4 ms·

Blows my mind that a shareholder might have a cause of action for this. 1) Buy volatile stock with recent IPO 2) Sue them for their volatility 3) ?????

tlbsofware 7y ago
> Zoom documentation claims that the app uses “AES-256” encryption for meetings where possible. However, we find that in each Zoom meeting, a single AES-128 key is used in ECB mode by all participants to encrypt and decrypt audio and video. The use of ECB mode is not recommended because patterns present in the plaintext are preserved during encryption. https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/ https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto...
- toomuchtodo 7y ago
  You know, I had never considered being a shareholder and using said standing to sue a company into security best practices when they lie about it, considering regulation has failed to create the appropriate incentives.
  - tlbsofware 7y ago
    Neither have I, but figured I’d link this since it is more than likely why they are suing
- shanemhansen 7y ago
  Oh wow. ECB mode? That's horrifying.
  - fnord123 7y ago
    For those that don't know much about encryption, here is an example image for why ECB mode is trash: https://i.stack.imgur.com/bXAUL.png https://i.stack.imgur.com/bXAUL.png
    - UncleMeat 7y ago
      Images are uniquely bad for ECB mode since they almost definitionally will have repeated material. ECB mode is bad and shouldn't be used. But it isn't like somebody listening to your zoom traffic can transparently see penguins.
      - pedrocr 7y ago
        Isn't an h264 stream even worse given that unlike a random image it has a very well defined repeating structure? The risk isn't that someone will look at zoom traffic directly and see the content Matrix-style. The risk is that it should become possible to just completely decode the encryption given what you know about the plaintext. In that context the penguin image is a great illustration.
    - shanemhansen 7y ago
      I would say that anyone who ever tries to encrypt some data and does the bare minimum google/stackoverflow search for how to do it would see extremely vigorous warnings not to touch ECB with a 10 foot pole. Unfortunately, crypto libraries have a history of having a terrible UI and defaulting to ECB. Years ago I ran into this with pycrypto. I worked on a team that joked about how important it was not to do ECB and it turns out they had done ECB. https://www.dlitz.net/software/pycrypto/api/current/Crypto.Cipher.AES-module.html https://www.dlitz.net/software/pycrypto/api/current/Crypto.C...
detaro 7y ago
Shareholders can sue you for pretty much anything you do that damages your value that you didn't warn them about. I.e. they put in their IPO prospectus that there might be a negative impact on their reputation from them having Chinese R&D, so they have a defense against that. They didn't put "We have misleading marketing materials that might become subject to widespread public attention" in there I think.
- encoderer 7y ago
  That doesn’t mean it’s a sound policy. Public markets bid up a stock to an insane valuation in a matter of weeks and then the price comes down (due to technicals, fundamentals, whatever) and you have shareholders trying to weasel out of their gambling losses by suing company. Let a customer who was actually harmed by this sue. Much more compelling to me.
  - netsharc 7y ago
    It should teach companies not to lie in their marketing, or as Zoom calls it, "have a discrepancy between the commonly accepted definition of e2e and how [they're] using it". If they weren't making shit up, stocks go up, stocks go down, but the gamblers wouldn't have any grounds to sue.

tlbsofware 7y ago

> Zoom documentation claims that the app uses “AES-256” encryption for meetings where possible. However, we find that in each Zoom meeting, a single AES-128 key is used in ECB mode by all participants to encrypt and decrypt audio and video. The use of ECB mode is not recommended because patterns present in the plaintext are preserved during encryption. https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/ https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto...

toomuchtodo 7y ago
You know, I had never considered being a shareholder and using said standing to sue a company into security best practices when they lie about it, considering regulation has failed to create the appropriate incentives.
- tlbsofware 7y ago
  Neither have I, but figured I’d link this since it is more than likely why they are suing
shanemhansen 7y ago
Oh wow. ECB mode? That's horrifying.
- fnord123 7y ago
  For those that don't know much about encryption, here is an example image for why ECB mode is trash: https://i.stack.imgur.com/bXAUL.png https://i.stack.imgur.com/bXAUL.png
  - UncleMeat 7y ago
    Images are uniquely bad for ECB mode since they almost definitionally will have repeated material. ECB mode is bad and shouldn't be used. But it isn't like somebody listening to your zoom traffic can transparently see penguins.
    - pedrocr 7y ago
      Isn't an h264 stream even worse given that unlike a random image it has a very well defined repeating structure? The risk isn't that someone will look at zoom traffic directly and see the content Matrix-style. The risk is that it should become possible to just completely decode the encryption given what you know about the plaintext. In that context the penguin image is a great illustration.
  - shanemhansen 7y ago
    I would say that anyone who ever tries to encrypt some data and does the bare minimum google/stackoverflow search for how to do it would see extremely vigorous warnings not to touch ECB with a 10 foot pole. Unfortunately, crypto libraries have a history of having a terrible UI and defaulting to ECB. Years ago I ran into this with pycrypto. I worked on a team that joked about how important it was not to do ECB and it turns out they had done ECB. https://www.dlitz.net/software/pycrypto/api/current/Crypto.Cipher.AES-module.html https://www.dlitz.net/software/pycrypto/api/current/Crypto.C...

detaro 7y ago

Shareholders can sue you for pretty much anything you do that damages your value that you didn't warn them about. I.e. they put in their IPO prospectus that there might be a negative impact on their reputation from them having Chinese R&D, so they have a defense against that. They didn't put "We have misleading marketing materials that might become subject to widespread public attention" in there I think.

encoderer 7y ago
That doesn’t mean it’s a sound policy. Public markets bid up a stock to an insane valuation in a matter of weeks and then the price comes down (due to technicals, fundamentals, whatever) and you have shareholders trying to weasel out of their gambling losses by suing company. Let a customer who was actually harmed by this sue. Much more compelling to me.
- netsharc 7y ago
  It should teach companies not to lie in their marketing, or as Zoom calls it, "have a discrepancy between the commonly accepted definition of e2e and how [they're] using it". If they weren't making shit up, stocks go up, stocks go down, but the gamblers wouldn't have any grounds to sue.