14 ms·

Some thoughts: 1. Google's threat model may not be your threat model, and it definitely isn't the threat model of my daughter's school. A corporation like Goog

• jMyles 7y ago
  > Google's threat model may not be your threat model, and it definitely isn't the threat model of my daughter's school. A corporation like Google may be concerned using native applications, written in unsafe languages, written by developers from other corporations in China. That said, Zoom isn't wrong for everyone. Google's threat model surely differs in some way from a school, but the specific threats you named seem like threats equally applicable to the surfaces identifiable in the threat model of a school.
  • CameronNemo 7y ago
    No they are not. A business can have trade information they want to protect. A school would be more focused on individual privacy and safety. These threat models are quite different.
  • Mvandenbergh 7y ago
    The threat model for a school is kids/others disrupting sessions and creepers using access to gawp at (or communicate with kids). Since the Chinese government is unlikely to feel the need to compel Zoom to do that, the fact that they have all the keys centrally stored is not a problem. Google's threat model actually does include state level attack (And specifically by China) to steal IP or access confidential user data.
    • jMyles 7y ago
      > The threat model for a school is kids/others disrupting sessions and creepers using access to gawp at (or communicate with kids). Not if the school actually cares about the future of its students. From a blog post[0] we published at NuCypher a while back: > If we fail to take action now, we risk a world in which unsavory actors - domestic and foreign - have built rich, comprehensive profiles for every one of our children, following the trajectories of their education, home life, consumer habits, health, and on and on. These profiles will then be used to manipulate their behavior not only as consumers, but as voters and participants in all those corners of society which, in order for freedom and justice to prevail, require instead that these kids mature into functional, free-thinking adults. 0: https://blog.nucypher.com/todays-kids-need-end-to-end-encryption/ https://blog.nucypher.com/todays-kids-need-end-to-end-encryp...
      • rdxm 7y ago
        Exactly. why do you think they punched the OPM to get SF86's? It continues to surprise me that people just don't grok basic concepts of intelligence gathering. Particularly on a site like this.... And as much is its controversial here, there is a material difference between US and Chinese objectives, value systems and implementations of surveillance.
      • gowld 7y ago
        Sure, but Zoom isn't anywhere near the source of marignal risk on that.
      • mattip 7y ago
        Is Google or Facebook any better in this regard?
        • DeathArrow 7y ago
          It highly depends on the definition of the good guys. If you live in US, that might be true. If you live in the rest of the world that might be false.
        • jMyles 7y ago
          Is the fact that I specifically called out both of them in the post insufficient condemnation? :-) Indeed - they're no better.
    • HashThis 7y ago
      I great worry that China's intelligence service has the zoom traffic of American's routed to the Chinese zoom servers, so they can intercept.
      • Wowfunhappy 7y ago
        Yes, but why does it matter if China intercepts your American school children? Why would they want to? That's not a reasonable threat model.
        • rangibaby 7y ago
          It still leaks information. How many kids you have, their name, some things about their personality, who they are friends with, etc. Think about how someone who wants to hurt or control you could could use that information.
          • Wowfunhappy 7y ago
            > Think about how someone who wants to hurt or control you could could use that information. "Someone", sure, but not the Chinese Government! That's a completely different threat model!
            • dionian 7y ago
              how so
          • abnry 7y ago
            I couldn't imagine it mattering to any random individual, but I could imagine some American diplomat or defense contractor being concerned.
            • rangibaby 7y ago
              I would say contributing or maintaining anything on Github would make you a possible target, you never know
    • fulafel 7y ago
      A risk when talking about memory safety vulnerabilities is that someone (not china especially, just someone exploiting zoom) pwns the child's or family's computing infrastructure and gains access to everything running on there and possibly does it without detection for a long time. It's badically an all-bets-are-off situation that also puts social media contacts at risk. Zoom is of course just one vector for this, but the threat model of "it's just schoolwork at risk" is wrong. It's actually integrity of tje computing environment.
    • watwut 7y ago
      It is also the few parents with no contact order trying to get contact to kids.
    • qiguai 7y ago
      Actually tiktok shows is their intent is kids data so not far-fetched
  • QUFB 7y ago
    Understood, it differs, I just made a very brief comment and mentioned a couple of obvious threats! For those that use Zoom - consider spending at least a few minutes to make a mental threat model about Zoom. Who might go after you? What features does Zoom have that might be exploitable? What's the worst thing that can happen? The worst case for Google is not the same as the worst case for a professor or elementary school. Maybe Zoom doesn't work for your use case - fine! Maybe Zoom is good for your use case - fine! Lots of people will be using it either way, so it's good to have Alex help lock it down.
  • neves 7y ago
    My children's school is using Microsoft Teams for classes. The students are: - kicking out their colleagues - muting the teacher - posting memes in the chat room It looks like you can't prevent them from muting/kicking out each other. There's a larger threat surface of mean pre-adolescents, than a hacker trying to steal their info.
    • rand49an 7y ago
      All these things can be stopped with the Teams policies which can be set by the Teams owner (probably the teacher). Better education regarding these tools is required for sure.
      • neves 7y ago
        Sure. And it's not easy for a k12 teacher of a third world country to use these tools. The default is open and the need to configure it is a surface attack.
• manojlds 7y ago
  With the kind of things we are seeing with Zoom, I shudder at what Tavis & team will find.
• hkai 7y ago
  Or perhaps Google just doesn't like China.
• annie_chung 7y ago
  > That said, Zoom isn't wrong for everyone. Why use it at all? I honestly don't know what's available in this space, since I don't need to, but is there really no alternative? If they're building a product that does shady things (e.g., macOS install nonsense) and is full of security holes (e.g., zoombombing) that's enough to tell me I don't want to use it and I don't want my son's school using it. Google isn't alone here. Just another data point. At best it's a product full of security holes. At worst deliberately designed to spy on people. I don't care who those people are. I care about the intent.
  • swampthinker 7y ago
    Because in 2020, it's still a far simpler and better product than anything else at 1 thing - getting large video conferencing to be seamless.
  • freepor 7y ago
    Some of us don’t have security as a high priority. I for example wouldn’t really mind if my computer’s entire contents were published at nytimes.com. What I care about right now is my kids getting to see their family over Zoom or whateverx
    • hyko 7y ago
      I think we’re probably at the point where it doesn’t matter what your personal threat model is: your insecurity affects everyone, so nobody has the luxury of not caring about it (much like vaccination against disease). It is a matter of collective and national security.
      • aembleton 7y ago
        Why is it a matter of national security if my weekly beer meetup (to replace the pub) is watched over by some Chinese spy?
  • neuronic 7y ago
    Zoom is by far the best usable conferencing software. Its security flaws are irrelevant to most users as the pain of using anything else is awful. It's always a major drawback. People in the real world care as much about Jitsi as about Bernie Sanders. HN and Reddit are bubbles that Joe Schmitz from MegaCorp Inc. does not know or care about ever despite some aspects being vastly better on the security side. UI/UX is Zoom's domain though and nothing comes close. Try doing a Teams call with 30+ people.
• toss1 7y ago
  Sure, everyone's threat model is different. But look at the whole threat model. * Google's exposure is far greater than merely other languages * Exposing profiles & activities of an entire generation of kids to a foreign adversarial surveillance govt is itself a serious threat, covered by other responses here * This creates a massive increase in exposed surface area. E. g., consider abkid using their parent's computer who happens to work at a sub-sub-contractor on a key defense project. Even if the key files are properly encrypted, just some little data points like the fact of their employment, network name, list of known WiFi routers cached, etc., now lets CCP fill out their model of attack vectors. There's a thousand other ways this can be used to gain an edge if you don't like that example The bottom line is like the precautionary principle - just because you or I can't figure out how to exploit something, doesn't mean that it can't be exploited.