4 ms·

Zoom still claims ability to “secure a meeting with end-to-end encryption”

62 points by tonyztan 7y ago

empressplay 7y ago
Fake it 'till you make it!
- flattone 7y ago
  Or possibly ‘lie till you die’
- mladen5 7y ago
  And when you make it there is no reason fix anything
franciscop 7y ago
The website does not just say "end-to-end" and leave it open to interpretation. It goes into some detail of how it works: > End-to-End Chat Encryption allows for a secured communication where only the intended recipient can read the secured message. Zoom uses both asymmetric and symmetric algorithms to encrypt the chat session. Session keys are generated with a device-unique hardware ID to avoid data being read from other devices. This contradicts their previous statement[1] that end-to-end encryption means from the client to the browser. Surely the "recipient" of the communication is not zoom, but the other person you are talking to, right? [1] https://theintercept.com/2020/03/31/zoom-meeting-encryption/ https://theintercept.com/2020/03/31/zoom-meeting-encryption/
- kerng 7y ago
  Your comment above mentions chat encryption- not video..
  - franciscop 7y ago
    You are right, then my case is weaker since they do not define video end-to-end encryption explicitly. But still this shows that they do know what end-to-end encryption means as opposed to what was claimed previously.
    - kerng 7y ago
      Correct - but it also shows that they continue to actively mislead people.
- upofadown 7y ago
  I can't find that previous statement from Zoom in the linked article. They actually said things were encrypted from end point to end point. The article itself speculated that they actually meant server to server but in light of subsequent testing that is probably wrong.
kerng 7y ago
They are behind with their responses, what about the ECB usage? https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/ https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto... That by itself might render encryption claims from Zoom as meaningless.
upofadown 7y ago
It appears that the stuff about there only being TLS as far as the servers is wrong. There is encryption and it goes all the way to the ends. That's all you need these days to claim e2ee it seems. It doesn't matter that the company making the claim can easily decrypt the data. It's all a black box all the way down to the closed source clients. This whole discussion seems kind of pointless. Crap is crap.
slovenlyrobot 7y ago
Entirely shoot from the hip comment, but at this point I feel it's warranted.. What is with all the Zoom hate? The company have been around for a decade, enjoyed relatively mediocre success until the outbreak of Covid, and suddenly apparently since they're experiencing huge demand and press coverage, every man and his dog is finding reasons to write a blog post complaining about them. I've read some article splitting hairs over the nuances of "end to end encryption" and how Zoom is so horrible, evil and wrong because they, like almost every telecommunication provider under the sun, can intercept your calls. What makes Zoom so special? What's driving all this hate? Because it's a far more interesting question than what technical flaws Zoom, or any other product in this category, almost certainly suffer from. Has someone done any security analysis of Houseparty? It's experienced surge growth in the same period. But in the time I've seen maybe 20 Zoom-hate articles on HN I haven't seen a single mention of Houseparty. What about Google Hangouts: is it "end"-to-"end" "encrypted"? What about its recording feature? Where are the articles? Where is all the hate? Why?
- KZeillmann 7y ago
  It's probably because HN is a particularly privacy-focused community and Zoom's privacy policy is a bit more questionable than other companies
  - slovenlyrobot 7y ago
    This could have been true except probably half of HN have an Android phone in their pocket. So this, like with Android and Google Play Services, is a case study in perception management. Suddenly the perception of Zoom seems to be forced in a particular direction. My paranoid 4 glasses of wine self can believe nothing other than money being involved.
- ccktlmazeltov 7y ago
  short sellers
- Waterluvian 7y ago
  The real question is why doesn't everyone go after other companies with this much rigor too?

62 points by tonyztan 7y ago

empressplay 7y ago

Fake it 'till you make it!

flattone 7y ago
Or possibly ‘lie till you die’
mladen5 7y ago
And when you make it there is no reason fix anything

franciscop 7y ago

The website does not just say "end-to-end" and leave it open to interpretation. It goes into some detail of how it works: > End-to-End Chat Encryption allows for a secured communication where only the intended recipient can read the secured message. Zoom uses both asymmetric and symmetric algorithms to encrypt the chat session. Session keys are generated with a device-unique hardware ID to avoid data being read from other devices. This contradicts their previous statement[1] that end-to-end encryption means from the client to the browser. Surely the "recipient" of the communication is not zoom, but the other person you are talking to, right? [1] https://theintercept.com/2020/03/31/zoom-meeting-encryption/ https://theintercept.com/2020/03/31/zoom-meeting-encryption/

kerng 7y ago
Your comment above mentions chat encryption- not video..
- franciscop 7y ago
  You are right, then my case is weaker since they do not define video end-to-end encryption explicitly. But still this shows that they do know what end-to-end encryption means as opposed to what was claimed previously.
  - kerng 7y ago
    Correct - but it also shows that they continue to actively mislead people.
upofadown 7y ago
I can't find that previous statement from Zoom in the linked article. They actually said things were encrypted from end point to end point. The article itself speculated that they actually meant server to server but in light of subsequent testing that is probably wrong.

kerng 7y ago

They are behind with their responses, what about the ECB usage? https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/ https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto... That by itself might render encryption claims from Zoom as meaningless.

upofadown 7y ago

It appears that the stuff about there only being TLS as far as the servers is wrong. There is encryption and it goes all the way to the ends. That's all you need these days to claim e2ee it seems. It doesn't matter that the company making the claim can easily decrypt the data. It's all a black box all the way down to the closed source clients. This whole discussion seems kind of pointless. Crap is crap.

slovenlyrobot 7y ago

Entirely shoot from the hip comment, but at this point I feel it's warranted.. What is with all the Zoom hate? The company have been around for a decade, enjoyed relatively mediocre success until the outbreak of Covid, and suddenly apparently since they're experiencing huge demand and press coverage, every man and his dog is finding reasons to write a blog post complaining about them. I've read some article splitting hairs over the nuances of "end to end encryption" and how Zoom is so horrible, evil and wrong because they, like almost every telecommunication provider under the sun, can intercept your calls. What makes Zoom so special? What's driving all this hate? Because it's a far more interesting question than what technical flaws Zoom, or any other product in this category, almost certainly suffer from. Has someone done any security analysis of Houseparty? It's experienced surge growth in the same period. But in the time I've seen maybe 20 Zoom-hate articles on HN I haven't seen a single mention of Houseparty. What about Google Hangouts: is it "end"-to-"end" "encrypted"? What about its recording feature? Where are the articles? Where is all the hate? Why?

KZeillmann 7y ago
It's probably because HN is a particularly privacy-focused community and Zoom's privacy policy is a bit more questionable than other companies
- slovenlyrobot 7y ago
  This could have been true except probably half of HN have an Android phone in their pocket. So this, like with Android and Google Play Services, is a case study in perception management. Suddenly the perception of Zoom seems to be forced in a particular direction. My paranoid 4 glasses of wine self can believe nothing other than money being involved.
ccktlmazeltov 7y ago
short sellers
Waterluvian 7y ago
The real question is why doesn't everyone go after other companies with this much rigor too?