4 ms·

This is complete and utter BS. EVERY communications provider has to comply with lawful intercept [1] regulation in all the regions where they operate. If they

This is complete and utter BS. EVERY communications provider has to comply with lawful intercept [1] regulation in all the regions where they operate. If they do not they find themselves hauled before the regulator and they'll be fined or worse until they do or go out of business. 'Encryption', while it would make it harder to snoop on your calls from third parties, will not 'protect' you from lawful intercept. Furthermore specific to the US Zoom also has to comply with the Communications Assistance for Law Enforcement Act [2]. This does in no way mean Zoom can not encrypt its traffic. It just means it has to provide law enforcement the ability to covertly wiretap every and any communication. If Zoom provides end to end encryption to its paying customers, it still has to provide access to law enforcement to the content of those communications. [1] https://en.wikipedia.org/wiki/Lawful_interception https://en.wikipedia.org/wiki/Lawful_interception [2] https://en.wikipedia.org/wiki/Communications_Assistance_for_Law_Enforcement_Act https://en.wikipedia.org/wiki/Communications_Assistance_for_...

adtac 6y ago
I'm not sure what your point is? Do you believe that all encryption is broken? If not, to the FBI, the tapped data should be indistinguishable from random bytes, from the definition of ciphertext. And that serves its purpose perfectly well. Whether or not the FBI has access to the ciphertext is immaterial.
Erlich_Bachman 6y ago
> 'Encryption', while it would make it harder to snoop on your calls from third parties, will not 'protect' you from lawful intercept. Yes it will, it will make the intercept so expensive that it will not make sense anymore for them to do it. In the first case, all they need to do to intercept is to call Zoom headquarters, or even just go to some pre-setup website and just enter the identity of the user and voíla you have the data. The cost is 1 man-hour of an agent. In the second case, the Zoom doesn't have technical ability to break the encryption, and to "lawfully intercept" they need to either break your phone or physically break into your home to install some devices, or construct elaborate servers to trick your phone into thinking it talks to real Zoom, or use the supercomputers to break some of the encryption, or use some of their hidden stashed 0-day, and thus risk exposing it by using it, and not be able to use it later for a real threat. Cost of this can be astronomical for breaking a single user. (And all of that is even more true for open-source solutions.) Also a lot of people disdain this not because they are terrorists. They disdain this type of surveillance because it has been shown many times that governments do not just track terrorists, they always end up abusing their power and track everyone, and there are agents who sometimes just make fun of people and read their emails etc. Didn't you read any of the Snowden material that was published? Encryption prevents exactly this type of ABUSE of the power by the government.
- deleted 6y ago
  [deleted]
michaelmrose 6y ago
>If Zoom provides end to end encryption to its paying customers, it still has to provide access to law enforcement to the content of those communications. How do you think this works? If Alice and Bob generate private keys and share only their public keys with each other over the wire how does the provider obtain the content of those communications to share? It never had them. There is no non broken way to provide a backdoor for government while actually retaining meaningful security in the long run. See the extensive discussion on "key escrow" Lets discuss a very old encrypted communication mechanism. PGP encrypted email. If I Bob send an encrypted email to Alice how does gmail fulfill its obligations as stated previously to law enforcement? PGP came out in 1991 and CALEA is from 1994. In the 26 years since I don't seem to recall anyone shutting down gmail.
- PeterStuer 6y ago
  "There is no non broken way to provide a backdoor for government while actually retaining meaningful security in the long run" I actually agree with you on this. I was personally involved in the past to advocate for stronger encryption ( https://archive.nytimes.com/www.nytimes.com/library/cyber/week/102497computing.html https://archive.nytimes.com/www.nytimes.com/library/cyber/we... [1997]). However, law enforcement agencies around the world see "broken" ways to achieve this as a 'lesser of two evils' trade-off. Am I too paranoid (I hope I am) to envisage a scenario where Sam, our friendly US law enforcement officer asks Sheila, his friendly AU counterpart to request a copy of the conversation obtained through technical capability and assistance notices and share it back under 5 eyes agreements? Add the pending bilateral CLOUD act for an extra spicy double exchange sandwich?

adtac 6y ago

I'm not sure what your point is? Do you believe that all encryption is broken? If not, to the FBI, the tapped data should be indistinguishable from random bytes, from the definition of ciphertext. And that serves its purpose perfectly well. Whether or not the FBI has access to the ciphertext is immaterial.

Erlich_Bachman 6y ago

> 'Encryption', while it would make it harder to snoop on your calls from third parties, will not 'protect' you from lawful intercept. Yes it will, it will make the intercept so expensive that it will not make sense anymore for them to do it. In the first case, all they need to do to intercept is to call Zoom headquarters, or even just go to some pre-setup website and just enter the identity of the user and voíla you have the data. The cost is 1 man-hour of an agent. In the second case, the Zoom doesn't have technical ability to break the encryption, and to "lawfully intercept" they need to either break your phone or physically break into your home to install some devices, or construct elaborate servers to trick your phone into thinking it talks to real Zoom, or use the supercomputers to break some of the encryption, or use some of their hidden stashed 0-day, and thus risk exposing it by using it, and not be able to use it later for a real threat. Cost of this can be astronomical for breaking a single user. (And all of that is even more true for open-source solutions.) Also a lot of people disdain this not because they are terrorists. They disdain this type of surveillance because it has been shown many times that governments do not just track terrorists, they always end up abusing their power and track everyone, and there are agents who sometimes just make fun of people and read their emails etc. Didn't you read any of the Snowden material that was published? Encryption prevents exactly this type of ABUSE of the power by the government.

deleted 6y ago
[deleted]

michaelmrose 6y ago

>If Zoom provides end to end encryption to its paying customers, it still has to provide access to law enforcement to the content of those communications. How do you think this works? If Alice and Bob generate private keys and share only their public keys with each other over the wire how does the provider obtain the content of those communications to share? It never had them. There is no non broken way to provide a backdoor for government while actually retaining meaningful security in the long run. See the extensive discussion on "key escrow" Lets discuss a very old encrypted communication mechanism. PGP encrypted email. If I Bob send an encrypted email to Alice how does gmail fulfill its obligations as stated previously to law enforcement? PGP came out in 1991 and CALEA is from 1994. In the 26 years since I don't seem to recall anyone shutting down gmail.

PeterStuer 6y ago
"There is no non broken way to provide a backdoor for government while actually retaining meaningful security in the long run" I actually agree with you on this. I was personally involved in the past to advocate for stronger encryption ( https://archive.nytimes.com/www.nytimes.com/library/cyber/week/102497computing.html https://archive.nytimes.com/www.nytimes.com/library/cyber/we... [1997]). However, law enforcement agencies around the world see "broken" ways to achieve this as a 'lesser of two evils' trade-off. Am I too paranoid (I hope I am) to envisage a scenario where Sam, our friendly US law enforcement officer asks Sheila, his friendly AU counterpart to request a copy of the conversation obtained through technical capability and assistance notices and share it back under 5 eyes agreements? Add the pending bilateral CLOUD act for an extra spicy double exchange sandwich?