5 ms·
Zoom I've always thought must have pretty strong security if configured correctly (obviously that's a big if) It is currentLy in use by the Chinese Academy of S
by rshnotsecure 6y ago
Zoom I've always thought must have pretty strong security if configured correctly (obviously that's a big if) It is currentLy in use by the Chinese Academy of Sciences (CAS). CAS is sort of like a mix of NSF, NIH, and DARPA all rolled into one. About 20% of their research supports the People's Liberation Army (PLA) for things like encryption research, so I assume they know what they're doing.
This is technically a white label I guess you would say, but if you download the code, a majority of the files begin with the prefix Zoom and what not: https://cc.cstcloud.cn https://cc.cstcloud.cn
- tialaramex 6y agoWhy have you thought that? The actual security of the system has been dissected already. They took RTP and just encrypted the data with ECB mode, using the same keys on every node. It's what a child would do, or somebody who either didn't know or didn't care to do better. Well over a decade ago the standard way to do that (named SRTP following the usual convention) uses a counter mode instead of ECB, with separate keys on each node. That's still pretty poor, but it's like SRTP is a Yale lock and what Zoom chose to do is use one of those "handcuff key" locks that's just a single lever. Can a specialist open that Yale lock? Yeah, probably in a minute or two, with the right tools - but any idiot can open the handcuff key lock with a bent twig, it's not security it's the barest effort to not just emit plaintext.