3 ms·

> Zoom does not and will not proactively monitor meeting contents, but our trust and safety team will continue to use automated tools to look for evidence of ab

by cbg0 6y ago

> Zoom does not and will not proactively monitor meeting contents, but our trust and safety team will continue to use automated tools to look for evidence of abusive users based upon other available data. > Zoom has not and will not build a mechanism to decrypt live meetings for lawful intercept purposes. > We also do not have a means to insert our employees or others into meetings without being reflected in the participant list. We will not build any cryptographic backdoors to allow for the secret monitoring of meetings. One court + gag order and all of these promises are out the window.

GurnBlandston 6y ago
Let alone the legalese included that makes 'will not' lose any meaning at all.
degenerate 6y ago
Consider these promises a warrant canary. They will be removed at some point.
- sdlkfgj 6y ago
  only that it is not. warrant canaries must be written in the past tense. This is future tense. So they can monitor millions of calls, and give your information away at every second. This text only tells you about the next second (a promise they will break too, but then the text will be about the next second)
  - MiroF 6y ago
    Perhaps it's my inexperience with the english language showing, but I thought "has" in this context was past tense.
    - jpxw 6y ago
      Nope you’re right. They could use this as a warrant canary by removing the “has not” part
  - mdtusz 6y ago
    > Zoom has not and will not build a mechanism to decrypt live meetings for lawful intercept purposes. That seems to include past tense.
    - JshWright 6y ago
      I wonder how important the word "live" is there. Does this statement only apply to real-time decryption of ongoing meetings?
      - anticensor 6y ago
        I think yes: they lack the technical infrastructure to decrypt the meeting in real time (which totally makes sense), rather than they have no plans to buid any infrastructure to decrpyt it afterwards (which cannot be guaranteed against a hostile actor).
      - SAI_Peregrinus 6y ago
        And how long of a delay counts as no longer "live"? After the meeting ends? Five seconds? A millisecond? Does the latency to the server mean it's not "live", since it happened in the past?
        anticensor 6y ago
        One full meeting duration after the meeting ends.
- SahAssar 6y ago
  I thought warrant canaries had to be in financial reports because those are one of the documents where companies are legally cannot lie under SEC rules?
blackkat 6y ago
“...will not proactively monitor...” “...will not build a mechanism to decrypt live meetings...” So, this means that they can record meetings, then retroactively decrypt and monitor meeting contents :)
foobiekr 6y ago
The statement about lawful intercept can only be considered a blatant lie. It’s a requirement in China and CALEA applies in the US. Europe, India and Australia have their own laws around this.
- jlgaddis 6y ago
  What makes you think that CALEA applies to Zoom (in the U.S.)? IANAL, but I'm reasonably confident that it does not.
  - coolspot 6y ago
    EFF says[1] it applies to Skype, so I think it should apply to Zoom as well. [1] - https://www.eff.org/issues/calea https://www.eff.org/issues/calea
notriddle 6y ago
Well, yeah, duh. What do you expect them to do? Hire a PMC and fight a war with the police when they come around to raid the server room? Go into hiding so that the security agency can't steal the upgrade signing key from them? We can't expect all of the internet to operate like Wikileaks and The Pirate Bay. If the justice system is broken, then the people aren't safe.
- oehpr 6y ago
  >What do you expect them to do? Hire a PMC and fight a war with the police when they come around to raid the server room? Go into hiding so that the security agency can't steal the upgrade signing key from them? No, we want them to assume the same thing we are assuming. That if their service becomes successful, they will be coerced to compromise their users, regardless of how frequently they promise that they would never do so. If they are even bothering to make public announcements like this, then that means they believe the security of their system can be founded on the honor of their employees. It's important to recognize that this isn't even true if you assume every member of their team is an uncorruptible seraphim. Instead, where possible, the service should be zero knowledge, where not possible, it should be considered insecure.
- mirimir 6y ago
  > We can't expect all of the internet to operate like Wikileaks and The Pirate Bay. Why not? That's just what it takes. > If the justice system is broken, then the people aren't safe. It is, and they are. After 50 years under the heel of the war on drugs, how is it not 100% obvious?
- teknologist 6y ago
  Building reasonable end-to-end encryption in the first place isn't rocket science. In fact, Keybase have done just that. As well as WhatsApp, Signal, and many others.
kyboren 6y ago
It also does not say that they have not provided key material or RNG output, or that they have not deliberately weakened any aspect of their design other than "cryptographic backdoors" to accommodate law enforcement desires. These kinds of statements are typically most usefully interpreted as a template for the kinds of things they plan to do, just maybe not exactly in that way.

by cbg0 6y ago

GurnBlandston 6y ago

Let alone the legalese included that makes 'will not' lose any meaning at all.

degenerate 6y ago

Consider these promises a warrant canary. They will be removed at some point.

sdlkfgj 6y ago
only that it is not. warrant canaries must be written in the past tense. This is future tense. So they can monitor millions of calls, and give your information away at every second. This text only tells you about the next second (a promise they will break too, but then the text will be about the next second)
- MiroF 6y ago
  Perhaps it's my inexperience with the english language showing, but I thought "has" in this context was past tense.
  - jpxw 6y ago
    Nope you’re right. They could use this as a warrant canary by removing the “has not” part
- mdtusz 6y ago
  > Zoom has not and will not build a mechanism to decrypt live meetings for lawful intercept purposes. That seems to include past tense.
  - JshWright 6y ago
    I wonder how important the word "live" is there. Does this statement only apply to real-time decryption of ongoing meetings?
    - anticensor 6y ago
      I think yes: they lack the technical infrastructure to decrypt the meeting in real time (which totally makes sense), rather than they have no plans to buid any infrastructure to decrpyt it afterwards (which cannot be guaranteed against a hostile actor).
    - SAI_Peregrinus 6y ago
      And how long of a delay counts as no longer "live"? After the meeting ends? Five seconds? A millisecond? Does the latency to the server mean it's not "live", since it happened in the past?
      - anticensor 6y ago
        One full meeting duration after the meeting ends.
SahAssar 6y ago
I thought warrant canaries had to be in financial reports because those are one of the documents where companies are legally cannot lie under SEC rules?

blackkat 6y ago

“...will not proactively monitor...” “...will not build a mechanism to decrypt live meetings...” So, this means that they can record meetings, then retroactively decrypt and monitor meeting contents :)

foobiekr 6y ago

The statement about lawful intercept can only be considered a blatant lie. It’s a requirement in China and CALEA applies in the US. Europe, India and Australia have their own laws around this.

jlgaddis 6y ago
What makes you think that CALEA applies to Zoom (in the U.S.)? IANAL, but I'm reasonably confident that it does not.
- coolspot 6y ago
  EFF says[1] it applies to Skype, so I think it should apply to Zoom as well. [1] - https://www.eff.org/issues/calea https://www.eff.org/issues/calea

notriddle 6y ago

Well, yeah, duh. What do you expect them to do? Hire a PMC and fight a war with the police when they come around to raid the server room? Go into hiding so that the security agency can't steal the upgrade signing key from them? We can't expect all of the internet to operate like Wikileaks and The Pirate Bay. If the justice system is broken, then the people aren't safe.

oehpr 6y ago
>What do you expect them to do? Hire a PMC and fight a war with the police when they come around to raid the server room? Go into hiding so that the security agency can't steal the upgrade signing key from them? No, we want them to assume the same thing we are assuming. That if their service becomes successful, they will be coerced to compromise their users, regardless of how frequently they promise that they would never do so. If they are even bothering to make public announcements like this, then that means they believe the security of their system can be founded on the honor of their employees. It's important to recognize that this isn't even true if you assume every member of their team is an uncorruptible seraphim. Instead, where possible, the service should be zero knowledge, where not possible, it should be considered insecure.
mirimir 6y ago
> We can't expect all of the internet to operate like Wikileaks and The Pirate Bay. Why not? That's just what it takes. > If the justice system is broken, then the people aren't safe. It is, and they are. After 50 years under the heel of the war on drugs, how is it not 100% obvious?
teknologist 6y ago
Building reasonable end-to-end encryption in the first place isn't rocket science. In fact, Keybase have done just that. As well as WhatsApp, Signal, and many others.

kyboren 6y ago

It also does not say that they have not provided key material or RNG output, or that they have not deliberately weakened any aspect of their design other than "cryptographic backdoors" to accommodate law enforcement desires. These kinds of statements are typically most usefully interpreted as a template for the kinds of things they plan to do, just maybe not exactly in that way.