8 ms·

Zoom banned from New York City schools due to privacy and security flaws

• longcommonname 7y ago
  Rash decisions like this aren't going to do anything but hurt the students.
  • tw04 7y ago
    How is it a rash decision? There are multiple alternatives that respect privacy and do more than pay lip service to security.
    • contravariant 7y ago
      Although if I'm honest I wouldn't really know if the alternatives are going to be that much better. All alternatives that I know off still follows the same general pattern of letting all connections go through a central server where everyone with the right URL can participate. Sure I wouldn't trust a company that claims to have better security than they actually have and who add weird privacy violating features, but any of the common alternatives are by Microsoft and Google, which I don't trust either. So in the end I'm not sure what good will come of this decision, while it will definitely cause some confusion. It's possible I missed something and that Zoom truly is notably worse than any of the common alternatives. I'm partially posting this in the hopes that anyone can point out whether this is the case. And yes Zoom is definitely worse than a self hosted OSS solution like Jitsi (or even Jitsi without the self hosting) but we all know that that's not going to happen.
      • Spooky23 7y ago
        NYC schools have like a million students. How is jitsi going to scale to that?
        • __s 7y ago
          By having each school's IT setup a separate server School's have IT. It isn't always competent IT (I speak from experience), but clear instructions from up high can lead it
          • Spooky23 7y ago
            Or, you can flip a switch and enable Zoom, Google, or even Microsoft. IT people are hammered right now, nobody has time to futz around with some random oss tool that will further stress overutilized remote infrastructure.
          • godelski 7y ago
            While I believe this will work for NYC, I'm not sure how it'll work for Pumpkintown TN
            • Spooky23 7y ago
              Pumpkinland, TN will use Zoom. It’s exponentially easier, except for older kids already using Google Classroom.
              • godelski 7y ago
                That's kinda my point. That the IT in a major city can use a custom system but that discludes a lot of people. I would wager that most schools don't have a decent IT department. I know that when I was in high school they weren't great and I grew up in a fairly affluent area. Not everyone has the ability to "roll their own"
        • contravariant 7y ago
          It probably isn't, but one could hope. Edit: If I'm honest I'm not even sure how meet.jit.si can function at it's current scale. Especially because I've found no way to send them money.
          • fock 7y ago
      • eagsalazar2 7y ago
        Zoom is known to have at best been massively incompetent and at worst to have been grossly irresponsible and possibly malicious. Sure other solutions might be just as bad but that is hardly and argument against ditching Zoom immediately. If you've missed the many articles about their weirdly bad security you should definitely go read them.
        • contravariant 7y ago
          I saw those articles. Quite a few talked about how Zoom was weirdly insistent that they had end to end encryption (which they do not), and they added some disturbing privacy violating features to the desktop client which they're oddly pushy about, also their privacy statement wasn't exactly reassuring. All red flags, but strictly speaking they don't really impact the security much (they might do god knows what to the metadata, but to my knowledge, that's the same with most alternatives). The one truly sensitive issue is the zoombombing, and I haven't been able to figure out whether that's truly a security bug or if zoom is just the biggest attack surface and has some terrible default settings.
      • tw04 7y ago
        Zoom is notably worse. They rolled their own encryption and it's really, really bad. They also send keys through China even if none of the participants are in China. Questionable behavior even if they were perfect in every other way, which they aren't.
    • techntoke 7y ago
      Be careful, you are going up a Chinese-based company that will downvote anything negative and give excuses that most people won't know anything about.
      • eagsalazar2 7y ago
        Is this really happening? Lots of very reasonable comments are in fact getting downvoted. Because it is Chinese??? WTF? Are you saying this is a patriotism thing? Or are you saying either Zoom or Chinese organizations are paying people to downvote? Seriously this is bugging me. If this is going on on HN that is a serious violation. Normally HN seems like a sanctuary from crap like that.
        • loopz 7y ago
          Zoom seems popular, so many are willing to sacrifice principles for using something easy. Preconceptions are big everywhere, reinforced not fixed by mod points.
  • tjohns 7y ago
    It's not like there aren't other options out there they could be using. I'm sure this was factored into the decision given current events. At this point, I think it's more than fair to be worried about Zoom's security.
• hiisukun 7y ago
  I find it incredibly uncommon to see real repercussions (even temporary ones) resulting from cyber security failings of companies. In this case, some large part of the issue was in deceptive (at best) promotional material. Does that mean people understand messaging, even if they don't understand encryption? I'm sure many readers here have seen incredible breaches of trust and security, such as Equifax, go almost entirely without punishment. This is an interesting case in the opposite direction. It is worth noting for balance that Zoom does appear to have favoured usability, and successfully so.
  • Spooky23 7y ago
    I couldn’t imagine trying to get elementary kids using Teams... it’s way too convoluted.
• tictoc 7y ago
  What a fall from grace.
  • adrr 7y ago
    They 20x their users in one month. 10MM to 200MM
    • ashleshbiradar 7y ago
      yep, I come from a really small town in India, and I see everyone using Zoom suddenly, the mobile app is all over the town, all business meetings, family meetups, schools, everyone is using Zoom all of a sudden.
• crazygringo 7y ago
  Honestly this feels bizarrely knee-jerk and media-driven to me. First of all, Zoom has been used in education for a long time. The quote about switching to Teams because it's FERPA-compliant is disingenuous -- Zoom says they are too. [1] Second, Zoom has been receiving tons of scrutiny recently while e.g. Microsoft Teams hasn't received any. (Nor has Google Meet.) I'm really not sure how I feel about this. It's been hard enough already on teachers to adopt remote learning, now they're expected to switch platforms after a couple of weeks, presumably mostly because of sensationalistic media reports of "Zoombombing" which a teacher can trivially prevent? [1] https://zoom.us/docs/doc/FERPA%20Guide.pdf https://zoom.us/docs/doc/FERPA%20Guide.pdf
  • bilbo0s 7y ago
    To be fair, if naked men are zoombombing your class of schoolchildren? I mean, not a lot of teachers out there are equipped to deal with that. They fumble around looking for how to remove a participant. Some panic and try to kill the whole session for the entire class. Some call the cops while yelling at the man to leave. Some freeze up and don't know what to do. Maybe MS Teams is worse? But MS will, at least, make sure to keep the pedophiles and racists at bay.
    • deminature 7y ago
      It's incredibly straightforward to prevent zoombombing, you simply set a password on your room. I would be surprised if Zoom hadn't made this the default by Monday. Prior to the age of 'zoombombing', frictionless entry to every meeting was a nice feature, and meeting IDs are difficult enough to guess (11 digit number) that entry of uninvited guests basically never happened. Now that everyone has so much spare time, the worst elements of society are using it to try to harass children. I guess the tragedy of the commons kicks into full swing and we must have passwords going forward.
      • bilbo0s 7y ago
        Fine, but what's the number of times that a naked man zoombombs your class before you tell your school and they switch to Teams? These are schools we're talking about. That number is exactly one. Because I can guarantee you the kids are gonna tell their parents what they saw, and the parents are gonna light into the principal. Slow video? A few random disconnects? These are the kinds of issues that result in second chances. Random men showing up naked in your classfull of kids, or random racists coming in your class to call the black kid an n-word? Yeah, I'm fair certain that results in a, "Thanks, but no thanks. We'll find something else."
• koolba 7y ago
  Is there any browser based P2P web conferencing software? WebRTC seems like a perfect fit for this. Especially as in the suburbs students will almost certainly be on the same single broadband provider so the traffic will be local.
  • tehlike 7y ago
    Hangouts etc are using webrtc, but p2p doesn't scale beyond a few participants.
    • koolba 7y ago
      Not even to a standard 20-30 person class size? Surely there’s enough bidirectional bandwidth for a continuous audio feed and a token based video feed.
      • detaro 7y ago
        In my experience, WebRTC peer-to-peer solutions often struggle keeping a room of 15 in a state that everyone can hear everyone else. Many upstream connections are tiny, and the p2p session management tricks to get through NAT slightly wonky. And NYC is going to have many students with only a mobile phone plan or similarly bad internet (and a bunch with no internet at all, but that's another discussion). Efficient is important.
        • fock 7y ago
          did you ever try it with such a real low bandwidth connection? I somehow doubt that it's really that nice to transmit WQHD desktops as is... Also I don't really get the thing about a 30 person, all hands video-conference. The only thing coming out of that (on the average 1080p screen) is gratifying the host: "all these people show up, because of meeee" (and yeah, school kids could do whatever they want in an audio conference. but kids can do that also with zoom (unless you are spying on them with the integrated spyware...) and they also can sit through one session and then replay their face all the time...
• mrosett 7y ago
  I'm sensitive to complaints about Zoom's privacy/security shortcomings. I wouldn't have an important conversation on the platform. But Zoom clearly offers the best videoconferencing product along many dimensions: ease of use, quality of video, etc. Students are already receiving subpar instruction due to the unceremonious transition to remote learning by schools that clearly aren't prepared. So unless the privacy/security issues are actually impacting learning on a large scale, perhaps it makes more sense to stick with the product people are already using.
• thosmos 7y ago
  What are some good alternatives to Zoom that are actually true end-to-end encrypted? I know of one: https://www.crypho.com/ https://www.crypho.com/ and Crypho is offering free audio and video conferencing for the next 3 months due to Coronavirus demand.
  • upofadown 7y ago
    From the Crypho website: >Key management and encryption happens automatically. That implies that they could do MITM if they chose to do so because of the lack of a way to ensure you are actually talking to who you think you are talking to. If that is true then you still have to trust them and e2ee is in a sense pointless.
• deleted 7y ago
  [deleted]