25 ms·
Zoom lied to users about end-to-end encryption for years, FTC says
- eddieoz 6y ago"[S]ince at least 2016, Zoom misled users by touting that it offered 'end-to-end, 256-bit encryption' to secure users' communications, when in fact it provided a lower level of security," the FTC said today in the announcement of its complaint against Zoom and the tentative settlement. Despite promising end-to-end encryption, the FTC said that "Zoom maintained the cryptographic keys that could allow Zoom to access the content of its customers' meetings, and secured its Zoom Meetings, in part, with a lower level of encryption than promised." That's the concept of E2Z2EE (End2Zoom2End Encryption)
- xiphias2 6y agoCustomers or users? There’s a huge difference between the 2, and this excerpt uses the 2 words like if those were interchangeable.
- joombaga 6y agoWhat's the difference? Aren't they the same group of people in this context?
- rsstack 6y agoFree users are not customers.
- xiphias2 6y agoI'm sorry, I'm not a native English speaker. According to the Oxford dictionary customers are people who buy a product or service. Zoom was thinking of giving only them E2E encryption, and actually I would pay for that service if I would trust Zoom. Currently I use telegram to speak with my friends, but the call drops quite often as we don't have stable internet connection.
- bigbubba 6y agoMaybe, since you admit your English language skills could use some work, you should give up on linguistic pedantry and find a new hobby.
- xiphias2 6y agoIf my English here is so bad why do I see ,,end user'' in Zoom's terms of license all the time, and customer for paying customers? Can you provide a better legal definition than what I see? (Only the legal meaning of the word matters in the current context). We're talking about hundreds of millions of people being effected vs few million people, it matters a lot. You would understand that it's very far from pedantry if you followed all announcements that Zoom had in the past.
- oarsinsync 6y agoI think a better distinction is 'paying customers' and 'non-paying customers'. Customers being a subset of users after all makes it a bit ambiguous. Not that it should matter in the context of the feature being described.
- xiphias2 6y agoI'm still not a native English speaker, but a Google search shows that non-paying customers are people who don't pay their bills, which is not the same thing as users who don't have bills to pay. Also as I wrote, Zoom was thinking of selling E2E encryption as a payed feature, that's why the distinction really matters (I would happily pay for it if that would give me a strong assurance that I just don't have so far).
- pc86 6y agoNon-paying customers can mean either customers who are delinquent in paying their bills, or customers that are using the service for free with permission.
- selimthegrim 6y agoNon-revenue customers for the latter (from airlines)
- bshipp 6y agoI don't think I'd happily pay for Zoom, regardless of their encryption promises. I've personally struggled more with zoom call quality issues and hardware conflicts than I have with any other video conference provider.
- olyjohn 6y agoAlso anecdotally, I hear the opposite from every single person I know. Zoom has been the video conferencing system that works the best. Have you ever used Go2Meeting, WebEx, Teams? Constant struggles with those applications for me, my friends, and my co-workers.
- feralimal 6y agoNo! Corporations lie?! At least their feet will held to the fire! /s Tbh though, they will only be held to account, if another big player wants to cripple them and take their market.
- Quarrelsome 6y agoSo will they get fined more than Snapchat for lying about ephemeral messaging or will this be the usual American "slap on the wrist" thing we usually see to protect the investors?
- eddieoz 6y agoIn a world where US and EU are willing to ban Signal because it doesn't allow a 'master key', Zoom is the BFF of governments and regulators.
- danielscrubs 6y agoWhat? ” The European Commission has told its staff to switch to the encrypted Signal messaging app in a move that’s designed to increase the security of its communications.” This was February 2020, has something changed?
- macrolime 6y agoYes https://news.ycombinator.com/item?id=25028411 https://news.ycombinator.com/item?id=25028411
- thrwyoilarticle 6y agoThe EU isn't a single individual. It isn't even a group of individuals with aligned interests. As such, its many different heads shouldn't be expected to have consistent messaging. This is a draft so, as of now, it's factually untrue to say the EU are willing to ban encryption.
- ckocagil 6y agoThat's encryption for the state, not for us peasants.
- matheusmoreira 6y agoCan the govenment somehow restrict end-to-end encrypted messaging to officials only?
- londons_explore 6y agoIf Zoom made clear to users that connections were not secured to the same standards as competitors, and that potentially hundreds of employees could be silently listening in on any call, I think that would have prevented them becoming a leader in video conference tech. So the right fine here is their entire market cap. That would put them back at square one, which is where an honest competitor would be right now.
- me_me_me 6y agoSure, that sounds like fair solution. But that's not how capitalism works. You can be honest business or you can steal billions, get caught and pay a millions in fines. I think everyone can see a problem here. You pay back less then you stole so this is an active encouragement to steal. Most recent example, morgan stanley fraud for bilions in profit pays fine of 1.5 mil [0]. Reality is borrowing from Kafka. [0] https://coinweek.com/bullion-report/morgan-stanley-mitsubishi-to-pay-almost-2-million-for-spoofing-precious-metals-futures/ https://coinweek.com/bullion-report/morgan-stanley-mitsubish...
- amelius 6y agoTotally agree, and this should hold for any kind of illegal growth hacking.
- johannes1234321 6y agoIs it really different from competitors like Cisco (webex, jabber, ...)? A big selling point of all those is phone dial in which can't be done with e2e encryption (the phone gateway run by the operator has to have the keys)
- thesimon 6y agoThe thing is: Our team doesn't use phone dial-in, haven't even seen the feature so I guess it's not enabled, but still we don't have e2e encryption. That doesn't make sense.
- johannes1234321 6y ago
- meowface 6y agoAll they had to do was say "encrypted" instead of explicitly saying "end-to-end encrypted" when it very clearly wasn't end-to-end. The former still could've been a bit weaselly and misleading (many non-technical users would probably have assumed "encrypted" implied total confidentiality), but what they actually did was so much worse. I hope they get hit hard on that.
- sizt 6y agoZoom lied. People spied.
- macspoofing 6y ago>People spied. Did they? Which people? When? How?
- carapace 6y agoThat's kind of the point isn't it? You can't know, because it wasn't actually e2ee, eh? That's the harm. Also, think of the competitors of zoom who lost customers to them due to their lying, that's a harm too, eh? These are hard to quantify but they're not nothing.
- crazygringo 6y agoWell, we can know. It was encrypted, but not E2EE, so the only person who could have spied was Zoom itself, and we know the how too - by the same mechanism it performs a video recording, for example. We just don't know if. But seeing as we've had zero reports of any real-world consequences that could only have come about by Zoom spying, combined with the fact that "spying on your customers" is anathema to your business model and therefore a risk no sane and rational board of directors would ever approve (moderate upside, enormous possibly business-ending downside if ever discovered)... Occam's Razor says no spying ever occurred.
- raxxorrax 6y ago
- throwaway4good 6y agoI thought they made a deal with Trump/Oracle and that fixed all this stuff?
- simonh 6y agoYou're thinking of Tiktok.
- throwaway4good 6y agoFrom https://www.cnbc.com/2020/04/15/oracles-larry-ellison-calls-zoom-an-essential-service.html https://www.cnbc.com/2020/04/15/oracles-larry-ellison-calls-... : Along with is growth in users, Zoom has seen concerns spike about how it is protecting users’ privacy. The Senate advised members not to use the service, according to Ars Technica and the New York City Department of Education banned its use for remote learning. A group of state attorneys general are probing the company after one of the officials was “zoombombed” on a forum about the Census, meaning the chat box was filled with profanities. Ellison’s support could prove useful to Zoom as it wades through the new challenges of becoming a consumer tech company. Ellison is an influential billionaire with ties to the Trump administration. He has supported Trump’s campaign and even told the President about an anti-malaria drug Trump ended up touting as a possible treatment for the coronavirus, according to The New York Times. Oracle CEO Safra Catz served on Trump’s transition team in 2016.
- simonh 6y agoSo Ellison 'supports' Zoom, but as far as I can tell the connection with Trump is pure speculation.
- throwaway4good 6y agoIt is was a prelude to what happened to TikTok. Or almost happened to TikTok as now with the Trump administration is gone, it makes no sense to do a deal with Oracle.
- aofeisheng 6y agoAll E2E encryption claims in closed source software are untrustworthy. What're you expecting?
- intricatedetail 6y agoEven with open source software you will never know what is actually running on the servers. It's best to assume none of the services are e2e encrypted and you should provide your own encryption on top of the medium you communicate with if you require privacy. By own encryption I mean exchanging keys and encrypting offline using oss tools.
- _-___________-_ 6y ago> Even with open source software you will never know what is actually running on the servers. If the clients are open-source and properly implement end-to-end encryption, and you verify that they are not sending your keys to the servers, then what is running on the servers is irrelevant.
- DangerousPie 6y ago... if you have the technical expertise to audit the full source code, and run and audit your own build (on both ends).
- _-___________-_ 6y agoSure, but that's a different argument than what parent was making.
- hajile 6y agoI'm qualified to audit loads of software I don't have the time to write myself.
- intricatedetail 6y agoBut they may run modified software e.g. with added backdoors and you wouldn't know as you cannot check what is actually running on servers.
- roenxi 6y agoPretty scandalous stuff. But to be fair it seems pretty likely that any or all of the major players (Apple, Google, MS, Facebook, AWS, etc) to be maintaining some sort of back-door access to the channels they control for spying purposes. I suppose the risk with Zoom is leaks due to incompetence rather than leaks due to government intervention.
- _-___________-_ 6y agoApple claims that FaceTime is end-to-end encrypted (and makes some pretty strong statements about not having access to the content of communications). Facebook similarly claims that WhatsApp is end-to-end encrypted. Whilst I have little love for either company, do you have any evidence that these claims are lies?
- aborsy 6y agoI thought the lesson is clear. All e2e claims with closed source software must be dismissed by default. The burden of proof is on the seller.
- _-___________-_ 6y agoI mean, I agree with you, and I guess the "surely Apple is not blatantly lying about being unable to read the content of your communication" argument has eroded a bit after Zoom's behaviour. But the penalties (both in terms of reputation and in terms of monetary fines) for this kind of misbehaviour are already large, and are likely to increase over time, and it seems an unnecessarily extreme risk for these companies to take. But yes, impossible-to-verify claims are not worth very much at all.
- jfrunyon 6y agoI don't... did you even read TFA? All the order says is that they can't lie about it again. They don't have to pay anything, they don't have to actually fulfill their prior claims, and the other parts of the agreement they likely already comply with, and if not it'll be quite cheap (relatively) to do so.
- 0xy 6y agoWhy would any company with valuable IP use Zoom after this security blunder, along with the fact they "accidentally" routed domestic US calls via China. Zoom is software developed almost entirely in China, meaning it is subject to Chinese law and the very strong influence of the CCP. It is fact to say that Zoom could be compelled by the CCP to plant backdoors in software to siphon valuable IP for use by Chinese companies, as is usually the case with CCP-aligned companies like Huawei (Huawei had a cash incentive program for employees who delivered stolen IP to them).
- intricatedetail 6y agoMany companies work WFH these days, so intercepting dev and r&d meeting would be a dream for CCP. Can't see why they wouldn't do it.
- lixtra 6y ago(Industrial) Espionage is the ius prima noctis of superpowers. http://cryptome.org/echelon-nh.htm http://cryptome.org/echelon-nh.htm
- buryat 6y agoDoes it open Zoom to being sued by clients? If a company signed a contract with Zoom in which e2e encryption was stated.
- hatmatrix 6y agoLike a class action lawsuit? I think there have to be evidence of damage done in that case.
- tpxl 6y agoYou can sue directly, no? The damage should be easy, you thought you bought something and weren't delivered it, so just refund all costs.
- kube-system 6y agoMost of what was purchased was delivered.
- mikro2nd 6y ago"Here are the keys to your new car" "Where are the wheels?" "Well... we delivered most of what was purchased so you don't get to complain."
- kube-system 6y agoGood example. If you bought a $40k car and it didn't come with wheels, the damages would be the amount to remedy the missing wheels, not $40k.
- vict00ms 6y agoI don't think the example vindicates you in the manner you believe. The damages would surely exceed the missing wheels if resolved in the courtroom.
- deleted 6y ago[deleted]
- smokey_circles 6y agoI don't understand how the FTC arrived at the conclusion they're not E2E? Or have I missed something? >Despite promising end-to-end encryption, the FTC said that "Zoom maintained the cryptographic keys that could allow Zoom to access the content of its customers' meetings, and secured its Zoom Meetings, in part, with a lower level of encryption than promised." Not wonderful but that still, technically, is an E2E encryption scheme. Is it not? Or do they mean one end terminates in Zoom's servers and it's not E2E through the whole pipe, but rather two pipes stitched together? Agreed it's not as secure as they marketed, but this seems to suggest if you want to offer E2E you need a specific kind of key storage to meet this new precedent. Good in practice, but maybe the FTC are not the right people to placing such a hurdle down? I'm sure I've missed something though.
- viraptor 6y agoI'm not sure what you mean by "you need a specific kind of key storage". You don't need any kind of key storage for e2e. You only need to facilitate the key exchange as a server, then push the opaque data both ways. If zoom (the company, not the software client) can get the encryption key, the call is not e2e encrypted.
- smokey_circles 6y ago>If zoom (the company, not the software client) can get the encryption key, the call is not e2e encrypted Ah, thank you. That was the bit I was missing. Silly question I know but I couldn't wrap my head around the wording
- krageon 6y agoWhat kind of hurdle do you see? What you've described isn't e2e encryption, the FTC is absolutely correct. The FTC not doing something unreasonable here, I would wager you are by implying they're placing undue hardship on a company that peddles bald-faced lies.
- thesimon 6y agoThe zoom definition of E2E is that the one end is one user and the other end is the zoom server. At no point is there encryption directly from one user to anothre.
- a_nar 6y agoI saw this on /r/privacy a few hours ago. Funny how things from reddit can appear on HN, and vice-versa
- tester34 6y agoWhat's wrong/funny with that? Both are news "aggregators"
- micropoet 6y agoIs this the reason stock price going down? or Covid vaccine?
- joeblau 6y agoI wonder if this is the source for any “leaks” from tech companies who use Zoom as their office communication tool?
- jtdev 6y agoThe relationship between Zoom and China should outright disqualify it from being used in any Democratic countries.
- Dahoon 6y agoI don't see how democracy has anything to do with wanting to secure video calls or not but anyways, how is this worse than trusting anything from the US? Not trying to add whataboutism, but curious if you have the same look on security when made by companies that share data with someone that realistically could come after you for anything done in those calls. PRC clearly can't unless you live in PRC while the FBI and CIA operate in most of the world, more often than not hand in hand with local police or agencies.
- jtdev 6y agoDid the Polish scoff at the rise of the third reich simply because their existed a line on a map dividing Germany and Poland?
- themacguffinman 6y agoNo, instead they target political dissidents and find any possible family you might have in China and threaten to hurt them if you don't either return to the PRC or commit suicide [1], much better. [1] https://en.wikipedia.org/wiki/Operation_Fox_Hunt https://en.wikipedia.org/wiki/Operation_Fox_Hunt
- cfstras 6y agoWhat other popular group video meeting tools are e2e? I know of none. I remember reading a while back that Zoom claimed a few times they were e2e-encrypted, but what they meant was transport encryption.
- izacus 6y agoBetween others mentioned here there's also Google Duo, but it's not really a meeting tool but a FaceTime competitor.
- Aachen 6y agoIf you want my popular products then nobody can answer because you'd know of them already. So I'll generalize to what group video tools are e2ee: -> Jami (according to their website, I only ever used their chat and regular one-on-one calls) -> Wire (client and server open source, but not community-lead development) -> WhatsApp (if you trust Facebook, proprietary back-end) And if you consider open source & on-premises / "can be completely locked off from the Internet so only you can access it" software to be end to end encrypted (if you personally run the server, you're one of the endpoints): -> Jitsi Meet (full e2ee is under development, collab with Matrix I think) -> BigBlueButton -> Apache OpenMeetings (I never used this one, can't vouch for it) Signal and Threema don't do group calls as far as I can quickly find online, correct me if I'm wrong. Anyhow, plenty of options whether you like to self host (saves a ton of CPU on encryption and lets the server do stream mixing) or have full end to end encryption. Why do you care whether they're used by a billion people / "popular"? You can still choose to use them and improve the status quo because why not?
- cfstras 6y ago- I was looking for "desktop-solutions" comparable to Zoom, so WhatsApp and Telegram are out of the question (Telegram doesn't do group calls AFAICS). Some notes: - Wire has published a detailed whitepaper on e2ee. https://wire-docs.wire.com/download/Wire+Security+Whitepaper.pdf https://wire-docs.wire.com/download/Wire+Security+Whitepaper... - Jami (formerly GNU Ring) has an interesting post about having e2e here: https://security.stackexchange.com/a/162603/243716 https://security.stackexchange.com/a/162603/243716 - Jitsi e2e is testable, but they note that it's not completely finished. Key exchange has to be done manually. - https://github.com/bigbluebutton/bigbluebutton/issues/9893 https://github.com/bigbluebutton/bigbluebutton/issues/9893 suggests BigBlueButton don't have e2e yet - Wikipedia claims "no encryption protocol" for OpenMeetings https://en.wikipedia.org/wiki/Apache_OpenMeetings https://en.wikipedia.org/wiki/Apache_OpenMeetings --- So that leaves Wire and Jami. Thanks for the info!
- noyoukhkh 6y agoif security is that much important to you, your company may be you, your company should build a communication platform for itself right!? you, people should believe or trust no one! thats the number one rule for [e2e, or else] security I think.
- boomboomsubban 6y agoThe "trust no-one" mantra would still apply to your own team, and unless you're putting tons of money into this project a free software platform us probably more trustworthy. There's more risk of outside infiltration but also far more bug checking and security testing.
- zelphirkalt 6y agoHmmm, why am I not surprised right now?
- WhyNotHugo 6y agoI find it amusing that congress is seeking to ban E2EE, yet the FTC fining a company that lied about doing it.
- koheripbal 6y agoIt's not really a contradiction if you think about it.
- kevmo 6y agoYep. They're fining the customer fraud, not the lack of E2EE. I wish executives would start going to jail over this stuff. Bet they'd stop lying to their customers then.
- WhyNotHugo 6y agoYeah, I get the impression that if some guy frauds a bunch of rich guys, he goes to jail, but if a corporation frauds millions of users, they're just politely asked to behave.
- kevmo 6y agoIndeed. The government basically says "Please give us 1% of the profit you made from defrauding millions, and we will call it a day."
- pluc 6y agoWhere is the consequences addendum?
- rwmurrayVT 6y agoThere are none.
- einpoklum 6y agoZoom is also in the habit of censoring content it doesn't approve of politically: https://www.insidehighered.com/quicktakes/2020/10/27/zoom-faces-more-allegations-censorship https://www.insidehighered.com/quicktakes/2020/10/27/zoom-fa... so, drop Zoom, use a Free and Open-Source alternative. Example: Jitsi (jitsi.org) . It has more rough edges, but it works.
- kevincox 6y ago> Zoom has agreed to a requirement to establish and implement a comprehensive security program, a prohibition on privacy and security misrepresentations, and other detailed and specific relief to protect its user base What a slap on the wrist. "You blatantly lied to your customers for years. How about you just continue to implement the thing that you were working on anyways." I don't think punishment is always the best solution but it seems that you should at least set some sort of example.
- gmd63 6y agoPunishment is the best solution. Incentives are what drive behavior, and learning that you can get away with lying will just lead to more getting away with lying.
- acbart 6y agoWhen it comes to training humans and animals, positive punishment is far less effective than most other training techniques like positive reinforcement. Don't Shoot the Dog[1]! [1] https://www.amazon.com/Dont-Shoot-Dog-Teaching-Training/dp/0553380397 https://www.amazon.com/Dont-Shoot-Dog-Teaching-Training/dp/0...
- jvanderbot 6y agoUnfortunately, the positives are customer adoption, and customers have already adopted zoom. This is like continuing to feed the dog treats because it's what you're used to, regardless of the outcome of their actions. But more generally, it's not obvious that individual, "reptile-brain" incentives translate to large company leadership. I'd be hugely skeptical of applying positive psychology to international corporate leadership, but what do I know anyway.
- unityByFreedom 6y agoAgree with your first paragraph, less so the second. People learn corporate leadership in steps, starting with a small group. The style of successful leadership doesn't change IMO, just the number of variables and possibility for greater success/failure.
- upofadown 6y agoI think the assumed implication with E2EE is that no one other than the partcipants can get at the content of your communications. To do that you need: 1. All cryptographic keys controlled by the users. 2. Some way to confirm you are actually connected to who you think you are connected to. 3. A way to confirm that the code you are running is not leaking keys/content. So Zoom failed on all 3 points. There are lots of things out there claiming E2EE that fail on one or more of these points. Almost all fail on point 2 unless the user does things that they almost never do. Is the FTC going to come up with a E2EE definition for trade and start prosecuting those that don't meet that definition? Otherwise it would seem unfair that they only went after the entity that ended up in the general media.
- pbronez 6y ago> almost all fail on point 2 unless the user does things that they almost never do Are you referring to the "scan this QR code to verify your partner's key" function in secure messaging apps? I definitely use that. I try to keep all my primary contact's keys verified. It's harder during COVID when you're not meeting up in person as often, because anything besides meeting in person and verifying the two devices directly exposes you to another unverified channel. It's very hard to bootstrap this stuff. Sure, "web of trust" but that's hard too. Speaking of which, didn't Keybase get bought by zoom to help with exactly these issues?
- upofadown 6y ago>Are you referring to the "scan this QR code to verify your partner's key" function in secure messaging apps? Yes. Or read the weird numbers/letters over the phone. Or look at the strange image and compare it somehow. For all I know there is something out there that wants you to compare a tune...
- DaiPlusPlus 6y agoThat still requires you to trust the client software. I trust Telegram’s E2E, but not Zoom - unless Zoom’s client is on GitHub with deterministic build steps?
- _jal 6y agoA deeper issue is how hard it is to "know" if companies hawking products with security implications (which is nearly everything, today) are lying. I'm not even talking about the gradient ranging from innocent bugs to incompetent coders and how that gets papered over. When you buy shoddy physical goods, there are typically characteristics you can't hide, like cheap materials. But with software like this of course the only function your average person can verify is that the transmission happens, not how it is encoded. Neither Grandma nor your manager are likely to break out tcpdump to check. And of course the DMCA complicates this in the US, and things are even worse for researchers elsewhere. Third party audit and reputation are the only fixes I see. And the second one requires a commercial environment that rewards it. The current one doesn't; it rewards novelty and lies, so that's what we get.
- okprod 6y agoFreely licensed software would allow for audits.
- ineedasername 6y agoAs long as you audit both the software and the implementation.
- phone8675309 6y agoAny software you don't have the source for, haven't built yourself, and don't host yourself is immediate suspect. Third party audits aren't a silver bullet. Enron and Worldcom had third party audits.
- forgotmypw17 6y agoI agree. I am writing my project a certain way to achieve a goal I call reimplementability. This means that I try to design in such a way that a reasonably competent dev could sit down and rewrite the whole system in a couple hours/days/weeks.
- _jal 6y ago
- vinniejames 6y agoDon't forget the hidden web server fiasco https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5 https://medium.com/bugbountywriteup/zoom-zero-day-4-million-...
- martinknapic 6y agoThat's quite a claim.
- morpheuskafka 6y agoPretty ridiculous for the US to be enforcing this while they try to ban and reduce availability of E2EE worldwide. Zoom et all are doing them a great service by spreading FUD and confusion about what E2EE even is. Once it's reduced to "complex math thing" in people's minds no one will know or care when they ban it.
- some_random 6y agoThe US has more than one actor in it, only some of them care about E2EE. This is true for literally everywhere.
- ineedasername 6y agoCompanies that make claims like this should provide an external audit to support their claims.
- bborud 6y agoOver the past decade I've had to deal with a lot of executives and security people who don't actually understand security all that well. Or at all. (Not that I'm a security expert, but that hardly makes it better when even I can see that something is nonsense). Right now I know of at least half a dozen products that are marketed as having E2E encryption but do not actually implement this (no, I'm not going to out them. See second to last paragraph as to when to be wary). In part because executives, marketers and salespeople don't know what it means. And in part because when explained what it means they will insist on their own definition/interpretation and demand the product is marketed as E2E. It is also important to note that quite often you are not dealing only with the company that makes a product, but the regulatory bodies that can pressure companies into complying with their wishes. As for Zoom, I don't understand why people trust them or still use their product if they are at all concerned about security. It makes very little sense.
- qazxcvbnmlp 6y agoMy boss is one of those people. He insists to our customers (and engineers) our product has encryption. It does not.
- dspillett 6y agoI strongly recommend attempting to fix that and/or (while I am aware that it may be difficult in the current climate) searching for a new boss. In the meantime be very careful to monitor anything your name is associated with, just in case any of your customers get wind of the situation and sue-balls are thrown.
- atn89 6y agohad a boss that marketed our product as having AI solutions while it had nothing to do with AI, lol.
- Jasper_ 6y agoGiven how most actual AI solutions work under the hood, this might not even be a lie!
- m3kw9 6y agoOld news, is just FTC judgement but security has already proven that back in April it wasn’t E2E
- 120photo 6y agoOh no, a company based out of China lied to everyone? Say it ain't so.
- YinglingLight 6y agoYou guyz, look at how CCP sponsored TikTok users trolled Trump this time!!1
- hubbabubbarex 6y agoZoom, Google,twitter, Facebook what's common? All lies about your privacy and you still keep using these scammy services? Why???
- hubbabubbarex 6y agoHN ease shadowbann me
- frabjoused 6y agoFew years ago I noticed BBM Enterprise touts end-to-end encryption pretty strongly in their marketing, without mentioning an up-front caveat. https://www.blackberry.com/us/en/products/bbm-enterprise https://www.blackberry.com/us/en/products/bbm-enterprise Turns out that by default, BBME is not end-to-end. The initial handshake is transparent to Blackberry, and they could use that to decrypt future messages without your knowledge. To enable true end-to-end, you have to opt in to an out of band handshake to start each new conversation, an option you can turn on in their admin console. How many people are actually going to opt in to dealing with a confirmation SMS for every new thread? I reached out to Blackberry at the time to update their literature as it was misleading, but no action was taken by them.
- dane-pgp 6y agoBlackBerry has always been untrustworthy when it comes to encryption: > The defence in the case surmised that the RCMP must have used the "correct global encryption key," since any attempt to apply a key other than BlackBerry's own global encryption key would have resulted in a garbled mess. According to the judge, "all parties"—including the Crown—agree that "the RCMP would have had the correct global key when it decrypted messages during its investigation." https://www.vice.com/en/article/mg77vv/rcmp-blackberry-project-clemenza-global-encryption-key-canada https://www.vice.com/en/article/mg77vv/rcmp-blackberry-proje...
- peterwwillis 6y agoThis is like suing Hillshire Farms because their bacon wasn't as maple-honey-bourbon-flavored as they claimed. Nobody is buying bacon just for flavoring. People use Zoom because it's a free digital telephone with screen sharing. Not because it's super duper secure. Telephones (VoIP, PSTN, SMS, etc) do not have end-to-end encryption - or any encryption - and we've been using them for conferences since always. Hell, we use them for Zoom calls! This is some kind of government vendetta, probably pushed by Zoom's competitors who make a bundle in government contracts. Because they're currently the biggest provider, they're the biggest target. But this standard has not been (and will not be) held up to any of its competitors who make similar claims. The political party that is sabre-rattling in this article is just making themselves look good to their constituents.
- temp667 6y agoI was never confused, but am more technical. I mean, how do you terminate to POTS, do the mix-ins etc without zoom decrypting on their end? If it's E2E encrypted and I have a dial in number - it's not E2E in that sense.
- golemotron 6y ago> Democrats blast FTC/Zoom settlement because users won't get compensation. Are they the same people who want to get rid of encryption?
- ahmetyas01 6y agowhy the servers are in Chine ? For asia market or for communist part?
- benkarst 6y agoOh you know that private video chat that that literally everyone uses, it's not private. How is this getting almost no attention from the ms media?
- residentfoam 6y agofake it until you make it
- 29athrowaway 6y agoCompanies that mine data from users will often mislead users when it comes to privacy. e.g.: "You have control over your data"... no, you don't.
- minusSeven 6y agoI guess fake till you make it is name of the game these days. But if that is really the case why did we vilify companies like Theranos or Edison. I have often wondered if I should do it at work as well.
- X86IpodInsame 6y agoChinse
- cwkoss 6y agoEvery business customer should now sue zoom for the full cost of what they previously paid.
- zzo38computer 6y agoThere are (at least) two points, I think: - Open protocols would be helpful. Then you can implement it by yourself and you can see if it is encrypted (and implement whatever other features you may need, including saving energy). - If they lied to users about end-to-end encryption, then it is false advertising. It is important to avoid false advertising.
- lilyball 6y ago> Amid controversy in July 2019, Zoom issued an update to completely remove the Web server from its Mac application, as we reported at the time. Surprised to see them mention the web server thing and not mention that it was so bad that Apple actually updated its antivirus software to remove the Zoom web server.
- mrtweetyhack 6y agoChinese company. They also own Keybase. Think before you use.
- PradeetPatel 6y agoIt's situations like this that makes me wonder whether there should be more efforts put into education and awareness regarding ethics in software engineering. We teach ethics to other STEM disciplines such as biotechnology and aeronautics, why is it left out of software engineering?
- airlust 6y agoWe had a course on it as part of my degree, I believe it was required for the course to be accredited by the BCS (British Computer Society), but I could be wrong on - this was over 25 years ago.
- vmception 6y ago2020 Zoom lied about end to end encryption 2021 Nobody can have end to end encryption
- jimnotgym 6y agoDisrupting an industry seems to mean breaking the rules. When there is no financial penalty it must be read as a tacit approval from government.
- spacemanmatt 6y agoWill they pay a dime in penalties or backlash for their fraud against consumers? No. Because we nerds aren't holding organizational leaders accountable for their IT staffer's choices and diligence owed to purchases.
- tsjq 6y agoHow long before it is discovered that such fake encryption led to some killings / illegal arrests or meddling with Elections ?
- BlueTemplar 6y agoIt's kind of funny to put this article in parallel with this one : https://news.ycombinator.com/item?id=25028411 https://news.ycombinator.com/item?id=25028411 Where the EU is planning to add backdoors to E2E services.
- tripu 6y agoI'm not in the least surprised. Think of other popular messaging systems that claim to offer some kind of E2EE, but are proprietary software: WhatsApp, Skype, FB Messenger, Viber, Threema, Line… Distrust by default! I am always amazed when folks even consider the alleged support for strong E2E encryption in those apps… the value of those claims is exactly zero.
- T3RMINATED 6y agoOver the past decade I've had to deal with a lot of executives and security people who don't actually understand security all that well. Or at all. (Not that I'm a security expert, but that hardly makes it better when even I can see that something is nonsense). Right now I know of at least half a dozen products that are marketed as having E2E encryption but do not actually implement this (no, I'm not going to out them. See second to last paragraph as to when to be wary). In part because executives, marketers and salespeople don't know what it means. And in part because when explained what it means they will insist on their own definition/interpretation and demand the product is marketed as E2E. It is also important to note that quite often you are not dealing only with the company that makes a product, but the regulatory bodies that can pressure companies into complying with their wishes. As for Zoom, I don't understand why people trust them or still use their product if they are at all concerned about security. It makes very little sense.
- deleted 6y ago[deleted]
- slostar 6y agoSo the takeaway here, there isn't real significant consequence for this kind of stuff. Can I just create startup and store passwords in plaintext and lie about it so that I can focus on the core user facing features of the product? Once we get big enough I'll just hire some security engineers to do things right. I'm exaggerating a bit with the above example, but how much corners can someone cut and how much lies can they get away with when it comes to security? Because finding the right balance seems like a serious competitive advantage in the startup space.