5 ms·

The threat model for a school is kids/others disrupting sessions and creepers using access to gawp at (or communicate with kids). Since the Chinese government i

The threat model for a school is kids/others disrupting sessions and creepers using access to gawp at (or communicate with kids). Since the Chinese government is unlikely to feel the need to compel Zoom to do that, the fact that they have all the keys centrally stored is not a problem. Google's threat model actually does include state level attack (And specifically by China) to steal IP or access confidential user data.

jMyles 7y ago
> The threat model for a school is kids/others disrupting sessions and creepers using access to gawp at (or communicate with kids). Not if the school actually cares about the future of its students. From a blog post[0] we published at NuCypher a while back: > If we fail to take action now, we risk a world in which unsavory actors - domestic and foreign - have built rich, comprehensive profiles for every one of our children, following the trajectories of their education, home life, consumer habits, health, and on and on. These profiles will then be used to manipulate their behavior not only as consumers, but as voters and participants in all those corners of society which, in order for freedom and justice to prevail, require instead that these kids mature into functional, free-thinking adults. 0: https://blog.nucypher.com/todays-kids-need-end-to-end-encryption/ https://blog.nucypher.com/todays-kids-need-end-to-end-encryp...
- rdxm 7y ago
  Exactly. why do you think they punched the OPM to get SF86's? It continues to surprise me that people just don't grok basic concepts of intelligence gathering. Particularly on a site like this.... And as much is its controversial here, there is a material difference between US and Chinese objectives, value systems and implementations of surveillance.
- gowld 7y ago
  Sure, but Zoom isn't anywhere near the source of marignal risk on that.
- mattip 7y ago
  Is Google or Facebook any better in this regard?
  - DeathArrow 7y ago
    It highly depends on the definition of the good guys. If you live in US, that might be true. If you live in the rest of the world that might be false.
  - jMyles 7y ago
    Is the fact that I specifically called out both of them in the post insufficient condemnation? :-) Indeed - they're no better.
  - fnord123 7y ago
    I got confused and thought he was talking about Google. The results already exist via Cambridge Analytica. It's like the old 5G debate in Europe: who do you want to have a backdoor: Cisco+USA or Huawei+PRC? (Hint for Americans: some/many see China as less malevolent).
HashThis 7y ago
I great worry that China's intelligence service has the zoom traffic of American's routed to the Chinese zoom servers, so they can intercept.
- Wowfunhappy 7y ago
  Yes, but why does it matter if China intercepts your American school children? Why would they want to? That's not a reasonable threat model.
  - rangibaby 7y ago
    It still leaks information. How many kids you have, their name, some things about their personality, who they are friends with, etc. Think about how someone who wants to hurt or control you could could use that information.
    - Wowfunhappy 7y ago
      > Think about how someone who wants to hurt or control you could could use that information. "Someone", sure, but not the Chinese Government! That's a completely different threat model!
      - dionian 7y ago
        how so
    - abnry 7y ago
      I couldn't imagine it mattering to any random individual, but I could imagine some American diplomat or defense contractor being concerned.
      - rangibaby 7y ago
        I would say contributing or maintaining anything on Github would make you a possible target, you never know
fulafel 7y ago
A risk when talking about memory safety vulnerabilities is that someone (not china especially, just someone exploiting zoom) pwns the child's or family's computing infrastructure and gains access to everything running on there and possibly does it without detection for a long time. It's badically an all-bets-are-off situation that also puts social media contacts at risk. Zoom is of course just one vector for this, but the threat model of "it's just schoolwork at risk" is wrong. It's actually integrity of tje computing environment.
watwut 7y ago
It is also the few parents with no contact order trying to get contact to kids.
qiguai 7y ago
Actually tiktok shows is their intent is kids data so not far-fetched

jMyles 7y ago

> The threat model for a school is kids/others disrupting sessions and creepers using access to gawp at (or communicate with kids). Not if the school actually cares about the future of its students. From a blog post[0] we published at NuCypher a while back: > If we fail to take action now, we risk a world in which unsavory actors - domestic and foreign - have built rich, comprehensive profiles for every one of our children, following the trajectories of their education, home life, consumer habits, health, and on and on. These profiles will then be used to manipulate their behavior not only as consumers, but as voters and participants in all those corners of society which, in order for freedom and justice to prevail, require instead that these kids mature into functional, free-thinking adults. 0: https://blog.nucypher.com/todays-kids-need-end-to-end-encryption/ https://blog.nucypher.com/todays-kids-need-end-to-end-encryp...

rdxm 7y ago
Exactly. why do you think they punched the OPM to get SF86's? It continues to surprise me that people just don't grok basic concepts of intelligence gathering. Particularly on a site like this.... And as much is its controversial here, there is a material difference between US and Chinese objectives, value systems and implementations of surveillance.
gowld 7y ago
Sure, but Zoom isn't anywhere near the source of marignal risk on that.
mattip 7y ago
Is Google or Facebook any better in this regard?
- DeathArrow 7y ago
  It highly depends on the definition of the good guys. If you live in US, that might be true. If you live in the rest of the world that might be false.
- jMyles 7y ago
  Is the fact that I specifically called out both of them in the post insufficient condemnation? :-) Indeed - they're no better.
- fnord123 7y ago
  I got confused and thought he was talking about Google. The results already exist via Cambridge Analytica. It's like the old 5G debate in Europe: who do you want to have a backdoor: Cisco+USA or Huawei+PRC? (Hint for Americans: some/many see China as less malevolent).

HashThis 7y ago

I great worry that China's intelligence service has the zoom traffic of American's routed to the Chinese zoom servers, so they can intercept.

Wowfunhappy 7y ago
Yes, but why does it matter if China intercepts your American school children? Why would they want to? That's not a reasonable threat model.
- rangibaby 7y ago
  It still leaks information. How many kids you have, their name, some things about their personality, who they are friends with, etc. Think about how someone who wants to hurt or control you could could use that information.
  - Wowfunhappy 7y ago
    > Think about how someone who wants to hurt or control you could could use that information. "Someone", sure, but not the Chinese Government! That's a completely different threat model!
    - dionian 7y ago
      how so
  - abnry 7y ago
    I couldn't imagine it mattering to any random individual, but I could imagine some American diplomat or defense contractor being concerned.
    - rangibaby 7y ago
      I would say contributing or maintaining anything on Github would make you a possible target, you never know

fulafel 7y ago

A risk when talking about memory safety vulnerabilities is that someone (not china especially, just someone exploiting zoom) pwns the child's or family's computing infrastructure and gains access to everything running on there and possibly does it without detection for a long time. It's badically an all-bets-are-off situation that also puts social media contacts at risk. Zoom is of course just one vector for this, but the threat model of "it's just schoolwork at risk" is wrong. It's actually integrity of tje computing environment.

watwut 7y ago

It is also the few parents with no contact order trying to get contact to kids.

qiguai 7y ago

Actually tiktok shows is their intent is kids data so not far-fetched