdude20 7y ago
Machine learning on everyone's video feeds to make better deep fakes of common people? You get the face and the voice of people talking directly to the camera. You get the people who they constantly talk to so you know their relations. You know the content of what they are saying.
- otachack 7y ago
  Deep fakes can only work for so long. When it becomes ubiquitous people will naturally learn that anything can be deep faked. We would need some process of verification, then.
crazygringo 7y ago
That's actually the most interesting fact about Zoom I feel like I've learned so far! Edit: I looked it up... thought it seemed crazy high but it obviously includes all the support staff too. So they might have only 300 engineers total, for example. I guess that's more reasonable. [1] "As of January 31, 2020, we had 2,532 full-time employees. Of these employees, 1,396 are in the United States and 1,136 are in our international locations." "We also operate research and development centers in China, employing more than 700 employees as of January 31, 2020." [1] https://investors.zoom.us/static-files/09a01665-5f33-4007-8e90-de02219886aa https://investors.zoom.us/static-files/09a01665-5f33-4007-8e...
- 013a 7y ago
  Is "Support" traditionally categorized under research & development? Possibly enterprise support or solutions engineers?
7y ago

NikolaeVarius 7y ago

I really don't think this counts as rolling your own crypto. They just used a weak implementation of existing methods. No more rolling your own crypto than if I were to use DES.

wrs 7y ago
It's "rolling your own crypto", not "rolling your own encryption algorithm". That includes using "secure" low-level primitives incorrectly to build an insecure higher-level protocol. In this case, using ECB mode has been known for years (decades?) to be a bad move regardless of the underlying encryption algorithm. As the classic article says, if you type the letters A-E-S, you're doing it wrong.
- Enginerrrd 7y ago
  Yeah, in fact, that is USUALLY the way people screw up and roll their own crypto.
rzimmerman 7y ago
I agree - all security is assembled from lower level primitives and can be insecure despite using good building blocks. AES (even AES-128) is a fine choice, ECB mode is even okay in some contexts, but using that a stream cipher is not appropriate.
- noahtallen 7y ago
  Definitely. Some other places (I think Telegram iirc) do actually create their own encryption algorithms without using existing ones. That’s what I thought rolling your own crypto scheme was. If the problem with Zoom is that they chose a poor mode for the algorithm, why doesn’t the headline say that? Creating your own encryption algorithm is way worse. If rolling your own encryption scheme is just choosing what algorithm you use — every system does that. So it’s not headline worthy. :/ I get that zoom needs to make better choices, but the rhetoric around it has been pretty poor and unhelpful.
Skunkleton 7y ago

rzimmerman 7y ago

Using AES in ECB mode is clearly a bad choice, but honestly it's not that horrible for high entropy data like compressed audio/video. I'm sure someone could prove me wrong one day, but it seems hard to extract any useful patterns out of compressed audio/video. It does check the box of "uses encryption" for regulatory reasons (while missing the intent). It's pretty egregious considering how easy this is to get right. The 128-bit key is not inherently wrong if they were rotating these out during the stream. That being said, there's no reason not to do it right and use a mode like GCM with a longer key - most hardware supports acceleration for AES-256 these days. It can actually be slower to use a 128-bit key on 64-bit systems. While I respect the decision not to disclose the waiting room vulnerability, it's pretty obvious what's going on given the context. They probably shouldn't have mentioned where the vulnerability is. I'm honestly surprised anyone with technical knowledge thought that Zoom was actually doing end-to-end encryption given how the software works. All of the video transcoding/downconversion is clearly happening on the server. Your client is not sending multiple compressed streams for varying connection bandwidths. That's the main reason a lot of people like Zoom - it actually works well with dozens or hundreds of participants.

phendrenad2 7y ago
Is compressed audio/video actually high-entropy (in the time domain) though?
- rongenre 7y ago
  Compressed anything is high entropy
  - jldugger 7y ago
    Depends on the compression. Lossy compression discards a lot of noise vs the signal we care about and would in a sense reduce entropy.
  - sudosysgen 7y ago
    Untrue. Many performance trade-offs have to be made and the entropy has to vary drastically with time. See for example B-Frames vs I-frames in compressed video. Couple that with the very low entropy video conference data and bam.

maest 7y ago

Was this done in the interest of convenience, as most Zoom appologists have been clamining?

api 7y ago
This looks like either incompetence or intentionally weak crypto.
- rzimmerman 7y ago
  I agree, it's probably lack of appropriate expertise. There are much more subtle and useful ways to make this intentionally weak (like subtle nonce reuse with GCM). Or just giving Chinese authorities access to the key like the article implies.

api 7y ago

Why can't people bother to construct a minimally secure encryption system given that there are so many good documents and code examples out there? I don't mean anything with ratcheting, forward secrecy, replay protection, nonce reuse resistance, or any other bells and whistles, just basic competent symmetric encryption without gaping holes or ridiculous bizarre design choices? It's not hard! (1) Generate 12 bytes of random nonce using a good secure random source, prepend to message. (2) Use nonce to initialize AES-GCM. (3) Run it through AES-GCM, append tag. (4) Done. That's not hard and it's secure enough for common use cases.

rzimmerman 7y ago
The only thing I can think if is that maybe the protocol Zoom is using precludes prepending the nonce due to the packet format. But surely there's some way to do this with packet counters and user IDs. It's possible this was an intermediate step but I'm really stretching for excuses here.
- api 7y ago
  Yes you can construct an IV from other state, though it's not ideal. Another good fit might be modes designed for disk encryption as those are designed for cases where you can't pad (e.g. disk blocks). There's also AES-GCM-SIV and its relatives which construct the nonce from a MAC of the plaintext and technically do not require a separate IV, though if you don't use one any duplicate message will be obvious. Those are somewhat more complex but honestly even if you don't get those perfect it's almost definitely better than ECB.
restingrobot 7y ago
Or use TLS end to end like a normal company...
- api 7y ago
  Yeah I wasn't saying that because it's obvious. I was just saying if you really want to DIY crypto it's not that hard to do better than dumb ECB.

dang 7y ago

The Intercept article about this has a thread here: https://news.ycombinator.com/item?id=22767807 https://news.ycombinator.com/item?id=22767807

bedros 7y ago

always wondered why zoom.us url not zoom.com which they both own. it's basically to give the perception it's US company and assumed trustworthy.

huslage 7y ago
It is a US company. It’s a US Public company.

AshamedCaptain 7y ago

Seriously, all people who are surprised about this type of news should really understand that most "successful" (as in, popular) tech/.com/SV "startups" these days are like this. If you "waste" time on the real important stuff such as a good design, user security, or the like, you will lose over to a competitor who didn't and therefore was able to spend more time on marketing. If you waste your time on user privacy you will be totally crushed by that competitor whose definition of "privacy" was "how much can I pester this user until he gives me access to his address book so I can spam his friends?". I don't think this is good. I think this is very sad. But it is what it is. I still remember the Whatsapp founders coming into the jabber mailing lists with "please let me configure my server"-type questions, for god's sake.

herodotus 7y ago
Agree, but I want to add something: the usability of Zoom is good, even for casual computer users. Strategically, they focussed on what they considered to be the things that would give them sales. Not saying it is good, but it certainly worked for them (at least until now).
- sdoering 7y ago
  I agree. My SO ist currently studying from home due to the pandemic. A lot of professors and tutors use what they find first. There is no standard. She already had to use MS Teams, Slack, Jitsu and Zoom. Her take was that Zoom was by far the most usable tool. And most of her 20 years younger co-students agree. Sadly most people don't even know about the problematic status of Zoom. And if one tells them, most do not understand what's so problematic about that.
  - fossuser 7y ago
    Partly because it isn't really problematic for students and teachers that are trying to use VTC. When the alternatives don't work, it doesn't really matter how secure the alternatives are.
  - sneak 7y ago

thinkingemote 7y ago

On Ubuntu would installing Zoom via Snap be preferable than as a normal package when it comes to security / sandboxing, should the case be that they turn evil?

stubish 7y ago
Yes, that would be vastly preferable. Normally, the client would still have access to quite a bit (Lots of $HOME for example, minus security sensitive files). It would be possible for the packager to turn off that access too and completely lock it down, turning off those interfaces and providing a fake $HOME etc. A good reason for the packager to not be Zoom Corp, but getting a distribution license might be tricky.

daffy 7y ago

Is it possible to use Zoom on Linux from an ordinary user without sudo rights?

nerdkid93 7y ago
Use or install? I can run Zoom post installation without sudo.
- daffy 7y ago
  Use. The only way I'm willing to use it is from a dedicated user that has access to nothing else. I don't want it installed in the system.
a-nikolaev 7y ago
I just downloaded their binary build and it worked without sudo (you need to run "ZoomLauncher" file). That being said, I did not get the impression of an easy to use app that "just works" (at least with my tiling window manager), things were confusing, clunky and rather idiosyncratic (e.g. sharing a screen was weird, and the whiteboard did not work).
- daffy 7y ago
  Did you use it to talk to someone? I ran it too, but wanted to make sure it really works without being installed.
  - a-nikolaev 7y ago
    Yeah, I used it for calls, did not install anything.

jtdev 7y ago

Is it possible that China is actually gleaning foreign IP from Zoom customers?

est 7y ago
Is it possible that China is actually part of routable public Internet at all? Should ICANN give each assigned IP block a flag to indicate whether it's capitalist or communist, so vendors can connect more carefully?

HashThis 7y ago

Zoom has betrayed us all! Congress must require zoom to explain why they are sending encryption keys to China when all participants are USA citizens. Zoom is betraying USA citizens and their customers. We must pressure USA zoom execs to explain exactly why they are doing this.

dang 7y ago

Matthew Green's article on this is has a thread here: https://news.ycombinator.com/item?id=22771193 https://news.ycombinator.com/item?id=22771193 The Intercept article on it has a thread here: https://news.ycombinator.com/item?id=22767807 https://news.ycombinator.com/item?id=22767807 It's probably too much of a stretch to merge all these, because many comments are about specifics of those posts, and the ones that aren't are kind of generic and so maybe not worth merging anyway (https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=by%3Adang%20generic%20discussion&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...).

Judgmentality 7y ago
Hi dang, Thanks in advance for all your moderation efforts that make HN the site we all love to use on a regular basis. I'm curious if you've ever considered writing a blog post about some of the things you've learned from your years of moderation? You spend so much time on HN, you must have seen lots of patterns and have lots of insights on...well, everything that gets posted on HN to everybody that posts on HN. I'd genuinely be interested in reading it if you ever did. Cheers, a semi-anonymous HN user
- Leary 7y ago
  While you wait for his response: https://www.newyorker.com/news/letter-from-silicon-valley/the-lonely-work-of-moderating-hacker-news https://www.newyorker.com/news/letter-from-silicon-valley/th...
  - threatofrain 7y ago
    I wonder how that approach can continue to make sense unless they hire more Lisp moderators.
    - dang 7y ago
      I don't understand your point but I relate to the idea of hiring more Lisp moderators.

pvijeh 7y ago

https://classicprogrammerpaintings.com/post/148027314949/we-rolled-our-own-crypto-pieter-bruegel-the https://classicprogrammerpaintings.com/post/148027314949/we-...

smsm42 7y ago

Looks like Zoom to video conference security is like Flash to web browser security.

tptacek 7y ago

The serverside key handling stuff is bad, but generally known (Zoom has features whose natural implementation require them to keep keys serverside). People are dunking on Zoom for rolling their own crypto and coming up with AES-128-ECB. This is also bad, but people should be aware that it's a lot more complicated than "you can see penguins through it". You can see penguins through an ECB-encrypted bitmap because discrete blocks of the bitmap image repeat, and thus have the same ciphertext, and these correspondences carry obvious meaning in a bitmap. The same is not automatically true of video or audio data with normal codecs. Aaron Toponce points out that sensor noise will likely scramble ECB ciphertexts, for instance. Colm MacCárthaigh makes an even more important point, which is that it's already very trick to reliably encrypt voice tracks, because common encoding and transmission techniques make them susceptible to traffic analysis. So, for instance, you can quickly find papers about exploiting silence suppression to make predictions about speech in an encrypted audio channel. The point here being, cryptanalytic attacks on ECB are unlikely to be anyone's first recourse. Obviously, the 128 bit AES key thing doesn't really have any practical impact. Designers should religiously avoid ECB mode, but the real danger of ECB is in interactive settings, where we as attackers get to induce plaintext patterns, and use chosen boundaries to isolate targeted ciphertext. Bulk video and audio transmission isn't that kind of interactive setting. You still don't want to read people saying that ECB is OK; it's bad. Essentially: it seems like Zoom's cryptography is bad, but not in a way that really matters compared to brochure-level badness of non-end-to-end-encryption.

ghostpepper 7y ago
As a total novice to crypto stuff, is there any way that someone with access to unencrypted audio/video from the sensor could work out some sort of "baseline" and then factor it into their cryptanalysis of encrypted content produced from the characterized sensor?
- tptacek 7y ago
  I don't know audio well enough to answer this, but you can play with it directly; it took about 7 minutes for me to throw a trivial Go program together to AAC-encode a WAV of half a minute of speech; the only repeated 16-byte blocks I got were a couple runs of zeroes. The trick with ECB is that you're relying on 128-bit blocks of plaintext repeating with perfect alignment, and, to do anything useful with it, those repeats leaking useful information. In a bitmap image of a penguin, those repeats are easy: they're blocks of pixels of uniform color, and all ECB is doing is permuting their colors. That's less intuitively true of audio (where I'm not really seeing repeats at all, but, again, you should just play with it).

WheelsAtLarge 7y ago

"Zoom, a Silicon Valley-based company, appears to own three companies in China through which at least 700 employees are paid to develop Zoom’s software. This arrangement is ostensibly an effort at labor arbitrage: Zoom can avoid paying US wages while selling to US customers, thus increasing their profit margin. However, this arrangement may make Zoom responsive to pressure from Chinese authorities." I'm not here to defend zoom but any and all companies that can do this have and are doing the very same thing to minimize costs. It's not great but it's the expected way of managing a software company in 2020. It would be hard to do business otherwise. Whether it's good or bad that's a question that will need to be reexamined given the current situation.

awaythrower 7y ago

And this is why you don't use unproven apps that come out of nowhere simply because they are "popular."

deleted 7y ago

[deleted]

duxup 7y ago

>However, this arrangement may make Zoom responsive to pressure from Chinese authorities. Zoom doesn't even have to be responsive to pressure, just a developer has to be. And they live there so yah they'll be understandably responsive.

thesausageking 7y ago

Given Zoom is blocked in China, what reason is there for the main key server to be there? Even ignoring the appearances, for latency and the fault tolerance reasons, China is the last place you'd want to put it a critical server for an app used in the West.

physicles 7y ago
Zoom is no longer blocked in China.

badrabbit 7y ago

Just a pet-peeve here: I am well aware if the CCP and how they run things in China as well as their hostilities against the west. But sending traffic or anything to or through China in itself is not a security risk. If the data goes through the US and you are european, whatever protocol weakness exists should also worry you because of possible network and server-side adversaries in the US. "China" is a threat not a vulnerability is all I meant, and using it for hype-training seems dishonest. I've had meetings with people in different companies using webex,goto meeting,skype , zoom,teams and hangouts. I found hangouts to be the most worrysome with regards to privacy (not security). A lot of the issues that keep popping up about zoom this week might also apply to the others (looking at you webex!). Zoom became popular because you can see everyone's video all at once. They had a betterr product. Vulnerabilities don't make a product bad, how you handle them does! If anything, I would like someone to show me how the free security audit zoom received by the hype crowd this week does not make it a superior alternative (provided they continue patching it).

3xblah 7y ago

Just out of curiousity I decided to check for a particular representation on the Zoom website. There must be some "magic" in these words because so many tech companies use them. "We take security seriously and we are proud to exceed industry standards when it comes to your organizations communications." https://zoom.us/security https://zoom.us/security

someonehere 7y ago

Is there any validity to the claim from earlier in the week (comments here on HN) that they Have engineers based out of China and it’s essentially tied to the CCP?

737min 7y ago

A Chinese founder cooperating with Chinese government is not something to be critical about, there is different political perspective.

chvid 7y ago

If I were to design a video conference platform my focus would be usability, video quality, speed. Because those are the things that matters to end-users; if it gives up some security because there is a server somewhere that decrypts, converts and reencrypt the traffic then that is a trade-off but so be it if the goal is to create a popular widely used platform.

DeathArrow 7y ago

I didn't use Zoom. What advantages does it have over Microsoft Teams, Webex or Skype?

bitwize 7y ago

What'd I tell you? This is either malice, or sufficient incompetence as to be indistinguishable from malice.

heyguys 7y ago

I do not give a shit