17 ms·
Zoom still don't understand GDPR
- andrewnicolalde 6y agoDisclaimer: I used to work at ThreatSpike Labs but left before this article was written and before any of the findings on this article were discovered.
- deleted 6y ago[deleted]
- ComputerGuru 6y agoHN is cool with self-posting, so in all cases you’re in the clear.
- wnoise 6y agoYes, but they (we) still like disclosure.
- saagarjha 6y agoC'mon, what does it take for Zoom to understand that when people uninstall software they don't want parts of it to stick around forever?
- summitsummit 6y agoit takes for them to stop profiting off it
- qppo 6y agoUsually this happens because the person who wrote the file or daemon didn't write the uninstaller and no one gives a hoot about it at review. Never assume malice that which can be explained by a poor engineering culture
- black_puppydog 6y agoWell, malice or not, the result is not conforming to the law. And from how I remember it, that's not the first time they are in that situation, so "oops, our bad" shouldn't really cut it.
- m11a 6y agoEspecially when you consider the software and design of Zoom, poor engineering culture sounds like the more realistic answer.
- strictnein 6y ago> "Poor engineering culture" The software and service is currently running at a scale that the vast majority of visitors to HN can barely dream of achieving. But yeah, they prioritized ease of install for the client of their software over other considerations, so that must mean they have a "poor engineering culture", whatever that's supposed to mean.
- clusterfish 6y agoProfitable business culture, poor engineering culture. Happens all the time in companies of all sizes.
- TeMPOraL 6y agoIn other words: a) malice, and b) a business problem, not a tech problem.
- clusterfish 6y agoAbsolutely would call this a tech culture problem. Just like e.g. not writing tests because management doesn't want to spend time on that. Doesn't mean that individual developers are to blame for this kind of decision, but it speaks for the overall culture of the tech org. Yes, often driven by business objectives.
- deleted 6y ago[deleted]
- black_puppydog 6y agoA court ruling for violation of the GDPR might go some ways there. Of course, these things move slowly. But zoom are now grown up enough that they'll have to plan on these time scales I guess.
- bilbo0s 6y ago"they don't want parts of it to stick around forever"* I don't think you're being fair. It's readily apparent that Zoom understands not to make parts of their software stick around forever. The fact that they understand this is the entire reason for setting the cookie to last only 10 years. Which is clearly not as long as forever! /s
- dylan604 6y agoZoom is not alone in this. Lots of crud gets left, and it differs between which OS it is.
- andrewnicolalde 6y agoThis looks more like them actively placing a cookie into the cookie DB upon install. Doesn't appear to be simply left behind.
- andrewnicolalde 6y ago*uninstall
- j45 6y agoI’m curious if the same is happening on Mac or Linux when uninstalling.
- 1vuio0pswjnm7 6y agoI love how when you go to enter a Zoom meeting, they bury the no-install, run-in-browser link in small type in a footer. And then, if you manage to see the link and use the browser, they withhold "Gallery View", forcing you to deal with the extremely annoying "Active Speaker View".
- edoceo 6y agoMeeting hosts can make a setting change that makes that link visible by default, so you don't have to cancel xdg-open twice (only once)
- Geezus_42 6y agocan't
- yjftsjthsd-h 6y agoCan't what?
- jefftk 6y agoThey do have a Chrome App that will run zoom in Chrome with gallery view, but they hide that even more thoroughly unless you're on ChromeOS: https://chrome.google.com/webstore/detail/zoom/hmbjbjdpkobdjplfobhljndfdfdipjhg https://chrome.google.com/webstore/detail/zoom/hmbjbjdpkobdj...
- suprfsat 6y agoTo be fair, Chrome apps are ending next year. https://blog.chromium.org/2020/08/changes-to-chrome-app-support-timeline.html https://blog.chromium.org/2020/08/changes-to-chrome-app-supp... Maybe they'll be forced to make a usable web version by then, but I doubt it.
- dylan604 6y agoNah, just one less thing to worry about by letting it go by the wayside.
- edoceo 6y agoBrief: adds cookies to Chrome on the UNinstall process. Includes a funny "everlogin" one that lasts 10yr
- ricardo81 6y agoWorth mentioning that the uninstaller sets the cookie by adapting your cookies file after reading contents of the file entirely unrelated to Zoom.
- bilbo0s 6y agoI don't even know what to say to all that. There's a point at which you're sick and tired of being sick and tired. I'm there.
- ppezaris 6y agoWorth mentioning that the author speculates that this happens not for a nefarious reason, but in a binary tree search to locate your zoom cookie.
- banana_giraffe 6y agoFurther, it's a SQLite database. It's not like it's hard to check this behavior, or instrument the database file to see exactly what it's doing. It was really odd they didn't bother. https://imgur.com/a/jBaW7RL https://imgur.com/a/jBaW7RL
- nostoc 6y agoWhat tools would you use to instrument a sqlite file in order to monitor reads?
- TeMPOraL 6y agoWhen Julia Evans wanted to learn what SQLite does, she just stuffed some printf calls into the code and rebuilt it :). https://jvns.ca/blog/2014/09/27/how-does-sqlite-work-part-1-pages/ https://jvns.ca/blog/2014/09/27/how-does-sqlite-work-part-1-... You could do similar at API entry points. Or, if you're after writes, it would be simpler to attach an "on insert/update" trigger that just records the changes in another table. See https://www.sqlite.org/undoredo.html https://www.sqlite.org/undoredo.html for an example of using triggers this way.
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- awinter-py 6y agowow as with everything that's come out about them it feels like they're trying to get the job done but with limited platform support and badly it's not absurd for a product manager to want your desktop zoom app to inherit your browser login though as a user if I saw this behavior I would have a few wtfs. But as a user I would never ever install zoom on a laptop my takeaway from this isn't GDPR implications, it's that desktop OSes need to get serious about permissions, especially filesystem walkabouts
- MrStonedOne 6y agoit does it on uninstall, not install.
- franga2000 6y ago> it's not absurd for a product manager to want your desktop zoom app to inherit your browser login Of course not, and there are many ways to do this while respecting the application boundary. In no particular order: passing a token in the launch URI, a bundled WebExtension, a local WebSocket/HTTP server, on-demand executable customization.
- DenseComet 6y agoIt's unfortunate that they bought and destroyed Keybase [1] in a bid to improve their security and even still there seems to be no improvement. Guess even the best folks can't make an impact if company culture prevents it. [1] https://github.com/keybase/client/graphs/commit-activity https://github.com/keybase/client/graphs/commit-activity
- turblety 6y agoYeah this was so sad, but I'm happy the guys that made it got paid. Even they would have known this was the end for Keybase. Hopefully when their non-compete clauses end the developers will make another product the same.
- bigiain 6y ago< Hopefully when their non-compete clauses end the developers will make another product the same. ... and it will get saddled with the reputation for trustworthiness it deserves. Sell me out once, shame on me...
- kelnos 6y ago> Yeah this was so sad, but I'm happy the guys that made it got paid. I don't really sympathize with this. You build something, get a ton of people to use it, advocate for it, get their friends to use it... I think after that, you have a responsibility to those users, and selling to a company like Zoom and then peaceing out on further work does not fulfill that responsibility.
- deleted 6y ago[deleted]
- irjustin 6y agoI argue Zoom does understand GDPR and the ePrivacy Directive from a legal perspective. The specific citation about the length of a cookie is a recommendation and not a law[0]. The key word is 'should'. I'm not a lawyer nor claim the ability to interpret GDPR legally, but I have seen companies that actively worked to edge case GDPR to their advantage (I was part of one). We would have lawyers and other 'GDPR experts' tell us what was possible and what wasn't then simply extend into the grey area. Here, I reject the Halon's Razor[1]. [0] https://gdpr.eu/cookies/#:~:text=All%20persistent%20cookies%20have%20an,you%20do%20not%20take%20action https://gdpr.eu/cookies/#:~:text=All%20persistent%20cookies%.... [1] https://en.wikipedia.org/wiki/Hanlon%27s_razor https://en.wikipedia.org/wiki/Hanlon%27s_razor
- lmkg 6y agoThe website gdpr.eu is not official. It's just a website made by some people. The length of the cookie, as far as I can tell, is not even a recommendation in the law. It's just a thing someone said on the Internet. The ePrivacy Directive requires strict consent (as defined in GDPR) in order to read or write data from a user's computer, including cookies, except were strictly necessary to provision the service. There's potentially wiggle room for throttling, which is in the name of one of the cookies. I have doubts about a cookie tracking whether you've ever logged in.
- dheera 6y agoI imagine GDPR doesn't apply to Zoom, as a non-EU company. Much like China bans what it doesn't want, the onus is on the EU to set up a GFW of their own and ban Zoom (and other GDPR-non-compliant foreign websites) if they disagree with it. Otherwise, Zoom only needs to obey the laws of USA and wherever else they have offices. Disclaimer: IANAL Also: I'm not arguing for Zoom's sketchy practices but just saying that GDPR might be the wrong card here. The EU isn't the world police.
- andrewnicolalde 6y agoI'm pretty sure GDPR applies to any companies with dealings in the EU, or at least to that company's dealings which occur within the EU. Disclaimer: IAANAL
- jjluoma 6y agoAt least zoom has privacy statement / policy page available on their web site unlike threatspike.com
- markthien 6y agoyou are damn right bro
- rndgermandude 6y agoFair point. threadspike's homepage talks about how they store data in a - according to them - secure fashion in a secure data center in London. What this tells me is that they collect data and store data. Moreover, their article tells me that they do have access to a lot of information, or else they couldn't have known about the zoom behavior if their stuff didn't phone home such information.
- markthien 6y agothreatspike.com is totally shady and shitty
- m3kw9 6y agoIt seem Zoom is so big that a small bone to pick on can yield clicks for them.
- robomc 6y agoa desktop uninstaller messing with chrome cookies isn't a small bone imo
- hkai 6y agoAre you trying to say that a Chinese app doesn't care about your privacy? That's new
- asciident 6y agoZoom is an american company by the way. Its headquarters is in silicon valley. Its founder, chairman, and CEO is an american citizen. It has employees in California and China, like nearly all tech companies.
- JumpCrisscross 6y ago> Zoom is an american company Correct. But it has significant dev in China. Corporately, it’s American. But when describing its engineering decisions, it’s fair to call it principally Chinese.
- asciident 6y agoWould you call Cisco and Dell principally Indian companies?
- andrewnicolalde 6y agoWhy not, if that’s where a majority of the teams making engineering decisions are?
- marksomnian 6y agoHow about GitLab then? The CEO is Dutch, working (AIUI) in SF, and the engineering team are all remote. The company is incorporated in the Netherlands, US, UK, and a load of other countries. Does that make them principally a Dutch, American, or ??? company?
- stunt 6y agoThat's not fair. You should look where their vision, policy , and standards are set. Engineering decisions respect those principals.
- JumpCrisscross 6y agoDoes anyone expect any consequences? It’s not like any EU member would ban Zoom in the middle of the pandemic.
- wlll 6y agoThe first step wouldn't be banning, it would be helping Zoom to be compliant, then if they were uncooperative, a fine.
- TedDoesntTalk 6y agoAs an American company, are they subject to GDPR regulations?
- yjftsjthsd-h 6y agoThey have European users and offices.
- stunt 6y agoThe fact that they operate and have revenue in the EU is enough. They are still subject to GDPR even without offices.
- aminozuur 6y ago*doesn't
- andrewnicolalde 6y agoIt caught me off guard too. The company is UK-based so it's probably a British colloquialism.
- tluyben2 6y agoAs far as I can find online, it's american street language; I only know it from US shows and Eminem (and other rap) songs. Maybe here it's used to indicate that "zoom be stupid".
- andrewnicolalde 6y agoPerhaps. I'm American but live in the UK, and I have observed how people in the UK use "don't" as opposed to "doesn't" when the thing being referred to is an organisation, I suppose with the idea of it being an organisation comprised of many people (i.e. "they don't") as opposed to an inanimate non-human entity ("it doesn't"). Still incorrect to my understanding of how English works.
- iso947 6y agoPerhaps it’s built into a different perception of what a company is. In America, I get the feeling people think more of companies (large companies) as human beings with rights (but no responsibilities), and that’s far less than the general view in the UK where the view is often they are parasites with valueless shareholders. I wonder if a company with a well known single owner (amazon/bezos, spacex/musk) is also thought of as a group Or a person subconsciously. Two countries separated by a common language
- foldr 6y agoNo, it's just that American English in general is much less free with the use of plural agreement with collective singular nouns. So e.g. "My team are" is much less acceptable in American English than in British English.
- morpheuskafka 6y agoThis is what we need app sandboxing for. No reason third-party apps should be able to read the browser's cookie database.
- andrewnicolalde 6y agoAs an aside, the Chrome cookies database on Windows is protected using the Windows Data Protection API[1], which ties encryption keys to a specific user. In the case of the Chrome cookie database, each cookie's payload/value is encrypted using a cryptographic key generated by the DPAPI which is only accessible to that Windows user. Of course, (and as is the case with most situations like this), this does absolutely nothing to protect users against malicious or intrusive programs running with the permissions of that user. So yeah, you're right. App sandboxing please. [1] https://en.wikipedia.org/wiki/Data_Protection_API https://en.wikipedia.org/wiki/Data_Protection_API
- grenoire 6y agoI thought the rule was: If you can see it plaintext on the screen, it's not safe.
- andrewnicolalde 6y agoCould you elaborate on that? Of course no computer is completely secure against all forms of attack, but I’ve found statements like these to not contribute very much towards solving any practical security problems.
- grenoire 6y agoThe moment that a string of text appears on your screen, it is passed through between many different functions (and even pieces of hardware, with textures being stored on the GPU VRAM) and has unencrypted copies laying all around in memory as the application is running. Any part of the space in which these copies exist being compromised will mean that your encryption is useless in the end.
- chromedev 6y agoGoogle Meet features seem so much better suited for government and education, especially if using G Suite on top of it. It is like the same price of Zoom but includes a lot of other great features, including unlimited storage using Google Drive.
- gojomo 6y agoI'm sure Zoom would be doing privacy-iffy things even if in full compliance with the GDPRAnd the possibility they might be surveying other cookies, and uploading them elsewhere, would be a giant concern if verified. But the specific complaint here, about a cookie with an expiration longer-than-12-months, seems pretty silly. It's not stored on some remote machine - it's stored locally, transparently. The user – and their own software – can control this easily & completely. If there's a good rationale for expiring cookies earlier, a browser can easily do it directly - it needn't involve regulators, or ineffectually hoping every one of thousands of different companies/websites do something the laws of one place ask.
- laurent92 6y agoWhy do you guys not use https://whereby.com https://whereby.com (formerly appear.in), it’s free for 4 people, in-browser only, no-login, WebRTC, allows sharing the screen alongside faces. But they made the 5+ rooms $9 per month, which is way too expensive. There are not enough competitors for WebRTC conf tools, it should be quite simple and $4-5 a month (WebRTC doesn’t incur data costs on the servers since the data is peer-to-peer).
- a13n 6y agoWe used them for a while but the quality just isn’t nearly as stable as zoom.
- dvfjsdhgfv 6y agoMaybe it's no-login, but in order to try it you need to register.
- buzer 6y ago> WebRTC doesn’t incur data costs on the servers since the data is peer-to-peer There are probably some operators that do pure p2p, but vast majority use some kind of bridge past certain number of users (& TURN might also be used for p2p). Usually this is to limit the amount of bandwidth participant needs. Another alternatives are https://meet.jit.si https://meet.jit.si & https://8x8.vc/ https://8x8.vc/. I cannot remember what was the current limit of participants in Jitsi (it was 75 back in June), but on 8x8.vc it's 100. In cases where you simply need a lot of viewers and limited number of participants there is also an option to livestream to Youtube. (Disclaimer: I work at 8x8, but not directly on Meet or Jitsi)
- sebmellen 6y ago8x8 has intrigued me, but I'm a bit confused as to what happened. Did 8x8 buy the Jitsi brand from Atlassian? And what's the benefit of 8x8 vs Jitsi pure? I might be a customer if 8x8 is a compelling alternative to Zoom without some of the downsides of Jitsi (generally less reliable).
- 6y ago
- setzer22 6y agoI find the name of the NPS_0487a3ac_throttle cookie suspicious enough, but the article does not comment on it. Is this a common practice? Throttling the website for users who uninstalled your application?
- Kiro 6y agoMaybe it's obvious but how does this break GDPR?
- stunt 6y agoYou shouldn't set a cookie without expiry date especially after user opt-out. This particular example isn't really a big issue. But, perhaps you wouldn't read it if the title was too accurate.
- robflaherty 6y agoIt doesn’t. Or if it does, no one here has yet to explain why.
- robflaherty 6y ago“Zoom cookies are firstly written when the user connects to the website zoom.us and accepts the cookies options.” That was the moment Zoom received your consent to store data transmitted by cookies. Adding a few more cookies to the pile, regardless of expiration date, doesn’t change the agreement. Rummaging round the cookie bin on uninstall is a nice find and deserves a raised eyebrow but this doesn’t really have anything to do with GDPR.
- currysausage 6y agoThis is very likely not valid consent under GDPR. Look at specific guidance on valid consent by DPAs: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
- robflaherty 6y agoCan you explain what is invalid about it? The list of functional cookie permissions on the consent opt-in specifically mentions cookies to remember log in details.
- currysausage 6y agoSure, let's have a look at Article 4 GDPR: ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her In this case, I doubt that consent is freely given (which requires a true choice on the user's part), I doubt that it is specific (that the choice is granular pertaining to different cookies fulfilling different purposes), and I doubt that it is informed (that the user understands the relevance of different cookies). Most importantly, consent given in the context of a visit of the zoom.us site cannot be specific and, at the same time, cover cookies being unexpectedly set by a local uninstall program. We are not talking about the usual session ID cookie here ("remember log in details"). Recital 43: Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, Somewhat questionable in this case. Is there a way to opt out of the specific cookie? I guess not. or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. Quite likely. Recital 42: For consent to be informed, the data subject should be aware at least of the identity of the controller and the purposes of the processing for which the personal data are intended Where does Zoom explain the purpose of the "everlogin" cookie? Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. Again, is there a way to opt out of the specific cookie? Article 7 GDPR: The data subject shall have the right to withdraw his or her consent at any time. ... It shall be as easy to withdraw as to give consent. It's quite easy to consent to cookies at zoom.us. Where, however, can a user revoke their consent? When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. I don't think it's possible to use Zoom without this (unnecessary) cookie being saved. Therefore, consent is most likely not applicable. Again, ICO guidance is a great resource: Be specific and ‘granular’ so that you get separate consent for separate things. Vague or blanket consent is not enough. Consent under GDPR simply doesn't work like "I consent to all of your cookies".
- tomschwiha 6y agoThe author is referring to the ePrivacy directive - its not the same as the GDPR. Does he mean the ePrivacy regulation? The ePrivacy regulation (not directive) is no binding law yet.
- daffy 6y agoIf you have run the native programme (for me it keeps breaking up in the browser), run it from a dedicated unpriviledged user, without installing it on the system. (Run ./opt/zoom/ZoomLauncher.) If you have to log in (I couldn't change the input device without logging in), when your browser tries to open the not installed programme, copy the link and give it as a command-line argument to ZoomLauncher. Looking forward to a working alternative.
- azepoi 6y agoI really don't like how Zoom forces the download of an executable, how doesn't this trip the antimalware? What a bad practice.
- stunt 6y agoIt's annoying when you don't have the client and you want to jump into a meeting. or you don't want to install client for different reasons. They obviously focus on pushing their client because they can offer more features and better user experience. It's easier to sell their product to you. Otherwise most web clients are limited in features which means it's harder to compete for them.
- IvanSologub 6y agoRead between the lines: a company established on the territory of a state where there is no concept of "private property" does not understand that it is impossible to collect personal data.
- franga2000 6y agoWho what now? Zoom? California? Because of that one squatting case? Whatever it is that you are referring to, it sounds political and can't possibly have anything to do with the topic at hand. Save it for a different thread.
- s_dev 6y agoIt is difficult to get a man to understand something when his salary depends upon his not understanding it. -- Upton Sinclair
- whereistimbo 6y agoWhy people still uses zoom? Something like Google Meet or Microsoft Teams are better.
- wlll 6y agoBecause in a Google meet with just one other person my computer fans spin up like crazy and the video quality is crap. With Zoom I can be in a call with many people and I don't notice my CPU fans, and the video quality is better.
- impendia 6y agoBecause it's frictionless. It's very easy to set up a Zoom meeting with anyone in the world. When I tried MS Teams, my impression was that it required a fair amount of advance configuration. This is no problem if you're meeting the same people repeatedly and they work for the same employer as you. Indeed, as the name of the software suggests, it's good for "teams". But for me, anyway, this hasn't been my typical use case.
- vultour 6y agoIt's the dropbox argument all over again. "I don't understand why people just won't use <much more complicated service>!" I've never used Teams, but my girlfriend was trying to walk her mum through getting it setup for work. It was a very long phone call. When I tried Zoom with my parents it took a grand total of about 2 minutes from the moment they get the link to being in the call, most of the time spent figuring out audio. Also, fuck Microsoft. From the complete destruction of Skype, the crappy Skype-rebranded Lync, to the shitshow that is their "Microsoft Store" and the whole xbox gaming ecosystem, if I ever have a choice between a Microsoft and non-Microsoft application that does the same thing, I'm never going with the Microsoft one.
- pbhjpbhj 6y agoZoom seems pretty high-friction vs jit.si . It forces (kinda, tricks I suppose) install of a client exe for example and IIRC requires registration. Jitsi you just follow the link, webrtc means no download.
- TheButlerian 6y agoGood, GDPR is a joke.
- deleted 6y ago[deleted]
- chrisjudice09 6y agoThis is excellent work by threatspike and we should commend/support efforts like this that help keep us informed of the sneaky and intrusive actions of certain pieces of software
- ubermonkey 6y agoMy bet is that Zoom understand the GDPR just fine, and don't care. They have repeatedly shown that they will do whatever they want, and then act contrite later if they're caught out. They are not trustworthy, and I won't run their software on any nonsandboxed environment AT ALL. There's utterly no reason to.
- johnchristopher 6y agoWhy is an uninstaller allow to access a browser's files on the first place and then modify it? There's a name for that category of software.
- caymanjim 6y agoWhile it's annoying that this is the case, pretty much all software on all commonly-used operating systems has complete access to everything. When you install software in Windows, either it installs without Administrator permissions (in which case it still has access to every single user file) or it asks for elevation to Administrator, and users blindly click Yes (in which case it has access to the entire machine). When you install software in Unix/Linux, you're almost certainly using sudo, giving up complete control. User permissions on single user systems are almost irrelevant. It's all about blind trust. People think nothing of installing software via "curl | sudo bash", or adding random PPA repositories to apt, downloading a binary and running it as root, or deploying a docker container linked from a blog. I know the risks and I do it all the time, because convenience always wins and popular things are reasonably safe due to the "mob trust" factor. MacOS has made some incremental steps to wall applications off from each other, requiring explicit authorization for some actions via System Preferences toggles, but really, it's just adding inconvenience for your average user, and people will generally blindly agree, in part because some of the categories are too vague or broad (small UI widgets that alter e.g. keyboard bindings or window placement require carte blanche). Phone operating systems are better at this than most, requiring explicit permission to access e.g. contacts, but there are still limits on how protected your data is. Most of the security on phone apps comes from the vetting required by the vendor lock-in stores. Yet we still had apps able to invisibly steal global clipboard contents until earlier this year. So, yeah, it's stupid that Zoom's uninstaller has access to browser cookies, but do you think there's a single piece of software you use that doesn't? Everything on your system has access to everything else in most cases.
- nedsma 6y agoZoom is a joke on Linux. You enter a meeting, it goes automatically into full screen mode and when you put in windowed mode, the window can get lost. Then you need to reconnect the session.
- xtat 6y agoZoom is terrible, but when you deep dive into GDPR it's pretty clear that nobody understands it.
- nojvek 6y agoHave you seen Zoom’s stock price? Wall Street don’t give a shit about security unless the company goes under due to a massive fine. Let’s accept the fact that US govt doesn’t give a shit about little privacy/security like this. EU will sometimes strike a big hammer but even that is sporadic. Zoom has built momentum on “dark growth hacks” and they’re reaping the rewards. This is standard Silicon Valley.