3 ms·
Calling it a disaster.. I find the security community a bit tough against Zoom. They traded a bit of security in favor of useability? Fair enough. They failed
by tardyp 7y ago
Calling it a disaster.. I find the security community a bit tough against Zoom.
They traded a bit of security in favor of useability? Fair enough.
They failed to recognise AES-EDC can be attacked by very motivated cryptanalysts? Alright.
They gathered a little bit more data than they claim they did? Well, who is not doing that?
I think they proved they can be agile. They fixed a bunch of sec issues in few days, while growing their user base like 30x, in a shutdown period!
How many companies would be able to do that?
I am sure they will work in fixing all of those quickly.
E2EE will take a bit of time. Right. In the meantime, Zoom is working pretty darn well for talking with 10+ family and friends while everybody is contained. Do we need E2EE for that? probably not, but that is my choice.
- seemslegit 7y agoThat's AES-ECB, and it can be viewed by bored amateurs.
- tptacek 7y agoNo, it can't.
- seemslegit 7y agoWell, for simple enough protocols and bored enough amateurs
- saagarjha 7y ago> They traded a bit of security in favor of useability? Fair enough. No, that's not "fair enough". > They failed to recognise AES-EDC can be attacked by very motivated cryptanalysts? Alright. No "motivated cryptanalysts" have put time into looking at yet. > They gathered a little bit more data than they claim they did? Well, who is not doing that? People who care about your privacy? > I think they proved they can be agile. They proved they could fix things that they lied or were clearly shady as soon as the media got wind of it? > Do we need E2EE for that? probably not, but that is my choice. It is your choice, but you have the right to make an informed choice. Zoom lied and prevented people from doing this.
- worik 7y agoSarcasm does not really work on the Internet. See what I mean?