3 ms·

> Zoom CEO Eric Yuan said in early June that the company has chosen not to encrypt free calls in order to cooperate with law enforcement. This is incorrect. Th

by sp332 6y ago

> Zoom CEO Eric Yuan said in early June that the company has chosen not to encrypt free calls in order to cooperate with law enforcement. This is incorrect. They don't offer end-to-end encryption, but it is encrypted between each client and the Zoom servers, and they have promised there's no way for a Zoom employee to spy on a conversation without visibly joining the meeting. https://twitter.com/alexstamos/status/1268061790954385408 https://twitter.com/alexstamos/status/1268061790954385408

Ntrails 6y ago
Either it is E2E encrypted, or it is unencrypted on zoom servers and the only claim that they can reasonably make is that they haven't provided their employees with the tools to observe a call invisibly.
- virgilp 6y ago
  This is addressed in the Alex Stamos twitter thread. It _is_ E2E encrypted. And from what I understand the "promise" is a technological promise, not a process promise; you can check the exact terms of the promise in the paper.
  - brians 6y ago
    The paper’s ideas are not yet implemented. Right now, it’s encrypted to whatever keys Zoom likes, including the PRC’s. Same system as Apple’s or Google’s
    - virgilp 6y ago
      OK, but if we were to take this stance it than literally the whole thread is pointless debate, right? It started with this: > Zoom CEO Eric Yuan said in early June that the company has chosen not to encrypt free calls in order to cooperate with law enforcement. The entire debate is about the not-yet-implemented E2E encryption (that's where Zoom "does not encrypt free calls"). And the Alex Stamos thread explains very well both why that is a sensible choice, and how they will implement E2E encryption& what are the limitations. If we're discussing about current implementation, it doesn't make sense to be outraged that "Zoom doesn't offer encryption for free calls" - if we talk about E2E encryption, it doesn't offer it for anyone; and if we talk just about HTTPS, it offers it to everyone. So in fact we must've been discussing the future implementation not the current one - right?
- bo1024 6y ago
  That’s not quite exhaustive. It could be encrypted the whole time, but with Zoom holding the encryption keys. Slight difference, perhaps important.
koonsolo 6y ago
So that statement is correct, you just confirmed it yourself.
woah 6y ago
Encrypted = private to most people. There’s no reason to muddy the waters with the fact that Zoom encrypts some data temporarily at some time with keys that they control, because that isn’t what anyone cares about.
throwaway483284 6y ago
> This is incorrect. They don't offer end-to-end encryption It's all about end-to-end encryption, so it's correct. If they decrypt it anywhere on the way then three letter agencies can always listen to what you say with a proper letter. > and they have promised Are you serious?
naugtur 6y ago
A promise is a promise. The "no way to spy" is likely just compliance. A lot of companies have compliance guarantees in place, like SOC2, which is about processes and documentation/audit trail. So the thing blocking you from reading customer data is another person in the organization having to confirm it's a legitimate action. Government level surveillance is not the same as an employee listening in on a whim. It's an organized endeavor, which comes with a process, so it may as well be ok from compliance point of view.
SahAssar 6y ago
> They don't offer end-to-end encryption, but it is encrypted between each client and the Zoom servers, I think it's absurd that when talking about private messages the bar for privacy would be so low as to say that client-server encryption would be a "feature"- > they have promised there's no way for a Zoom employee to spy on a conversation without visibly joining the meeting That's false unless no one at zoom has logins to any of the servers that route the calls or deploy code to them. Let's be clear and specific about the terms. "no way for" and "not allowed under guidelines" have very different technical meanings.
Townley 6y ago
IMO that's not "incorrect" so much as it is "ambiguous about the type of encryption being referred to. Even the most spy-happy, malicious service could offer HTTPS encryption, so hearing "they do encrypt some stuff" doesn't address concerns about Zoom willfully monitoring customers Neither does the second part about promising not to spy on a conversation; surrendering conversation metadata would be almost as bad from a privacy perspective.

by sp332 6y ago

Ntrails 6y ago

Either it is E2E encrypted, or it is unencrypted on zoom servers and the only claim that they can reasonably make is that they haven't provided their employees with the tools to observe a call invisibly.

virgilp 6y ago
This is addressed in the Alex Stamos twitter thread. It _is_ E2E encrypted. And from what I understand the "promise" is a technological promise, not a process promise; you can check the exact terms of the promise in the paper.
- brians 6y ago
  The paper’s ideas are not yet implemented. Right now, it’s encrypted to whatever keys Zoom likes, including the PRC’s. Same system as Apple’s or Google’s
  - virgilp 6y ago
    OK, but if we were to take this stance it than literally the whole thread is pointless debate, right? It started with this: > Zoom CEO Eric Yuan said in early June that the company has chosen not to encrypt free calls in order to cooperate with law enforcement. The entire debate is about the not-yet-implemented E2E encryption (that's where Zoom "does not encrypt free calls"). And the Alex Stamos thread explains very well both why that is a sensible choice, and how they will implement E2E encryption& what are the limitations. If we're discussing about current implementation, it doesn't make sense to be outraged that "Zoom doesn't offer encryption for free calls" - if we talk about E2E encryption, it doesn't offer it for anyone; and if we talk just about HTTPS, it offers it to everyone. So in fact we must've been discussing the future implementation not the current one - right?
bo1024 6y ago
That’s not quite exhaustive. It could be encrypted the whole time, but with Zoom holding the encryption keys. Slight difference, perhaps important.

koonsolo 6y ago

So that statement is correct, you just confirmed it yourself.

woah 6y ago

Encrypted = private to most people. There’s no reason to muddy the waters with the fact that Zoom encrypts some data temporarily at some time with keys that they control, because that isn’t what anyone cares about.

throwaway483284 6y ago

> This is incorrect. They don't offer end-to-end encryption It's all about end-to-end encryption, so it's correct. If they decrypt it anywhere on the way then three letter agencies can always listen to what you say with a proper letter. > and they have promised Are you serious?

naugtur 6y ago

A promise is a promise. The "no way to spy" is likely just compliance. A lot of companies have compliance guarantees in place, like SOC2, which is about processes and documentation/audit trail. So the thing blocking you from reading customer data is another person in the organization having to confirm it's a legitimate action. Government level surveillance is not the same as an employee listening in on a whim. It's an organized endeavor, which comes with a process, so it may as well be ok from compliance point of view.

SahAssar 6y ago

> They don't offer end-to-end encryption, but it is encrypted between each client and the Zoom servers, I think it's absurd that when talking about private messages the bar for privacy would be so low as to say that client-server encryption would be a "feature"- > they have promised there's no way for a Zoom employee to spy on a conversation without visibly joining the meeting That's false unless no one at zoom has logins to any of the servers that route the calls or deploy code to them. Let's be clear and specific about the terms. "no way for" and "not allowed under guidelines" have very different technical meanings.

Townley 6y ago

IMO that's not "incorrect" so much as it is "ambiguous about the type of encryption being referred to. Even the most spy-happy, malicious service could offer HTTPS encryption, so hearing "they do encrypt some stuff" doesn't address concerns about Zoom willfully monitoring customers Neither does the second part about promising not to spy on a conversation; surrendering conversation metadata would be almost as bad from a privacy perspective.