3 ms·

Looking back, there isn't actually any evidence that Zoom is not, as they put it, "encrypted from end point to end point". But it is clear that Zoom itself is k

Looking back, there isn't actually any evidence that Zoom is not, as they put it, "encrypted from end point to end point". But it is clear that Zoom itself is kind of confused about the whole thing. I don't think that Zoom is all that good with technical stuff... To have any assurance that a video conferencing system is actually secure e2e you would have to have access to the verified source code of the client programs and verify the identity of each and every participant. That is likely impractical so I think it is safe to say that you should not use any video conference system provided by others to discuss secret things. If you absolutely must do so then you can set up a server under your physical control and then would not have to bother with e2ee at all.

stingraycharles 7y ago
Security audits are done all the time, for which access to the source is given. In Zoom’s case, going through an audit from a reputable firm, may just be the answer of getting the public’s confidence back. And of course it’s fairly extreme to claim you should not use any video conference system for any sensitive discussions; security is not black and white, and each situation deserves an appropriate level of security; it needs to be balanced with convenience. There are a lot of situations where I would prefer “mostly” secure communication, rather than no communication at all.
- upofadown 7y ago
  >There are a lot of situations where I would prefer “mostly” secure communication, rather than no communication at all. We are not talking about "mostly" here for the video conference case. We are talking about a situation where most providers have access to the data of their users without very much work. If you are actually willing to confirm the identity of your correspondent using verified binaries you can get end to end protected communications ... if someone claims that they have something easier then they are lying. You can't beat the law of logic. The fact that anyone is even suggesting that Zoom could of been e2ee in any way that mattered is kind of depressing. I think we have some education to do. Security audits are pointless unless you can confirm that the software that was audited is the software actually running on your device.

stingraycharles 7y ago

Security audits are done all the time, for which access to the source is given. In Zoom’s case, going through an audit from a reputable firm, may just be the answer of getting the public’s confidence back. And of course it’s fairly extreme to claim you should not use any video conference system for any sensitive discussions; security is not black and white, and each situation deserves an appropriate level of security; it needs to be balanced with convenience. There are a lot of situations where I would prefer “mostly” secure communication, rather than no communication at all.

upofadown 7y ago
>There are a lot of situations where I would prefer “mostly” secure communication, rather than no communication at all. We are not talking about "mostly" here for the video conference case. We are talking about a situation where most providers have access to the data of their users without very much work. If you are actually willing to confirm the identity of your correspondent using verified binaries you can get end to end protected communications ... if someone claims that they have something easier then they are lying. You can't beat the law of logic. The fact that anyone is even suggesting that Zoom could of been e2ee in any way that mattered is kind of depressing. I think we have some education to do. Security audits are pointless unless you can confirm that the software that was audited is the software actually running on your device.