13 ms·

Zoom sued for overstating, not disclosing privacy, security flaws

391 points by laurex 7y ago

deleted 7y ago
[deleted]
tmpynews 7y ago
Will be interesting if Zoom is compelled to disclose their security architecture. On the same page can they be forced, in court, to make a statement on the interference by the Chinese government?
- xenonite 7y ago
  on the latter issue: a company can not speak for each individual employee.
  - xenonite 7y ago
    I don't get why this is downvoted? Maybe I was too concise. Then: even if the company may say what they do, the company cannot check and tell what each employee does. This doesn't have to be a malicious intent of the employee, but it can be.
- tensor 7y ago
  What interference by the Chinese government?
- dontbenebby 7y ago
  Is having keys compelled a surprise? Chinese servers, operating in China legally, will usually have this issue. It's serious yes, but I'm confused if it only applied to users in China? I'm more concerned about the technical issues TBH - I assume most software sanctioned in China had to turn over keys.
  - fnord123 7y ago
    Seeing as encryption is illegal in China, I don't think they will need to give up any keys.
    - gruez 7y ago
      >Seeing as encryption is illegal in China Source for this? That would make any https site in china illegal.
      - kube-system 7y ago
        Not an expert, but I searched and found this link which seems to explain it well: https://www.freshfields.com/en-us/our-thinking/campaigns/digital/data/china-rules-on-encryption/ https://www.freshfields.com/en-us/our-thinking/campaigns/dig... tl;dr: encryption is not completely illegal, but it sounds like it's pretty tightly controlled.
        dontbenebby 7y ago
        I didn't think they'd be foolish enough to completely ban it. They're not comically evil, they just have certain incentives. Key escrow meets those goals.
      - fnord123 7y ago
        I'm sorry, I was wrong. It requires a license from the State Encryption Management Commission: http://www.cryptolaw.org/cls2.htm#prc http://www.cryptolaw.org/cls2.htm#prc I am not a lawyer nor a cryptography expert who can advise whether licenses are granted easily or whether they are revoked if you fall out of favour.
- bdowling 7y ago
  If the lawsuit gets past the pleadings stage, then relevant information would be subject to discovery. So the plaintiffs would be able to get and use that info in court, but Zoom would probably ask the judge for a protective order so that it doesn’t become public.
whoisjohnkid 7y ago
Not surprising. Crazy how zoom in the beginning of the crisis was hailed for helping folks get together, but now with all the highlighted security concerns they are receiving a ton backlash. Hopefully they can recover and learn from this.
- runawaybottle 7y ago
  I’m more shocked that this massive tech industry has like one decent solution to remote video conferencing. Maybe we really have gone too far down the road of making bullshit apps, and stopped solving real problems. Shame on us.
  - kevin_thibedeau 7y ago
    Shame on the telcos who prevent residential customers from using the internet as intended. If everyone was given an IPV6 address block and freedom to accept outside connections from anywhere, none of this would be an issue.
    - cat199 7y ago
      agree on telcos preventing ppl from using internet as intended, but we'd still need good and easy to use videoconferencing software
    - meowface 7y ago
      >freedom to accept outside connections from anywhere Without NAT from home gateways (like consumer routers) preventing inbound connections from the internet, security would be far more of a nightmare than it is today. Requiring that people manually forward specific ports is the best way to handle it. We would be seeing news about Blaster-like worms pretty much every week of the past 20 years, otherwise. Also, even if it were a good idea, this still wouldn't solve the problem at all. The NAT-traversing capability of Zoom and other products is like 0.01% of the value they provide. You still need good software.
  - icelancer 7y ago
    MS Teams is pretty good, but it's Microsoft so people aren't using it as much. Which is understandable.
encoderer 7y ago
Blows my mind that a shareholder might have a cause of action for this. 1) Buy volatile stock with recent IPO 2) Sue them for their volatility 3) ?????
- tlbsofware 7y ago
  > Zoom documentation claims that the app uses “AES-256” encryption for meetings where possible. However, we find that in each Zoom meeting, a single AES-128 key is used in ECB mode by all participants to encrypt and decrypt audio and video. The use of ECB mode is not recommended because patterns present in the plaintext are preserved during encryption. https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/ https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto...
  - toomuchtodo 7y ago
    You know, I had never considered being a shareholder and using said standing to sue a company into security best practices when they lie about it, considering regulation has failed to create the appropriate incentives.
    - tlbsofware 7y ago
      Neither have I, but figured I’d link this since it is more than likely why they are suing
  - shanemhansen 7y ago
    Oh wow. ECB mode? That's horrifying.
    - fnord123 7y ago
      For those that don't know much about encryption, here is an example image for why ECB mode is trash: https://i.stack.imgur.com/bXAUL.png https://i.stack.imgur.com/bXAUL.png
cft 7y ago
This culture of biting the feeding hand has to stop somewhere.
- xenonite 7y ago
  Well no, the shareholder is the feeding hand, giving money. Actually, Zoom is accused of misbehaving and biting the feeding hand. And yes, this shouldn't have happened.
judge2020 7y ago
Note that the lawsuit is a class action for shareholders of Zoom stock. Filing: https://i.judge.sh/natural/Babs/1-main.pdf https://i.judge.sh/natural/Babs/1-main.pdf
- ship_it 7y ago
  Interesting that shareholders are the one to fill a lawsuit.
  - toomuchtodo 7y ago
    "Everything everywhere is securities fraud." [1] -- Matt Levine, Money Stuff [1] https://www.bloomberg.com/opinion/articles/2019-06-26/everything-everywhere-is-securities-fraud https://www.bloomberg.com/opinion/articles/2019-06-26/everyt...
  - elliekelly 7y ago
    In the US lying to users is merely frowned upon while lying to investors is illegal.
    - gpm 7y ago
      False advertising of services (amongst other things) is illegal in the US. https://www.law.cornell.edu/uscode/text/15/52#b https://www.law.cornell.edu/uscode/text/15/52#b
      - elliekelly 7y ago
        Yes, just this week the FTC brought a tech company to justice for false and misleading promises to users about information security: > “We allege that Tapplock promised that its Internet-connected locks were secure, but in fact the company failed to even test if that claim was true,” said Andrew Smith, Director of the FTC’s Bureau of Consumer Protection. “Tech companies should remember the basics—when you promise security, you need to deliver security.”[1] Armed with clear and indisputable evidence of Tapplock's blatant lies, the bulldog enforcement lawyers at the FTC took the opportunity to make an example out of the company. After 18 months of hard-fought negotiations the FTC announced a settlement agreement[2] whereby the Commission agreed to resolve the matter in exchange for Tapplock's pinky promise to not get caught doing that again. Per the arduous terms of the settlement, Tapplock neither admits nor denies any of the FTC's allegations. So when a company promises their users security that company better deliver security. Or else... absolutely fuckall will happen. [1]https://www.ftc.gov/news-events/press-releases/2020/04/canadian-maker-smart-locks-settles-ftc-allegations-it-deceived https://www.ftc.gov/news-events/press-releases/2020/04/canad... [2]https://www.ftc.gov/system/files/documents/cases/192_3011_tapplock_agreement_containing_consent_order.pdf https://www.ftc.gov/system/files/documents/cases/192_3011_ta...
sandov 7y ago
Does it count as lying when it's ridiculously obvious that you're lying?
- smolder 7y ago
  Yes, and it's not so obvious to almost everyone.
- runawaybottle 7y ago
  Well, I mean, I’m sure it was a throw in claim made for sales. Sales is always a little sleazy. I just don’t think the company expected ... you know, the whole world to be using their product. Sleazy got caught :p
- ajayyy 7y ago
  No, but this is not obvious. Vitamin water claims that excuse and I don't believe they should either.
pjc50 7y ago
It's a bit odd how everyone's attacking Zoom when none of the other common solutions have proper e2e encryption either.
- cblades 7y ago
  Do the other common solutions claim to have e2e encryption?
  - Wowfunhappy 7y ago
    Yeah. The problem here is that Zoom lied about it. And, like, why? Sure, if no one ever caught them, e2e could be a reason to choose Zoom—but it's like lying on a resumé. Which, I guess is also a thing that happens sometimes, but it's generally understood to be a bad idea.
    - UncleMeat 7y ago
      Because it was clearly botched marketing material rather than a coordinated plan. Hypothetical: somebody asked an engineer what kind of encryption Zoom used, the engineer responded somewhat vaguely and the marketing person heard "we encrypt between endpoints" as "end to end encryption" and then nobody noticed when reviewing the text.
      - m4r35n357 7y ago
        Yeah right, oops
        UncleMeat 7y ago
        Yes it definitely is an "oops". I'm not excusing it, but offering an alternative explanation to the "zoom is evil" thinking. If zoom was truly trying to market themselves as e2e, why is this only buried in one document rather than shouted from the hills?
        7y ago
fock 7y ago
my employer currently signs up for zoom, apparently managed via our SSO-solution. so far so good. Right now, I got an email from Zoom, not showing any relation to my employer or mentioning its name: "congratulations for signup, use your account now". Ok. Password reset yields an usable basic account. Seems like somehow Zoom created a personal account for me with my work email. As I didn't get the activation email I got on my private spam-account, I assume somehow they got/requested all the employees email-adresses and automatically created private accounts, not related to the actual business acc.. What the actual f* is that?!? And yeah, I think conceptually this is the same behavior as shown by the ad/malware/spam campaigns ca. 2003. I wonder what had happened if I had just typed a password when signing in with my account... Maybe they just grab the passwords of the illiterate users and check them by trying to login with the university website? (that's sooo userfriendly!)
- jamiequint 7y ago
  I set up Zoom for our company and nothing like this happened. It seems much more likely (than your wild conspiracy theory) that your company added a "basic", rather than "licensed" account for you and you got an email as a result.
  - fock 7y ago
    no, don't know what kind of mess they made; the official login is via SSO (and works with <companyname>.zoom.us). to my understanding the account is typically created on login there (otherwise we would sync our whole list of employees with 100s of services...). and even if it was just a random invitation sent to an email they bought somewhere, it doesn't really explain how I could reset the password for my email then (without ever activating an account)?! It might be a messup from someone but it's definitely strange and I just didn't sign up there, yet got spam and had a working basic account...
    - jamiequint 7y ago
      > otherwise we would sync our whole list of employees with 100s of services Could also have been created with SCIM and you're in a particular SCIM group that other folks are not in.
pastullo 7y ago
Am i the only one struggling to use Zoom properly since they introduced the latest security changes? The slack integration (write /zoom to start a meeting) was working ok-ish even though we always had problem with the meeting not starting unless the host of the meeting was logged in (gosh...why so complicated?) Now they added this waiting room, there is no sound notification to let you know that people are waiting. Doing daily standup become a sufference. It's crazy how quickly they lost us as users with literally two badly implemented features. Happy to hear if any of you also had the same struggle and if there is a good alternative.
- Wowfunhappy 7y ago
  Maybe set a (strong) password instead of using the waiting room?
- studmuffin650 7y ago
  I think most of these are settings that can be changed in the advanced settings menu. Zoom changed the defaults, but you can still change the settings to what you prefer them to be
- proverbialbunny 7y ago
  For our daily standup we use meet.google.com as it's more convenient than ZOOM. ymmv ofc
  - Wowfunhappy 7y ago
    My company has been trying to find a solution since the Coronavirus hit. (We're not used to working from home) We were using Slack's built-in conferencing at first, but aside from the quality being generally bad, there was a 15 person limit, and we're ~ 17 people. I didn't want us to use Zoom with everything that's going on, so I suggested Google Meet. We tried it, and it worked, but not well—people's voices would frequently break up and become hard to hear. And so we tried Zoom this past Monday. It was incredible. I could actually hear and see everyone. I'm not happy about all their issues, but damn their product is just really good.
crazygringo 7y ago
I don't think this is likely to succeed -- Zoom can argue that the stock price has gone down because of "Zoombombing" and security/privacy concerns that have nothing to do with exact details of what was disclosed in privacy/security documents, which barely anyone reads anyways. Also, it's awfully hard to argue losing shareholder value when the stock has still more than doubled in the end -- Zoom can easily make the plausible-enough case that it made the right tradeoffs in the end for shareholder value that allowed it to scale. (I'm not saying that's true, just that it's plausible.) Could it be fined by the SEC for misstating key details in their public filing? Maybe, although these are tiny details. But a class-action suit by shareholders? This feels like a stunt to me. Also, since a suit by shareholders could depress the stock price further, this feels like a short-seller trying to profit, no?
- JumpCrisscross 7y ago
  > Zoom can argue that the stock price has gone down because... Two general steps to a securities suit. First, show the company defrauded investors. That can be as simple as omitting or mis-stating material information. (Zoom publicly claimed to use certain encryption standards that it didn't.) So the battle, here, will be around materiality. Critically, this step does not typically require proving damages. Once materiality is met, the second step is showing damages. At this point, the change in (and attribution of) stock prices comes into play. Once fraud is shown, the company is in a bad place. Even if a particular investor faced no discernible loss, everyone who bought at higher prices will now sue. It also invites state and federal investigators to start pursuing management and senior staff. > this feels like a short-seller trying to profit, no? No. You have to disclose your positions when entering into a shareholder lawsuit. Shareholder lawsuits are comically common. And there is limited precedent for short sellers doing this. Disclaimer: I am not a lawyer. This is not legal advice. Don't buy or sell securities based on my internet comments.
seeTheAstroturf 7y ago
Can Apple be sued for the same? I'm reminded of their advertising against windows for security, but their products have had a myriad of security flaws over the years.
unlinked_dll 7y ago
How many of Zoom's recent issues can be explained by just bad engineering? Because my personal gripes with Zoom are mostly about its quality as a software product, which I find to be abysmal for my use cases.
- arbitrage 7y ago
  From a purely functional standpoint, that is -- does this software do what I need it to do?, I have had absolutely no problems with zoom. What issues have come up for you?
  - unlinked_dll 7y ago
    I don't really want to go through the laundry list of issues I have because none are critical, just the software is very rough around the edges on Linux. It just feels less than flushed out, and I've had a million little problems and bugs that I've reported and never heard anything back (as a paying user!).
    - jedberg 7y ago
      > on Linux I think I found your problem. While Linux is big here on HN, all Linux users probably represent .001% of their paying customers. In other words, it makes no business sense for them to do anything to retain you.
nkohari 7y ago
This nonsense happens all the time with public companies. All it takes is a law firm with the gumption to file a suit claiming that the company misrepresented something material which resulted in a significant change to share prices.
jy2947 7y ago
Don't know what is going on at Zoom, but I suspected at least part of it sneaky. For example, about 3 or 4 weeks ago I heard about this company, and learned that it has R&D in China per its SEC filing at IPO. However, checked its website, the career section led me to https://jobs.lever.co/zoom https://jobs.lever.co/zoom, and there was ONLY one opening at China per the website (I remember it was a position at marketing department). Then I searched the company in Chinese media, and saw that they were hiring all types of engineers. That made me feel uncomfortable in buying its stock. Interestingly, now you look at the same career website, and China is removed from the list of city dropdown - maybe they are cutting off or "decoupling" the Chinese R&D?
- eythian 7y ago
  It could be they advertise jobs in different regions on different systems, to get the closest reach to the potential hirees.
  - jy2947 7y ago
    The R&D centers in China (I think there are 3 of them) are their competitive advantage - this can help them manage cost to be profitable from early on. I also think the engineering teams there can share with their peers of the other local Chinese tech firms. For example, China was literately put in lock down in February, and all of the business and schools went on-line in couple of days - that was a enormous achievement for anyone who participated the scaling infrastructure at the big tech companies in China, and I would not be surprised that the Zoom engineers in Chinese R&D learned couple of lessons from them. Zoom even has a feature that you can choose to "soften" your appearance to look "better" in the video conference, which has been feature of camera/image software popular in Asian market. So I suspect their product team may also have some connections there. However, Zoom's biggest advantage is also its biggest risk, if they want to be part of the communication infrastructure of any business/government/university/etc in western countries, especially after so many security incidents that happened in the past years.
- yibg 7y ago
  Why is having engineers in China cause for suspicion? Lots of tech companies have engineers in China. Eg Microsoft.
A4ET8a8uTh0 7y ago
Good. There needs to be a serious crackdown on 'puffery' aka lying ( whether lying about product feature or anything else is irrelevant ). Fingers crossed and it will go beyond $2 credit on future Zoom services for affected users.
- ballenf 7y ago
  I'm betting the payout will be a custom emoji for affected users. Maybe a tinfoil hat. And the court will be ok with that so long as the lawyers get paid in hard currency.
  - pirocks 7y ago
    Iirc this is a lawsuit by shareholders so I imagine users will get nothing.
deleted 7y ago
[deleted]
philshem 7y ago
I guess investors who bought the wrong Zoom stock can’t get in on the class action? ;) https://time.com/5792310/zoom-zm-stocks-coronavirus/ https://time.com/5792310/zoom-zm-stocks-coronavirus/
upofadown 7y ago
Looking back, there isn't actually any evidence that Zoom is not, as they put it, "encrypted from end point to end point". But it is clear that Zoom itself is kind of confused about the whole thing. I don't think that Zoom is all that good with technical stuff... To have any assurance that a video conferencing system is actually secure e2e you would have to have access to the verified source code of the client programs and verify the identity of each and every participant. That is likely impractical so I think it is safe to say that you should not use any video conference system provided by others to discuss secret things. If you absolutely must do so then you can set up a server under your physical control and then would not have to bother with e2ee at all.
- stingraycharles 7y ago
  Security audits are done all the time, for which access to the source is given. In Zoom’s case, going through an audit from a reputable firm, may just be the answer of getting the public’s confidence back. And of course it’s fairly extreme to claim you should not use any video conference system for any sensitive discussions; security is not black and white, and each situation deserves an appropriate level of security; it needs to be balanced with convenience. There are a lot of situations where I would prefer “mostly” secure communication, rather than no communication at all.
  - upofadown 7y ago
    >There are a lot of situations where I would prefer “mostly” secure communication, rather than no communication at all. We are not talking about "mostly" here for the video conference case. We are talking about a situation where most providers have access to the data of their users without very much work. If you are actually willing to confirm the identity of your correspondent using verified binaries you can get end to end protected communications ... if someone claims that they have something easier then they are lying. You can't beat the law of logic. The fact that anyone is even suggesting that Zoom could of been e2ee in any way that mattered is kind of depressing. I think we have some education to do. Security audits are pointless unless you can confirm that the software that was audited is the software actually running on your device.
SubiculumCode 7y ago
I am beginning to get concerned also. The University of California has contracts with Zoom, and so many of us have moved over to using Zoom for all our research lab meetings, especially since the pandemic. We all know that China has pushed research espionage, with several convictions that I know about. The possibility of intimate ties with China raises the specter that Zoom is pushing video, or transcripts of that video through China, and hence through Chinese spy agencies, which would be really concerning. Note: I love the Chinese people, and my Chinese colleagues. I do NOT like the oppressive, and frankly, evil and callous crimes committed by the Chinese government. Downvotes or upvote the comment as you will, won't change their crimes or my opinion..
apotatopot 7y ago
And I've heard nothing about TikTok https://www.vox.com/open-sourced/2019/12/16/21013048/tiktok-china-national-security-investigation https://www.vox.com/open-sourced/2019/12/16/21013048/tiktok-...

391 points by laurex 7y ago

deleted 7y ago

[deleted]

Will be interesting if Zoom is compelled to disclose their security architecture. On the same page can they be forced, in court, to make a statement on the interference by the Chinese government?

xenonite 7y ago
on the latter issue: a company can not speak for each individual employee.
- xenonite 7y ago
  I don't get why this is downvoted? Maybe I was too concise. Then: even if the company may say what they do, the company cannot check and tell what each employee does. This doesn't have to be a malicious intent of the employee, but it can be.
tensor 7y ago
What interference by the Chinese government?
dontbenebby 7y ago
Is having keys compelled a surprise? Chinese servers, operating in China legally, will usually have this issue. It's serious yes, but I'm confused if it only applied to users in China? I'm more concerned about the technical issues TBH - I assume most software sanctioned in China had to turn over keys.
- fnord123 7y ago
  Seeing as encryption is illegal in China, I don't think they will need to give up any keys.
  - gruez 7y ago
    >Seeing as encryption is illegal in China Source for this? That would make any https site in china illegal.
    - kube-system 7y ago
      Not an expert, but I searched and found this link which seems to explain it well: https://www.freshfields.com/en-us/our-thinking/campaigns/digital/data/china-rules-on-encryption/ https://www.freshfields.com/en-us/our-thinking/campaigns/dig... tl;dr: encryption is not completely illegal, but it sounds like it's pretty tightly controlled.
      - dontbenebby 7y ago
        I didn't think they'd be foolish enough to completely ban it. They're not comically evil, they just have certain incentives. Key escrow meets those goals.
    - fnord123 7y ago
      I'm sorry, I was wrong. It requires a license from the State Encryption Management Commission: http://www.cryptolaw.org/cls2.htm#prc http://www.cryptolaw.org/cls2.htm#prc I am not a lawyer nor a cryptography expert who can advise whether licenses are granted easily or whether they are revoked if you fall out of favour.
bdowling 7y ago
If the lawsuit gets past the pleadings stage, then relevant information would be subject to discovery. So the plaintiffs would be able to get and use that info in court, but Zoom would probably ask the judge for a protective order so that it doesn’t become public.

whoisjohnkid 7y ago

Not surprising. Crazy how zoom in the beginning of the crisis was hailed for helping folks get together, but now with all the highlighted security concerns they are receiving a ton backlash. Hopefully they can recover and learn from this.

runawaybottle 7y ago
I’m more shocked that this massive tech industry has like one decent solution to remote video conferencing. Maybe we really have gone too far down the road of making bullshit apps, and stopped solving real problems. Shame on us.
- kevin_thibedeau 7y ago
  Shame on the telcos who prevent residential customers from using the internet as intended. If everyone was given an IPV6 address block and freedom to accept outside connections from anywhere, none of this would be an issue.
  - cat199 7y ago
    agree on telcos preventing ppl from using internet as intended, but we'd still need good and easy to use videoconferencing software
  - meowface 7y ago
    >freedom to accept outside connections from anywhere Without NAT from home gateways (like consumer routers) preventing inbound connections from the internet, security would be far more of a nightmare than it is today. Requiring that people manually forward specific ports is the best way to handle it. We would be seeing news about Blaster-like worms pretty much every week of the past 20 years, otherwise. Also, even if it were a good idea, this still wouldn't solve the problem at all. The NAT-traversing capability of Zoom and other products is like 0.01% of the value they provide. You still need good software.
- icelancer 7y ago
  MS Teams is pretty good, but it's Microsoft so people aren't using it as much. Which is understandable.

encoderer 7y ago

Blows my mind that a shareholder might have a cause of action for this. 1) Buy volatile stock with recent IPO 2) Sue them for their volatility 3) ?????

tlbsofware 7y ago
> Zoom documentation claims that the app uses “AES-256” encryption for meetings where possible. However, we find that in each Zoom meeting, a single AES-128 key is used in ECB mode by all participants to encrypt and decrypt audio and video. The use of ECB mode is not recommended because patterns present in the plaintext are preserved during encryption. https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/ https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto...
- toomuchtodo 7y ago
  You know, I had never considered being a shareholder and using said standing to sue a company into security best practices when they lie about it, considering regulation has failed to create the appropriate incentives.
  - tlbsofware 7y ago
    Neither have I, but figured I’d link this since it is more than likely why they are suing
- shanemhansen 7y ago
  Oh wow. ECB mode? That's horrifying.
  - fnord123 7y ago
    For those that don't know much about encryption, here is an example image for why ECB mode is trash: https://i.stack.imgur.com/bXAUL.png https://i.stack.imgur.com/bXAUL.png

cft 7y ago

This culture of biting the feeding hand has to stop somewhere.

xenonite 7y ago
Well no, the shareholder is the feeding hand, giving money. Actually, Zoom is accused of misbehaving and biting the feeding hand. And yes, this shouldn't have happened.

judge2020 7y ago

Note that the lawsuit is a class action for shareholders of Zoom stock. Filing: https://i.judge.sh/natural/Babs/1-main.pdf https://i.judge.sh/natural/Babs/1-main.pdf

ship_it 7y ago
Interesting that shareholders are the one to fill a lawsuit.
- toomuchtodo 7y ago
  "Everything everywhere is securities fraud." [1] -- Matt Levine, Money Stuff [1] https://www.bloomberg.com/opinion/articles/2019-06-26/everything-everywhere-is-securities-fraud https://www.bloomberg.com/opinion/articles/2019-06-26/everyt...
- elliekelly 7y ago
  In the US lying to users is merely frowned upon while lying to investors is illegal.
  - gpm 7y ago
    False advertising of services (amongst other things) is illegal in the US. https://www.law.cornell.edu/uscode/text/15/52#b https://www.law.cornell.edu/uscode/text/15/52#b
    - elliekelly 7y ago
      Yes, just this week the FTC brought a tech company to justice for false and misleading promises to users about information security: > “We allege that Tapplock promised that its Internet-connected locks were secure, but in fact the company failed to even test if that claim was true,” said Andrew Smith, Director of the FTC’s Bureau of Consumer Protection. “Tech companies should remember the basics—when you promise security, you need to deliver security.”[1] Armed with clear and indisputable evidence of Tapplock's blatant lies, the bulldog enforcement lawyers at the FTC took the opportunity to make an example out of the company. After 18 months of hard-fought negotiations the FTC announced a settlement agreement[2] whereby the Commission agreed to resolve the matter in exchange for Tapplock's pinky promise to not get caught doing that again. Per the arduous terms of the settlement, Tapplock neither admits nor denies any of the FTC's allegations. So when a company promises their users security that company better deliver security. Or else... absolutely fuckall will happen. [1]https://www.ftc.gov/news-events/press-releases/2020/04/canadian-maker-smart-locks-settles-ftc-allegations-it-deceived https://www.ftc.gov/news-events/press-releases/2020/04/canad... [2]https://www.ftc.gov/system/files/documents/cases/192_3011_tapplock_agreement_containing_consent_order.pdf https://www.ftc.gov/system/files/documents/cases/192_3011_ta...

sandov 7y ago

Does it count as lying when it's ridiculously obvious that you're lying?

smolder 7y ago
Yes, and it's not so obvious to almost everyone.
runawaybottle 7y ago
Well, I mean, I’m sure it was a throw in claim made for sales. Sales is always a little sleazy. I just don’t think the company expected ... you know, the whole world to be using their product. Sleazy got caught :p
ajayyy 7y ago
No, but this is not obvious. Vitamin water claims that excuse and I don't believe they should either.

pjc50 7y ago

It's a bit odd how everyone's attacking Zoom when none of the other common solutions have proper e2e encryption either.

cblades 7y ago
Do the other common solutions claim to have e2e encryption?
- Wowfunhappy 7y ago
  Yeah. The problem here is that Zoom lied about it. And, like, why? Sure, if no one ever caught them, e2e could be a reason to choose Zoom—but it's like lying on a resumé. Which, I guess is also a thing that happens sometimes, but it's generally understood to be a bad idea.
  - UncleMeat 7y ago
    Because it was clearly botched marketing material rather than a coordinated plan. Hypothetical: somebody asked an engineer what kind of encryption Zoom used, the engineer responded somewhat vaguely and the marketing person heard "we encrypt between endpoints" as "end to end encryption" and then nobody noticed when reviewing the text.
    - m4r35n357 7y ago
      Yeah right, oops
      - UncleMeat 7y ago
        Yes it definitely is an "oops". I'm not excusing it, but offering an alternative explanation to the "zoom is evil" thinking. If zoom was truly trying to market themselves as e2e, why is this only buried in one document rather than shouted from the hills?
        7y ago

fock 7y ago

my employer currently signs up for zoom, apparently managed via our SSO-solution. so far so good. Right now, I got an email from Zoom, not showing any relation to my employer or mentioning its name: "congratulations for signup, use your account now". Ok. Password reset yields an usable basic account. Seems like somehow Zoom created a personal account for me with my work email. As I didn't get the activation email I got on my private spam-account, I assume somehow they got/requested all the employees email-adresses and automatically created private accounts, not related to the actual business acc.. What the actual f* is that?!? And yeah, I think conceptually this is the same behavior as shown by the ad/malware/spam campaigns ca. 2003. I wonder what had happened if I had just typed a password when signing in with my account... Maybe they just grab the passwords of the illiterate users and check them by trying to login with the university website? (that's sooo userfriendly!)

jamiequint 7y ago
I set up Zoom for our company and nothing like this happened. It seems much more likely (than your wild conspiracy theory) that your company added a "basic", rather than "licensed" account for you and you got an email as a result.
- fock 7y ago
  no, don't know what kind of mess they made; the official login is via SSO (and works with <companyname>.zoom.us). to my understanding the account is typically created on login there (otherwise we would sync our whole list of employees with 100s of services...). and even if it was just a random invitation sent to an email they bought somewhere, it doesn't really explain how I could reset the password for my email then (without ever activating an account)?! It might be a messup from someone but it's definitely strange and I just didn't sign up there, yet got spam and had a working basic account...
  - jamiequint 7y ago
    > otherwise we would sync our whole list of employees with 100s of services Could also have been created with SCIM and you're in a particular SCIM group that other folks are not in.

pastullo 7y ago

Am i the only one struggling to use Zoom properly since they introduced the latest security changes? The slack integration (write /zoom to start a meeting) was working ok-ish even though we always had problem with the meeting not starting unless the host of the meeting was logged in (gosh...why so complicated?) Now they added this waiting room, there is no sound notification to let you know that people are waiting. Doing daily standup become a sufference. It's crazy how quickly they lost us as users with literally two badly implemented features. Happy to hear if any of you also had the same struggle and if there is a good alternative.

Wowfunhappy 7y ago
Maybe set a (strong) password instead of using the waiting room?
studmuffin650 7y ago
I think most of these are settings that can be changed in the advanced settings menu. Zoom changed the defaults, but you can still change the settings to what you prefer them to be
proverbialbunny 7y ago
For our daily standup we use meet.google.com as it's more convenient than ZOOM. ymmv ofc
- Wowfunhappy 7y ago
  My company has been trying to find a solution since the Coronavirus hit. (We're not used to working from home) We were using Slack's built-in conferencing at first, but aside from the quality being generally bad, there was a 15 person limit, and we're ~ 17 people. I didn't want us to use Zoom with everything that's going on, so I suggested Google Meet. We tried it, and it worked, but not well—people's voices would frequently break up and become hard to hear. And so we tried Zoom this past Monday. It was incredible. I could actually hear and see everyone. I'm not happy about all their issues, but damn their product is just really good.

crazygringo 7y ago

I don't think this is likely to succeed -- Zoom can argue that the stock price has gone down because of "Zoombombing" and security/privacy concerns that have nothing to do with exact details of what was disclosed in privacy/security documents, which barely anyone reads anyways. Also, it's awfully hard to argue losing shareholder value when the stock has still more than doubled in the end -- Zoom can easily make the plausible-enough case that it made the right tradeoffs in the end for shareholder value that allowed it to scale. (I'm not saying that's true, just that it's plausible.) Could it be fined by the SEC for misstating key details in their public filing? Maybe, although these are tiny details. But a class-action suit by shareholders? This feels like a stunt to me. Also, since a suit by shareholders could depress the stock price further, this feels like a short-seller trying to profit, no?

JumpCrisscross 7y ago
> Zoom can argue that the stock price has gone down because... Two general steps to a securities suit. First, show the company defrauded investors. That can be as simple as omitting or mis-stating material information. (Zoom publicly claimed to use certain encryption standards that it didn't.) So the battle, here, will be around materiality. Critically, this step does not typically require proving damages. Once materiality is met, the second step is showing damages. At this point, the change in (and attribution of) stock prices comes into play. Once fraud is shown, the company is in a bad place. Even if a particular investor faced no discernible loss, everyone who bought at higher prices will now sue. It also invites state and federal investigators to start pursuing management and senior staff. > this feels like a short-seller trying to profit, no? No. You have to disclose your positions when entering into a shareholder lawsuit. Shareholder lawsuits are comically common. And there is limited precedent for short sellers doing this. Disclaimer: I am not a lawyer. This is not legal advice. Don't buy or sell securities based on my internet comments.

seeTheAstroturf 7y ago

Can Apple be sued for the same? I'm reminded of their advertising against windows for security, but their products have had a myriad of security flaws over the years.

unlinked_dll 7y ago

How many of Zoom's recent issues can be explained by just bad engineering? Because my personal gripes with Zoom are mostly about its quality as a software product, which I find to be abysmal for my use cases.

arbitrage 7y ago
From a purely functional standpoint, that is -- does this software do what I need it to do?, I have had absolutely no problems with zoom. What issues have come up for you?
- unlinked_dll 7y ago
  I don't really want to go through the laundry list of issues I have because none are critical, just the software is very rough around the edges on Linux. It just feels less than flushed out, and I've had a million little problems and bugs that I've reported and never heard anything back (as a paying user!).
  - jedberg 7y ago
    > on Linux I think I found your problem. While Linux is big here on HN, all Linux users probably represent .001% of their paying customers. In other words, it makes no business sense for them to do anything to retain you.

nkohari 7y ago

This nonsense happens all the time with public companies. All it takes is a law firm with the gumption to file a suit claiming that the company misrepresented something material which resulted in a significant change to share prices.

jy2947 7y ago

Don't know what is going on at Zoom, but I suspected at least part of it sneaky. For example, about 3 or 4 weeks ago I heard about this company, and learned that it has R&D in China per its SEC filing at IPO. However, checked its website, the career section led me to https://jobs.lever.co/zoom https://jobs.lever.co/zoom, and there was ONLY one opening at China per the website (I remember it was a position at marketing department). Then I searched the company in Chinese media, and saw that they were hiring all types of engineers. That made me feel uncomfortable in buying its stock. Interestingly, now you look at the same career website, and China is removed from the list of city dropdown - maybe they are cutting off or "decoupling" the Chinese R&D?

eythian 7y ago
It could be they advertise jobs in different regions on different systems, to get the closest reach to the potential hirees.
- jy2947 7y ago
  The R&D centers in China (I think there are 3 of them) are their competitive advantage - this can help them manage cost to be profitable from early on. I also think the engineering teams there can share with their peers of the other local Chinese tech firms. For example, China was literately put in lock down in February, and all of the business and schools went on-line in couple of days - that was a enormous achievement for anyone who participated the scaling infrastructure at the big tech companies in China, and I would not be surprised that the Zoom engineers in Chinese R&D learned couple of lessons from them. Zoom even has a feature that you can choose to "soften" your appearance to look "better" in the video conference, which has been feature of camera/image software popular in Asian market. So I suspect their product team may also have some connections there. However, Zoom's biggest advantage is also its biggest risk, if they want to be part of the communication infrastructure of any business/government/university/etc in western countries, especially after so many security incidents that happened in the past years.
yibg 7y ago
Why is having engineers in China cause for suspicion? Lots of tech companies have engineers in China. Eg Microsoft.

A4ET8a8uTh0 7y ago

Good. There needs to be a serious crackdown on 'puffery' aka lying ( whether lying about product feature or anything else is irrelevant ). Fingers crossed and it will go beyond $2 credit on future Zoom services for affected users.

ballenf 7y ago
I'm betting the payout will be a custom emoji for affected users. Maybe a tinfoil hat. And the court will be ok with that so long as the lawyers get paid in hard currency.
- pirocks 7y ago
  Iirc this is a lawsuit by shareholders so I imagine users will get nothing.

deleted 7y ago

[deleted]

philshem 7y ago

I guess investors who bought the wrong Zoom stock can’t get in on the class action? ;) https://time.com/5792310/zoom-zm-stocks-coronavirus/ https://time.com/5792310/zoom-zm-stocks-coronavirus/

upofadown 7y ago

Looking back, there isn't actually any evidence that Zoom is not, as they put it, "encrypted from end point to end point". But it is clear that Zoom itself is kind of confused about the whole thing. I don't think that Zoom is all that good with technical stuff... To have any assurance that a video conferencing system is actually secure e2e you would have to have access to the verified source code of the client programs and verify the identity of each and every participant. That is likely impractical so I think it is safe to say that you should not use any video conference system provided by others to discuss secret things. If you absolutely must do so then you can set up a server under your physical control and then would not have to bother with e2ee at all.

stingraycharles 7y ago
Security audits are done all the time, for which access to the source is given. In Zoom’s case, going through an audit from a reputable firm, may just be the answer of getting the public’s confidence back. And of course it’s fairly extreme to claim you should not use any video conference system for any sensitive discussions; security is not black and white, and each situation deserves an appropriate level of security; it needs to be balanced with convenience. There are a lot of situations where I would prefer “mostly” secure communication, rather than no communication at all.
- upofadown 7y ago
  >There are a lot of situations where I would prefer “mostly” secure communication, rather than no communication at all. We are not talking about "mostly" here for the video conference case. We are talking about a situation where most providers have access to the data of their users without very much work. If you are actually willing to confirm the identity of your correspondent using verified binaries you can get end to end protected communications ... if someone claims that they have something easier then they are lying. You can't beat the law of logic. The fact that anyone is even suggesting that Zoom could of been e2ee in any way that mattered is kind of depressing. I think we have some education to do. Security audits are pointless unless you can confirm that the software that was audited is the software actually running on your device.

SubiculumCode 7y ago

I am beginning to get concerned also. The University of California has contracts with Zoom, and so many of us have moved over to using Zoom for all our research lab meetings, especially since the pandemic. We all know that China has pushed research espionage, with several convictions that I know about. The possibility of intimate ties with China raises the specter that Zoom is pushing video, or transcripts of that video through China, and hence through Chinese spy agencies, which would be really concerning. Note: I love the Chinese people, and my Chinese colleagues. I do NOT like the oppressive, and frankly, evil and callous crimes committed by the Chinese government. Downvotes or upvote the comment as you will, won't change their crimes or my opinion..

apotatopot 7y ago

And I've heard nothing about TikTok https://www.vox.com/open-sourced/2019/12/16/21013048/tiktok-china-national-security-investigation https://www.vox.com/open-sourced/2019/12/16/21013048/tiktok-...