4 ms·

The cognitive dissonance here is amazing. How do you claim you are offering E2E as an upgrade on a product you have already claimed is E2E?

by anm89 6y ago

neltnerb 6y ago
I'm not sure it's still really cognitive dissonance when they admitted their error in marketing it that way, announced they were working on exactly this to provide what their claims said, and now they're saying it's done? Sounds like they got a sudden spike in interest, realized that their customers were angry, admitted the error, bought keybase, and provided what their customers asked them for.
- ignoramous 6y ago
  > error in marketing it that way... There's an ashtonishing lack of ethics in our industry. A marketing error here, a software bug there [1], a misleading opt-out here [2], a preinstalled malware there [3][4][5], a little violation of privacy of here [6][7], a little lack of respect there [8][9]... It's all happening all at once. We shouldn't be lapping it up. [1] https://news.ycombinator.com/item?id=24514433 https://news.ycombinator.com/item?id=24514433 [2] https://news.ycombinator.com/item?id=22531087 https://news.ycombinator.com/item?id=22531087 [3] https://news.ycombinator.com/item?id=9072424 https://news.ycombinator.com/item?id=9072424 [4] https://news.ycombinator.com/item?id=17145204 https://news.ycombinator.com/item?id=17145204 [5] https://news.ycombinator.com/item?id=3298205 https://news.ycombinator.com/item?id=3298205 [6] https://news.ycombinator.com/item?id=19031055 https://news.ycombinator.com/item?id=19031055 [7] https://news.ycombinator.com/item?id=23929044 https://news.ycombinator.com/item?id=23929044 [8] https://news.ycombinator.com/item?id=4936561 https://news.ycombinator.com/item?id=4936561 [9] https://news.ycombinator.com/item?id=14384187 https://news.ycombinator.com/item?id=14384187
  - stingraycharles 6y ago
    I hate to be that guy, but you can hardly blame them when there are hardly any consequences. I really hate what they’re doing, but the worst they get is a slap on the wrist.
    - anm89 6y ago
      No, it's very true.
    - paxys 6y ago
      They do not get even a slap on the wrist. There is literally no enforcement for any of this.
  - bigbubba 6y ago
    I blame the dumb meme of 'Hanlon's Razor'. It extols gullibility.
    - rurounijones 6y ago
      Agreed. "never attribute to malice that which is adequately explained by stupidity" basically means "Always make sure your malicious act can be adequately explained by stupidity if you get caught"
      - tialaramex 6y ago
        Here's a clever technique from the Web PKI: Stop blaming people. You don't need to care whether people are malevolent or incompetent, you can assume incompetence just fine. Intent only matters for blame, so, don't use blame. I don't actually care whether the board at Symantec were deliberately turning a blind eye to forbidden practices and then get caught or they were too incompetent to exercise effective oversight and had no idea there was a problem, we can't trust them in either case.
        rurounijones 6y ago
        Apart from in the legal system, which is supposedly where we go to sort things like this out and discourage others from doing the same thing, intent has a massive impact ( https://en.wikipedia.org/wiki/Mens_rea https://en.wikipedia.org/wiki/Mens_rea ) on the penalties you can levy to discourage said behaviour.
- wittyreference 6y ago
  Even after they got busted, I had their sells reps pitching my organization that they have proper E2E encryption, and that the public claims were mistaken. So, no. This perfectly above-board version is not what happened.
  - neltnerb 6y ago
    That is another story entirely. It's a very low bar and that still doesn't make the cut. Like a car dealership except with no rules...
  - proactivesvcs 6y ago
    IIRC their web site wasn't updated to reflect the facts, either. In my opinion this means they lied twice - one after being caught out.
- Fnoord 6y ago
  > [...] bought keybase [...] I missed that one, thanks for the heads up (found sources @ [1]). Between that and Keybase going into cryptcurrency, that means I uninstalled Keybase and quit using it. [1] https://en.wikipedia.org/wiki/Keybase#cite_note-12 https://en.wikipedia.org/wiki/Keybase#cite_note-12
Spooky23 6y ago
Zoom is guilty of alot of stupid stuff, but the "E2E" controversy is the among the dumber controversies. Zoom's characterization of end to end was referring to the transport layer between the clients and Zoom service endpoint. The more serious issue there was that until a point in the recent past, they weren't using an appropriate cipher mode. E2E in the sense that security nerds bang their chests about isn't what customers want. Boards of directors of public companies, some attorneys, and some others need it. Almost nobody else does. It means that you don't have cloud recording, can't use POTS phones to connect to the meetings, etc. People with those needs have security controls beyond the software, so they probably need something like Webex, or should be using directly connected room systems. Someone who needs E2E for real reasons aren't doing it from home, for example, as you need to take other measures to protect that meeting content.
- atonse 6y ago
  You've pushed this narrative a couple times in these threads that only nerds care. That's like saying only car mechanics care about kind of oil that goes into your car. Yeah I mean nerds care because nerds know the difference. This is not something where nerds caring about e2e is at odds with what everyone benefits from. Better security benefits everyone without taking away from the experience. There's absolutely _nothing_ preventing recording while having end-to-end encryption. It just means the recording happens at one of the ends and can be uploaded. Hell, you could even go as far as storing the encrypted streams, and then decrypt on the device during playback. The keybase people especially have experience with messages that are encrypted so that only a handful of recipients can decrypt it. The POTS line, I'm less sure about. But I'm still a little iffy about it, since everything is VoIP now. But that may not matter.
  - Spooky23 6y ago
    You cannot do cloud recording, which is usually preferable for companies. If you look at 100 Webex customers, who have access to a high quality E2E capability, you’ll find 3-5 (outside the military) who have ever used it. You cannot do service-side POTS integration unless you integrate with an on premises PBX and restrict external calls. I’ve been on teams designing high security collaboration environments. E2E is a need for specific use cases only — the user endpoint is usually a bigger risk. Nobody with that need is considering Zoom!

The cognitive dissonance here is amazing. How do you claim you are offering E2E as an upgrade on a product you have already claimed is E2E?

by anm89 6y ago

The cognitive dissonance here is amazing. How do you claim you are offering E2E as an upgrade on a product you have already claimed is E2E?

neltnerb 6y ago

I'm not sure it's still really cognitive dissonance when they admitted their error in marketing it that way, announced they were working on exactly this to provide what their claims said, and now they're saying it's done? Sounds like they got a sudden spike in interest, realized that their customers were angry, admitted the error, bought keybase, and provided what their customers asked them for.

ignoramous 6y ago
> error in marketing it that way... There's an ashtonishing lack of ethics in our industry. A marketing error here, a software bug there [1], a misleading opt-out here [2], a preinstalled malware there [3][4][5], a little violation of privacy of here [6][7], a little lack of respect there [8][9]... It's all happening all at once. We shouldn't be lapping it up. [1] https://news.ycombinator.com/item?id=24514433 https://news.ycombinator.com/item?id=24514433 [2] https://news.ycombinator.com/item?id=22531087 https://news.ycombinator.com/item?id=22531087 [3] https://news.ycombinator.com/item?id=9072424 https://news.ycombinator.com/item?id=9072424 [4] https://news.ycombinator.com/item?id=17145204 https://news.ycombinator.com/item?id=17145204 [5] https://news.ycombinator.com/item?id=3298205 https://news.ycombinator.com/item?id=3298205 [6] https://news.ycombinator.com/item?id=19031055 https://news.ycombinator.com/item?id=19031055 [7] https://news.ycombinator.com/item?id=23929044 https://news.ycombinator.com/item?id=23929044 [8] https://news.ycombinator.com/item?id=4936561 https://news.ycombinator.com/item?id=4936561 [9] https://news.ycombinator.com/item?id=14384187 https://news.ycombinator.com/item?id=14384187
- stingraycharles 6y ago
  I hate to be that guy, but you can hardly blame them when there are hardly any consequences. I really hate what they’re doing, but the worst they get is a slap on the wrist.
  - anm89 6y ago
    No, it's very true.
  - paxys 6y ago
    They do not get even a slap on the wrist. There is literally no enforcement for any of this.
- bigbubba 6y ago
  I blame the dumb meme of 'Hanlon's Razor'. It extols gullibility.
  - rurounijones 6y ago
    Agreed. "never attribute to malice that which is adequately explained by stupidity" basically means "Always make sure your malicious act can be adequately explained by stupidity if you get caught"
    - tialaramex 6y ago
      Here's a clever technique from the Web PKI: Stop blaming people. You don't need to care whether people are malevolent or incompetent, you can assume incompetence just fine. Intent only matters for blame, so, don't use blame. I don't actually care whether the board at Symantec were deliberately turning a blind eye to forbidden practices and then get caught or they were too incompetent to exercise effective oversight and had no idea there was a problem, we can't trust them in either case.
      - rurounijones 6y ago
        Apart from in the legal system, which is supposedly where we go to sort things like this out and discourage others from doing the same thing, intent has a massive impact ( https://en.wikipedia.org/wiki/Mens_rea https://en.wikipedia.org/wiki/Mens_rea ) on the penalties you can levy to discourage said behaviour.
wittyreference 6y ago
Even after they got busted, I had their sells reps pitching my organization that they have proper E2E encryption, and that the public claims were mistaken. So, no. This perfectly above-board version is not what happened.
- neltnerb 6y ago
  That is another story entirely. It's a very low bar and that still doesn't make the cut. Like a car dealership except with no rules...
- proactivesvcs 6y ago
  IIRC their web site wasn't updated to reflect the facts, either. In my opinion this means they lied twice - one after being caught out.
Fnoord 6y ago
> [...] bought keybase [...] I missed that one, thanks for the heads up (found sources @ [1]). Between that and Keybase going into cryptcurrency, that means I uninstalled Keybase and quit using it. [1] https://en.wikipedia.org/wiki/Keybase#cite_note-12 https://en.wikipedia.org/wiki/Keybase#cite_note-12

Spooky23 6y ago

Zoom is guilty of alot of stupid stuff, but the "E2E" controversy is the among the dumber controversies. Zoom's characterization of end to end was referring to the transport layer between the clients and Zoom service endpoint. The more serious issue there was that until a point in the recent past, they weren't using an appropriate cipher mode. E2E in the sense that security nerds bang their chests about isn't what customers want. Boards of directors of public companies, some attorneys, and some others need it. Almost nobody else does. It means that you don't have cloud recording, can't use POTS phones to connect to the meetings, etc. People with those needs have security controls beyond the software, so they probably need something like Webex, or should be using directly connected room systems. Someone who needs E2E for real reasons aren't doing it from home, for example, as you need to take other measures to protect that meeting content.

atonse 6y ago
You've pushed this narrative a couple times in these threads that only nerds care. That's like saying only car mechanics care about kind of oil that goes into your car. Yeah I mean nerds care because nerds know the difference. This is not something where nerds caring about e2e is at odds with what everyone benefits from. Better security benefits everyone without taking away from the experience. There's absolutely _nothing_ preventing recording while having end-to-end encryption. It just means the recording happens at one of the ends and can be uploaded. Hell, you could even go as far as storing the encrypted streams, and then decrypt on the device during playback. The keybase people especially have experience with messages that are encrypted so that only a handful of recipients can decrypt it. The POTS line, I'm less sure about. But I'm still a little iffy about it, since everything is VoIP now. But that may not matter.
- Spooky23 6y ago
  You cannot do cloud recording, which is usually preferable for companies. If you look at 100 Webex customers, who have access to a high quality E2E capability, you’ll find 3-5 (outside the military) who have ever used it. You cannot do service-side POTS integration unless you integrate with an on premises PBX and restrict external calls. I’ve been on teams designing high security collaboration environments. E2E is a need for specific use cases only — the user endpoint is usually a bigger risk. Nobody with that need is considering Zoom!