4 ms·

what is there to even say at this point. everyones mad at zoom; we hit critical volume for mob mentality and now no amount of discussion or reason matters. sho

what is there to even say at this point. everyones mad at zoom; we hit critical volume for mob mentality and now no amount of discussion or reason matters. should they have marketed it is e2e when sometimes its not? of course not, theyre wrong. do you fucking care? do you need more than one hand to count the number of products that are e2e encrypted? if you use the definition of e2e in the article, nothing apple does is e2e either. does anyone else that's not in tech even understand what encryption is at all, much less e2e? they use a shitty encryption scheme when they do e2e? theyre wrong and should do better. do you care? your threat model is that someone knows your meeting, is in place beforehand, intercepts the encryption, decodes it, and then spys on your conference? this couldn't be more of a penny-wise, pound-foolish scenario. why are we still talking about this. please stop

jamesaepp 7y ago
The problem for the mob rests on the fact that they advertise the system as being e2e, when it is not - at least with the definition I use for e2e. https://zoom.us/security https://zoom.us/security My rule-of-thumb (NOT A LITMUS TEST) for e2e is as follows: If you have exchanged the public or pre-shared key(s) with the partner(s) out-of-band OR you had your public key signed by a NEUTRAL (key word) third party who is mutually trusted, then yes - you are likely using e2e. If Zoom generated the keypairs, signed them, and transported the public keys themselves without an external independent library - I don't consider that e2e because they are the middle man every step along the way. Should we treat other companies the same way if they claim they use e2e but don't? Yes, absolutely. This situation is bittersweet, it's (a bit) unfair to Zoom, but hopefully this will spark healthy discussions around what e2e is and more importantly, what it is not.
endorphone 7y ago
Your post seems a little over the top. Millions are still using Zoom. Its shares are still trading at an enormous premium. The technical discussion is something altogether different, and people are allowed to have that, regardless of your consternation. And hopefully a better product comes out of it. "if you use the definition of e2e in the article, nothing apple does is e2e either" This bit of sad whataboutism is technical nonsense, though. No, Apple, and a number of other vendors, actually do this right. I honestly think Zoom's engineers, who have made a number of rudimentary serious technical blunders, thought "end-to-end encryption" meant "it's encrypted during every stage of transport". I've seen a number of companies make this mistake.
- Judgmentality 7y ago
  > I honestly think Zoom's engineers, who have made a number of rudimentary serious technical blunders, thought "end-to-end encryption" meant "it's encrypted during every stage of transport". I've seen a number of companies make this mistake. This means they're incompetent, full stop. I don't think that at all. I think the marketing team is just full of shit.
  - betterunix2 7y ago
    I think the engineers told the marketing team that they implemented E2E and the marketing ran with it. The same engineers who rolled their own crypto using ECB mode probably thought they were telling the truth. The marketing team probably asked if they had used blockchain too. Until recently they were just another a small company trying to build a customer base in a crowded market.
luckylion 7y ago
"They've been repeatedly caught doing terrible thing security wise, doing shady stuff in general, not caring / learning from their mistakes, lying about their product and then issuing overly specific statements that are designed to confuse. Why are we still talking about this?"
unreal37 7y ago
Yes absolutely. In this time of crisis, where every hour of every day brings a new horror, it's like this is the one thing we can all be mad at. Classic painting of the bike shed discussion.

jamesaepp 7y ago

The problem for the mob rests on the fact that they advertise the system as being e2e, when it is not - at least with the definition I use for e2e. https://zoom.us/security https://zoom.us/security My rule-of-thumb (NOT A LITMUS TEST) for e2e is as follows: If you have exchanged the public or pre-shared key(s) with the partner(s) out-of-band OR you had your public key signed by a NEUTRAL (key word) third party who is mutually trusted, then yes - you are likely using e2e. If Zoom generated the keypairs, signed them, and transported the public keys themselves without an external independent library - I don't consider that e2e because they are the middle man every step along the way. Should we treat other companies the same way if they claim they use e2e but don't? Yes, absolutely. This situation is bittersweet, it's (a bit) unfair to Zoom, but hopefully this will spark healthy discussions around what e2e is and more importantly, what it is not.

endorphone 7y ago

Your post seems a little over the top. Millions are still using Zoom. Its shares are still trading at an enormous premium. The technical discussion is something altogether different, and people are allowed to have that, regardless of your consternation. And hopefully a better product comes out of it. "if you use the definition of e2e in the article, nothing apple does is e2e either" This bit of sad whataboutism is technical nonsense, though. No, Apple, and a number of other vendors, actually do this right. I honestly think Zoom's engineers, who have made a number of rudimentary serious technical blunders, thought "end-to-end encryption" meant "it's encrypted during every stage of transport". I've seen a number of companies make this mistake.

Judgmentality 7y ago
> I honestly think Zoom's engineers, who have made a number of rudimentary serious technical blunders, thought "end-to-end encryption" meant "it's encrypted during every stage of transport". I've seen a number of companies make this mistake. This means they're incompetent, full stop. I don't think that at all. I think the marketing team is just full of shit.
- betterunix2 7y ago
  I think the engineers told the marketing team that they implemented E2E and the marketing ran with it. The same engineers who rolled their own crypto using ECB mode probably thought they were telling the truth. The marketing team probably asked if they had used blockchain too. Until recently they were just another a small company trying to build a customer base in a crowded market.

luckylion 7y ago

"They've been repeatedly caught doing terrible thing security wise, doing shady stuff in general, not caring / learning from their mistakes, lying about their product and then issuing overly specific statements that are designed to confuse. Why are we still talking about this?"

unreal37 7y ago

Yes absolutely. In this time of crisis, where every hour of every day brings a new horror, it's like this is the one thing we can all be mad at. Classic painting of the bike shed discussion.