8 ms·

why not look at the problem the other way around? I don't have much respect for zoom's security practices, while I do have much respect for the keybase team.

why not look at the problem the other way around? I don't have much respect for zoom's security practices, while I do have much respect for the keybase team. Perhaps this is Zoom's way of admitting that there is no way they can just solve the problem internally by keeping doing what they're doing and they need to get some fresh blood and build upon good practices designed outside their current culture.

munchbunny 7y ago
In general, when it's between fresh blood and old management, old management will win every time. If Zoom is acquiring Keybase because the C-suite is pivoting culture around security, then it'll probably work. Otherwise, not much will change. So until I see more evidence that Zoom's upper management had a change of heart (creating a CISO council is a good start), I'm going to be skeptical that this will actually move the needle.
geerlingguy 7y ago
I'll take what you're drinking ;-)
andrepd 7y ago
Then why acquire? Why not just hire as a consultant?
- dcow 7y ago
  Because keybase obviously needs money and zoom has a lot of it right now..
  - mpweiher 7y ago
    That, and this is probably in large part a marketing/PR move. Public perception of zoom/security is "beyond horrible", thus visibly spending lots of money on an acquisition of a very well respected name in security helps them polish that image at least a little. And who knows, maybe they'll even work on actually improving security. Always the hopeless romantic/optimist, me. ¯\_(ツ)_/¯
    - ableal 7y ago
      > Public perception I'd say you overestimate that. Perhaps 0.01% of the public knows that Keybase exists and has a bad opinion of Zoom security. Expert's opinion is important, but does not automatically become general perception. (Anecdatum, I'm far from a security expert. I know that Keybase exists, even have an unused account; I use Zoom for work and don't blame them for not locking up tighter. Their blog post on the topic sounded reasonable to me.)
      - kyboren 7y ago
        > Perhaps 0.01% of the public knows that Keybase exists and has a bad opinion of Zoom security. Expert's opinion is important, but does not automatically become general perception. This is true, but perhaps a bit short-sighted. Expert opinion on Zoom is "avoid it like the plague". This does not automatically become general perception, true, but: - Over time, expert opinions have a marked effect on adoption by non-experts in their vicinity. See the adoption of Firefox, or Google Chrome, for example. - For a social networking platform, powerful well-connected never-adopters can pose a problem both to growth and to a budding monopoly. If CIOs and CISOs say, "Zoom over my dead body", that will tend to discourage adoption and encourage development of good alternatives.
- zoomablemind 7y ago
  Zoom may be also managing the perceptions. Some users will jump to conclusions that the aquisition means integration, like an plug-in, bam! the bad part swapped with a good one. Hiring consultants may be perceived like starting an investigation, not getting the fix now. The question remains how soon and how true this will translate to the stated goal of true end to end encryption.
frogpelt 7y ago
It seems that we live in an era where if you made bad decisions in the past, you can never be trusted to make good decisions ever again. Even if you own your bad decisions and show lots of improvement. Nope. Once a pariah, always a pariah.
- smacktoward 7y ago
  Tell that to Microsoft.
- lmm 7y ago
  Zoom's decisions did not feel like mistakes so much as an expression of their values. The company repeatedly prioritised ease of use while doing the absolute minimum on the security front. Are there any grounds to believe that that calculus has changed?
  - brians 7y ago
    No, but now they see that the minimum is not where they had thought. As someone who does security professionally, of course a business wants to do the minimum necessary for security. The point of security systems is to break things that would otherwise work. TLS is there to break sessions that would work under TCP. GPG is there to tell you to discard some mail.
  - jariel 7y ago
    This is a good point. But I do think that company values do change. Zoom is getting the shining light of attention globally. Even human beings, in these situations, start to act more conscientiously, and then believe their own morality after the fact! I believe the keybase acquisition demonstrates this a bit - because they will get zero public goodwill from this - nobody on Main St. knows are cares what Keybase is, this won't be on CNN so they are probably very much trying to make things better. Owners of the company want money - now they are popular, they have to behave well to get that money. Wanting money usually transcends everything else including loyalty to state. A Chinese CEO with a popular Western product is going to realize that if his customers are way for CCP grabbing their data, it's a problem to his business. He doesn't want CCP snooping and one of the better ways to do that is to have better encryption as well. Doing slightly suspicious things doesn't matter if nobody is watching and therefore nobody cares, now that people care ... it matters. Just as a matter of pragmatism.
doyoureallytnot 7y ago
I really hope that's the case, for Zoom's sake. Unfortunately, that means less than nothing to me; I don't use Zoom, whilst I do use Keybase. I don't trust Zoom to be custodians of the Keybase company or software. This has been a real blow to my confidence in them and I'm not sure I'll continue to use Keybase :(
fossuser 7y ago
I actually love Zoom as a product - far and away the best product in its class and this move likely makes sense for Zoom. The disappointment comes from the loss of Keybase and what it could have been. The main problem is Zoom having most of its development done via companies based in China. This means it is no longer possible for Keybase to achieve its original goal (and whatever encryption they add cannot fix this core problem). It's one thing to accept the risk for video conferencing, but it's another to accept for an encryption ID standard. I agreed with Chris Coyne's comments on HN a while back when he argued that the closed source server code didn't matter because of how they handled the encryption (when compared to Signal). While that's still true from a technical security standpoint, it looks like it does matter in a larger sense because this kind of sale shows that you can't really trust a company to act in its user's interests long-term.
bkanber 7y ago
I agree. I'd bet all the cash in my wallet that this was Zoom doing a talent acquisition, to bring a team of crypto experts on board.
- Flenser 7y ago
  You are probably right but I wouldn't discount the keybase server/client IP and user base completely. If Zoom could use keybase for identity verification and adding participants to a call via social graph connections of everyone on the call that could radically improve the UX of onboarding and securing a meeting to only approved participants.
  - bkanber 7y ago
    It's possible, though I think it's optimistic. Nobody really has a problem with Zoom's UX as it is now. The only people complaining about Zoom are us techies who know about the security issues. So my guess is they're just gonna quietly work on the security stuff in the background with this new team, and leave the UX largely as-is.
monadic2 7y ago
Has an acquisition ever worked like that in practice? I’ve heard that github might qualify but... Keybase ain’t no github.
munificent 7y ago
> why not look at the problem the other way around? Because no one ever buys or hires a conscience. If you thought a conscience was worth having one, that implies you would already have one and thus wouldn't need to outsource it in the first place. Ethics always rolls downhill. If Al Capone goes out and hires Mr. Rogers, the power imbalance between them means Mr. Rogers is going to get dirtier than Capone will get clean.
- jorangreef 7y ago
  Thanks for this! Besides upvotes, HN should have a hall of fame for comments this good. It reminds me of 1 Corinthians 15:33 quoting the Greek poet Menander: Do not be misled: “Bad company corrupts good character.”
  - mulmen 7y ago
    Click the timestamp, you can favorite a comment from there. It will show up on your profile under favorites -> comments.
    - jorangreef 7y ago
      Thanks!
  - spurgu 7y ago
    How does good character develop in the first place then..?
    - Communitivity 7y ago
      I always try to work with people smarter than me, more ethical than me, and more productive. When we associate with people we want to fit in with, we adapt to be more like them. We can adapt in bad ways, but we can also adapt in good ways. Essentially, on some level we never stop the role-model based adaptation we did as children, when we modeled our behavior on what our parent(s) did.
- 7y ago

munchbunny 7y ago

In general, when it's between fresh blood and old management, old management will win every time. If Zoom is acquiring Keybase because the C-suite is pivoting culture around security, then it'll probably work. Otherwise, not much will change. So until I see more evidence that Zoom's upper management had a change of heart (creating a CISO council is a good start), I'm going to be skeptical that this will actually move the needle.

geerlingguy 7y ago

I'll take what you're drinking ;-)

andrepd 7y ago

Then why acquire? Why not just hire as a consultant?

dcow 7y ago
Because keybase obviously needs money and zoom has a lot of it right now..
- mpweiher 7y ago
  That, and this is probably in large part a marketing/PR move. Public perception of zoom/security is "beyond horrible", thus visibly spending lots of money on an acquisition of a very well respected name in security helps them polish that image at least a little. And who knows, maybe they'll even work on actually improving security. Always the hopeless romantic/optimist, me. ¯\_(ツ)_/¯
  - ableal 7y ago
    > Public perception I'd say you overestimate that. Perhaps 0.01% of the public knows that Keybase exists and has a bad opinion of Zoom security. Expert's opinion is important, but does not automatically become general perception. (Anecdatum, I'm far from a security expert. I know that Keybase exists, even have an unused account; I use Zoom for work and don't blame them for not locking up tighter. Their blog post on the topic sounded reasonable to me.)
    - kyboren 7y ago
      > Perhaps 0.01% of the public knows that Keybase exists and has a bad opinion of Zoom security. Expert's opinion is important, but does not automatically become general perception. This is true, but perhaps a bit short-sighted. Expert opinion on Zoom is "avoid it like the plague". This does not automatically become general perception, true, but: - Over time, expert opinions have a marked effect on adoption by non-experts in their vicinity. See the adoption of Firefox, or Google Chrome, for example. - For a social networking platform, powerful well-connected never-adopters can pose a problem both to growth and to a budding monopoly. If CIOs and CISOs say, "Zoom over my dead body", that will tend to discourage adoption and encourage development of good alternatives.
zoomablemind 7y ago
Zoom may be also managing the perceptions. Some users will jump to conclusions that the aquisition means integration, like an plug-in, bam! the bad part swapped with a good one. Hiring consultants may be perceived like starting an investigation, not getting the fix now. The question remains how soon and how true this will translate to the stated goal of true end to end encryption.

frogpelt 7y ago

It seems that we live in an era where if you made bad decisions in the past, you can never be trusted to make good decisions ever again. Even if you own your bad decisions and show lots of improvement. Nope. Once a pariah, always a pariah.

smacktoward 7y ago
Tell that to Microsoft.
lmm 7y ago
Zoom's decisions did not feel like mistakes so much as an expression of their values. The company repeatedly prioritised ease of use while doing the absolute minimum on the security front. Are there any grounds to believe that that calculus has changed?
- brians 7y ago
  No, but now they see that the minimum is not where they had thought. As someone who does security professionally, of course a business wants to do the minimum necessary for security. The point of security systems is to break things that would otherwise work. TLS is there to break sessions that would work under TCP. GPG is there to tell you to discard some mail.
- jariel 7y ago
  This is a good point. But I do think that company values do change. Zoom is getting the shining light of attention globally. Even human beings, in these situations, start to act more conscientiously, and then believe their own morality after the fact! I believe the keybase acquisition demonstrates this a bit - because they will get zero public goodwill from this - nobody on Main St. knows are cares what Keybase is, this won't be on CNN so they are probably very much trying to make things better. Owners of the company want money - now they are popular, they have to behave well to get that money. Wanting money usually transcends everything else including loyalty to state. A Chinese CEO with a popular Western product is going to realize that if his customers are way for CCP grabbing their data, it's a problem to his business. He doesn't want CCP snooping and one of the better ways to do that is to have better encryption as well. Doing slightly suspicious things doesn't matter if nobody is watching and therefore nobody cares, now that people care ... it matters. Just as a matter of pragmatism.

doyoureallytnot 7y ago

I really hope that's the case, for Zoom's sake. Unfortunately, that means less than nothing to me; I don't use Zoom, whilst I do use Keybase. I don't trust Zoom to be custodians of the Keybase company or software. This has been a real blow to my confidence in them and I'm not sure I'll continue to use Keybase :(

fossuser 7y ago

I actually love Zoom as a product - far and away the best product in its class and this move likely makes sense for Zoom. The disappointment comes from the loss of Keybase and what it could have been. The main problem is Zoom having most of its development done via companies based in China. This means it is no longer possible for Keybase to achieve its original goal (and whatever encryption they add cannot fix this core problem). It's one thing to accept the risk for video conferencing, but it's another to accept for an encryption ID standard. I agreed with Chris Coyne's comments on HN a while back when he argued that the closed source server code didn't matter because of how they handled the encryption (when compared to Signal). While that's still true from a technical security standpoint, it looks like it does matter in a larger sense because this kind of sale shows that you can't really trust a company to act in its user's interests long-term.

bkanber 7y ago

I agree. I'd bet all the cash in my wallet that this was Zoom doing a talent acquisition, to bring a team of crypto experts on board.

Flenser 7y ago
You are probably right but I wouldn't discount the keybase server/client IP and user base completely. If Zoom could use keybase for identity verification and adding participants to a call via social graph connections of everyone on the call that could radically improve the UX of onboarding and securing a meeting to only approved participants.
- bkanber 7y ago
  It's possible, though I think it's optimistic. Nobody really has a problem with Zoom's UX as it is now. The only people complaining about Zoom are us techies who know about the security issues. So my guess is they're just gonna quietly work on the security stuff in the background with this new team, and leave the UX largely as-is.

monadic2 7y ago

Has an acquisition ever worked like that in practice? I’ve heard that github might qualify but... Keybase ain’t no github.

munificent 7y ago

> why not look at the problem the other way around? Because no one ever buys or hires a conscience. If you thought a conscience was worth having one, that implies you would already have one and thus wouldn't need to outsource it in the first place. Ethics always rolls downhill. If Al Capone goes out and hires Mr. Rogers, the power imbalance between them means Mr. Rogers is going to get dirtier than Capone will get clean.

jorangreef 7y ago
Thanks for this! Besides upvotes, HN should have a hall of fame for comments this good. It reminds me of 1 Corinthians 15:33 quoting the Greek poet Menander: Do not be misled: “Bad company corrupts good character.”
- mulmen 7y ago
  Click the timestamp, you can favorite a comment from there. It will show up on your profile under favorites -> comments.
  - jorangreef 7y ago
    Thanks!
- spurgu 7y ago
  How does good character develop in the first place then..?
  - Communitivity 7y ago
    I always try to work with people smarter than me, more ethical than me, and more productive. When we associate with people we want to fit in with, we adapt to be more like them. We can adapt in bad ways, but we can also adapt in good ways. Essentially, on some level we never stop the role-model based adaptation we did as children, when we modeled our behavior on what our parent(s) did.
7y ago