15 ms·

Over the past decade I've had to deal with a lot of executives and security people who don't actually understand security all that well. Or at all. (Not that

by bborud 6y ago

Over the past decade I've had to deal with a lot of executives and security people who don't actually understand security all that well. Or at all. (Not that I'm a security expert, but that hardly makes it better when even I can see that something is nonsense). Right now I know of at least half a dozen products that are marketed as having E2E encryption but do not actually implement this (no, I'm not going to out them. See second to last paragraph as to when to be wary). In part because executives, marketers and salespeople don't know what it means. And in part because when explained what it means they will insist on their own definition/interpretation and demand the product is marketed as E2E. It is also important to note that quite often you are not dealing only with the company that makes a product, but the regulatory bodies that can pressure companies into complying with their wishes. As for Zoom, I don't understand why people trust them or still use their product if they are at all concerned about security. It makes very little sense.

qazxcvbnmlp 6y ago
My boss is one of those people. He insists to our customers (and engineers) our product has encryption. It does not.
- dspillett 6y ago
  I strongly recommend attempting to fix that and/or (while I am aware that it may be difficult in the current climate) searching for a new boss. In the meantime be very careful to monitor anything your name is associated with, just in case any of your customers get wind of the situation and sue-balls are thrown.
- atn89 6y ago
  had a boss that marketed our product as having AI solutions while it had nothing to do with AI, lol.
  - Jasper_ 6y ago
    Given how most actual AI solutions work under the hood, this might not even be a lie!
    - wil421 6y ago
      Our system has an AI module. AI module: If something Else if something else Else if Else if ... Else Call Human
      - TeMPOraL 6y ago
        We practice responsible and safe approach to AI, by detecting situations the AI can't handle and deferring to human response. (It just so happens that the set of things the AI can handle is empty.)
      - Jasper_ 6y ago
        To be honest, before the modern machine learning approach, this was known as a decision tree and was thought to be a valid way to approach "artificial intelligence". Lots of "AI" hype in the 80s was based around "Expert systems" and "Decision trees".
        zelphirkalt 6y ago
        And there are even modern tree based approaches, that beat some of the modern artificial neural network approaches! It's not like it has become an absolutely unusable class of algorithms.
        FridgeSeal 6y ago
        People seem to think that the presence of neural nets and deep learning means that most of types of models are practically superseded whereas in my experience if some non-deep-learning model even gets you mostly there, then the efficiency and explain-ability wins make it worth it. At my previous job I had a ML-based service that used a basic random-forest model instead of a neural net because it was faster to train and operate, not to mention easier to maintain and had equivalent accuracy with little to no effort required on my part. It was a solid little service.
  - BlueTemplar 6y ago
    AI is pretty meaningless. Any computer program or robot-executed algorithm can be called AI.
- vorpalhex 6y ago
  I would have a conversation with your companies legal department.
  - cortesoft 6y ago
    A lot of startups don't have a legal department.
dspillett 6y ago
> It is also important to note that quite often you are not dealing only with the company that makes a product, but the regulatory bodies that can pressure companies into complying with their wishes. While considering the regulatory requirements helps explain the desire to lie, it does not make the lie any more defensible. Even if a regulatory body is making impractical demand, I very much doubt they are demanding companies lie to their users and potential users. Even if they were "just following orders guv" is not an acceptable excuse. The key facts: Zoom lied. They didn't have to. They could have accurately reported what encryption they use and what they were working towards if that was due to change. Even if we accept that the initial claims were wrong due to executives misunderstanding what their own security/dev people had stated, that doesn't defend continuing to make the claim without seeking further clarity after questions were raised.
- dheera 6y ago
  Unless there was a gag order. We should make gag orders unconstitutional.
  - NeutronStar 6y ago
    Gag orders don't force you to state wrong facts about your products in the first place.
    - rational_indian 6y ago
      What if they do?
      - dspillett 6y ago
        Then it is not a gag order. A gag order means "don't say anything about X" and is not concerned with what you might or might not say instead.
      - thw0rted 6y ago
        Look up "warrant canary". IANAL, but my understanding is that you can be secretly compelled to not speak, but you cannot be legally compelled to actively tell a lie -- the Wikipedia page agrees with my interpretation. So, you can just publish "I am not subject to a gag order" every day until you are subject to one.
desilentio 6y ago
> As for Zoom, I don't understand why people trust them or still use their product if they are at all concerned about security. It makes very little sense. I certainly don't trust them, but I do use Zoom (from a dedicated unprivileged user, so it can't do any harm beyond recording my conversations), because my colleagues use Zoom, and because there doesn't seem to be any working alternative. I got them to try Jitsi once, which simply didn't work. PS. There may be working /secret-source/ alternatives, but I don't know why one should think Zoom /more/ untrustworthy than them.
- robotnikman 6y ago
  Cisco Webex is used in my workplace. We forbid anyone from installing Zoom over security concerns
  - pbhjpbhj 6y ago
    What specific concerns that aren't also relevant to Webex?
- wil421 6y ago
  As another poster said, the very large company I work at bans Zoom. We can use Teams, Webex, Skype, etc. How can you say there is no alternative?
  - desilentio 6y ago
    Sorry, I didn't think in terms of degrees of untrustworthiness. What I miss is an open-source alternative. Doesn't Microsoft let the NSA tap into Skype calls?
    - acoard 6y ago
      >Doesn't Microsoft let the NSA tap into Skype calls? Yes, but it seems like Skype was doing that prior to being acquired (though Microsoft seems to have accelerated things). From some quick Googling to refresh on PRISM – >• In July last year, nine months after Microsoft bought Skype, the NSA boasted that a new capability had tripled the amount of Skype video calls being collected through Prism; >• Microsoft helped the NSA to circumvent its encryption to address concerns that the agency would be unable to intercept web chats on the new Outlook.com portal; >Eight months before being bought by Microsoft, Skype joined the Prism program in February 2011. > According to the NSA documents, work had begun on smoothly integrating Skype into Prism in November 2010, but it was not until 4 February 2011 that the company was served with a directive to comply signed by the attorney general. https://www.theguardian.com/world/2013/jul/11/microsoft-nsa-collaboration-user-data https://www.theguardian.com/world/2013/jul/11/microsoft-nsa-...
wsinks 6y ago
Hi there! I'm in the video meeting space, and always looking to find that blend between usable and secure. I'm curious - is there a video service out there you would recommend if you're conscious about security? Your third paragraph makes me think your opinion will be that no large company can be trusted, because they become a target for nation-state regulatory bodies.
- bborud 6y ago
  Yes, although there are degrees and differences in culture. For instance in the telco world you have a much more direct dependence on regulators because you need a stack of expensive and hard to acquire licenses to operate a network in most parts of the world. Some worse than others. In that environment there is a very high degree of compliance with regulators because they have to be given explicit permission to operate. For pure internet services or P2P applications it is quite a bit different. You don't actually need anyone's permission to distribute software. And you can move your servers around the world. You don't depend on permission - just that nobody comes after you with warrants you cannot ignore. So the advice is really to look at who you are dealing with and how dependent they are on regulators to operate. Large internet companies tend to have entire divisions whose job it is to tell regulators to get lost or at the very least maintain a really high bar for interference. Of course, this becomes difficult when the government is also a large customer. So for instance you might want to be careful with vendors who make a lot of money in / off of the defense and intelligence sectors.
  - wsinks 6y ago
    Thank you for the explanation! Seems to me that you're describing a trust chain where the product is directly affected by the landscape in which the parent company operates and their biggest customer base. I really appreciate your insight.
- atsmyles 6y ago
  Use Jitsi (https://jitsi.org https://jitsi.org). You can find people to host or host your own. Open Source. No downloads for participants. try their instance meet.jit.si
snarf21 6y ago
You answered your own question in your last statement. People don't care about security. They care about it being easy to use and Zoom works better and for more (non-technical) users than any other tool of its kind.
- dnautics 6y ago
  For a long time zoom was the best choice for technical users too, as webex, Skype, and everything except for google hangouts had terrible Linux support.
soulofmischief 6y ago
Regulation should prevent this from occurring. If you use a product that claims it is E2E and it is not, you should be able to sue wildly for potential damages given the sensitive nature of the software.
- WalterBright 6y ago
  > Regulation should prevent this from occurring. It already exists. It's called "fraud".
  - soulofmischief 6y ago
    On one level, yes. On the other hand, I think things involving cryptography at scale ought to come with regulations on language For example, look at how the word "bank" is specially regulated by most governments. I can't just call myself a bank without meeting specific guidelines or else it's not just typical fraud, it's major financial fraud coupled with putting sensitive customer data at risk. Same here. We need specific legislation targeting these scummy businesses who use corporate ignorance as an excuse for selling a product under false pretenses of end-to-end encryption.
    - Drakim 6y ago
      Exactly. Look at what Zoom is doing, they simply redefined end2end to mean something else so that they could brag about having it.
- bborud 6y ago
  Well, there might be conflicting interests within government. From a consumer advocate perspective government might want to demand this. From an intelligence services perspective you might want companies to lie.
  - soulofmischief 6y ago
    > From an intelligence services perspective you might want companies to lie. No, I don't. I don't want companies to lie. You can collect intelligence the same way we've been collecting intelligence for our entire history on this planet prior to E2E comms. E2E isn't a hindrance, it's a way to enforce limitations on government overreach. No freedom is without compromise.
QueensGambit 6y ago
"In part because executives, marketers and salespeople don't know what it means." Being a technical founder, I found some non-technical founders use this an advantage. They can lie to customers without guilt or investors with brimming confidence about their "MVP". They can use "making it simple" or "ignorance" as an excuse, if at all they get caught. These kind of lies are grey lines and exist everywhere.
- rutthenut 6y ago
  Have also encountered founders that know the difference, but lie about things by using 'weasel words' that are chosen to suit their audience, who may not be so knowledgeable :(
- Frost1x 6y ago
  I've worked with these types of people and what I've noticed is, even after you explain to them simply what they're saying is false, they insist or pushing those statements or as close to those labels as they can. They may even be angry after you inform them because they lose plausible deniability. I've also been in situations where an ultimatum like E2E encryption is dictated by a marketing team and then expected to be created without adequate budgeting or time, essentially creating pressures on development teams, project/product managers, etc to lie. The conclusion I've come to in business is that ultimately, your product or service is going to be falsely advertised and oversold one way or another. It's a lot easier for some to lie, act deceitful, and/or feign ignorance than it is to actually deliver. Your competitors are doing it, if you don't, you lose. The way I deal with this nonsense is that I make it a point at least once in meeting or fairly tracable record like an email that others know what is and isn't true once and it's up to them to decide who they want to lie to. I've been on the other side being pressured to lie and its not fun so I'll happily pass that responsibility. I didn't pursue a career in computing to be a constant liar, I'll let the people who want to lie, lie.
  - whatshisface 6y ago
    >Your competitors are doing it, if you don't, you lose. What's far more interesting to me is the fact that your vendors are doing it. I wonder how much business efficiency could be gained by taking advantage of the fact that we all know the products our businesses are buying are oversold?
kryogen1c 6y ago
> I don't understand why people trust them or still use their product if they are at all concerned about security. I've been a Zoom apologist from the beginning, and this is the money shot for me. What exactly do you mean by "security"? You're concerned zoom servers are recording your video - on purpose or because theyre compromised? thats too much data to dragnet (even for the NSA), so you think the servers are recording and theyre targeting your meeting specifically? the threat model here is very small and very specific. who are the ultrasecret sensitive information folks buying the newest, shiniest, unvetted tool for use where infosec matters? i bought zoom because the ui has simple, big, colorful buttons for my unskilled users where g2m et al. are just a little too complicated. if i needed an SLA specifying encryption models because of "security", I'd have a contract I could sue over. yes, zoom was wrong. they did a wrong thing, but the outcry against them has just been disproportionate.
- areoform 6y ago
  My therapist uses Zoom for her clients, as she was assured that the E2E would help her meet HIPAA requirements and protect her patients. If someone can get a transcript of what was said, let alone record, in these therapy sessions, they'd have a goldmine to blackmail from. Please note, this has legal significance for her and other doctors, who'd started seeing patients over Zoom. So it's not just an abstract, "lulz security" There are people out there with different threat models from you. Please refrain from talking about use cases you may not understand.
  - kryogen1c 6y ago
    > E2E would help her meet HIPAA requirements e2e is not a hipaa requirement. > So it's not just an abstract, "lulz security" by all means, show me all the concrete harm zoom has done.
    - wizzwizz4 6y ago
      > e2e is not a hipaa requirement. But HIPAA does (iirc) require not having arbitrary third-parties to communication. E2E prevents that, but if there wasn't E2E… fairly sure Zoom isn't meant to be a third-party to therapy sessions. > by all means, show me all the concrete harm zoom has done. “Oh, they built houses badly? Show me all the concrete harm that's done.” We might not know until the next (metaphorical) earthquake.
antonzabirko 6y ago
Tell us!
NDizzle 6y ago
Oh man I had a great one last week. We're migrating stuff to a cloud provider, and they wanted to expose an internal only API to the internet so that the things could reach it. I was strongly against that, as it has no security involved at all. Fast and loose and all of that. Two, count them, two people wanted to "just change it to use port 443, that way it's encrypted". I had to explain that you could pick any valid TCP port to pass TCP traffic, but simply changing a nonstandard port to "443" doesn't automatically make it start being encrypted. I had to explain that several times in order for it to sink in.
- vngzs 6y ago
  If it's AWS, the quickest path to doing this securely is AWS API Gateway mTLS authN[0]. You generate some certs, stuff the public halves in S3, slap an ACM cert on the Gateway, and you're done. I have also used certificate authentication on TLS-terminating reverse proxies (e.g., this is easy to do with HAProxy) to do the same in other environments. You can pin the API's certificate on the client end in order to further reduce MITM risks. If you don't want to supply a client certificate in your client application, Stunnel[1] is an acceptable wrapper that lets your clients remain TLS-unaware. You could use it for both ends of the tunnel, if you felt like it. Either way, you end up with a secure tunnel through the internet to the proxy, at which point you're back inside private networks. (Source: I build this kind of thing for a living.) [0]: https://aws.amazon.com/blogs/compute/introducing-mutual-tls-authentication-for-amazon-api-gateway/ https://aws.amazon.com/blogs/compute/introducing-mutual-tls-... [1]: https://www.stunnel.org/auth.html https://www.stunnel.org/auth.html
  - NDizzle 6y ago
    Thanks a lot for this comment. I really appreciate it. That mTLS solution is something that would solve this problem immediately.
  - MayeulC 6y ago
    I'd just like to point out that it's also very easy to do on most reverse proxies. Client cert, or even regular password protection. Client certs are quite easy to setup. Create a CA cert, sign client certs with it, and allow only clients who have a cert signed by you. Client cert on Nginx: https://fardog.io/blog/2017/12/30/client-side-certificate-authentication-with-nginx/ https://fardog.io/blog/2017/12/30/client-side-certificate-au... Bonus about client certs: https://drewdevault.com/2020/06/12/Can-we-talk-about-client-side-certs.html https://drewdevault.com/2020/06/12/Can-we-talk-about-client-...
nsgi 6y ago
> As for Zoom, I don't understand why people trust them or still use their product if they are at all concerned about security. It makes very little sense. Phone calls and text messages aren't particularly secure either, doesn't stop people using them
- whomst 6y ago
  At least phone calls are protected by law in some capacities (HIPAA allows for faxing but not email, warrants are supposed to be required for tapping phone lines but not email, etc)
  - mjevans 6y ago
    Faxes are "exempt", not secure. The intent was that they die off sooner rather than later.
dheera 6y ago
> As for Zoom, I don't understand why people trust them or still use their product if they are at all concerned about security. It makes very little sense. Actually it makes a lot of sense. Your boss sends you a Zoom link and asks you to install Zoom. Or you're having a meeting with the CEO of some company and they send you a Zoom link, saying it's the only thing their company uses. Or you are a high school student learning online and your teacher only delivers lectures on Zoom. Most people listen to their bosses and superiors instead of protesting their viewpoints about security. Only privileged people can protest. Others just lose their jobs, or don't get their high school diploma. No, it's not right, but it is the reality.
iamacyborg 6y ago
> In part because executives, marketers and salespeople don't know what it means. And in part because when explained what it means they will insist on their own definition/interpretation and demand the product is marketed as E2E. This sounds like precisely how Grammarly claim they're not a keylogger by trying to change the very definition of what a keylogger is.
1vuio0pswjnm7 6y ago
"As for Zoom, I don't uderstand why people trust them or still use their product if they are at all concerned about security." Perhaps the term "security" suffers from the same problem as "E2E encryption".
ProAm 6y ago
> As for Zoom, I don't understand why people trust them or still use their product if they are at all concerned about security. The same reason I use Slack, because I have to.
TwoBit 6y ago
Disagree. Engineers of that system surely knew it wasn't E2E and voiced it, but marketing purposely lied. I will bet my farm on that.
- bborud 6y ago
  For Zoom I suspect you are right. I think the engineers know what it means. But I have met a disturbing number of engineers (in security oriented jobs) who do not understand what the term means.
mschuster91 6y ago
> And in part because when explained what it means they will insist on their own definition/interpretation and demand the product is marketed as E2E. That is the moment when one calls up the corporate lawyer and asks about "false advertising"...
wesleywt 6y ago
It doesn't make sense to a computer savvy hacker news poster perspective. But to everyone else, the reason they use it because they don't really care or thought about it. It will continue to be the most popular meeting app despite the wailing and gnashing from Hacker News.
- sdoering 6y ago
  I see my significant other using it on a nearly daily basis. She started a uiversity course in her 30ies and due to Corona is in her second semester from home. The university has a MS365 license free for all students, but for video lectures nobody uses it. Why? Because it is really, really cumbersome to use compared to zoom. Teachers and students alike love the functionality, the quality of video/sound and esp. the ease of use. Compared to all other solutions available to students and teachers - in terms of what they all want to use Zoom just blows the competition out of the water. And who is to blame them? These are regular folks. They wouldn't even care, if the lectures were tranmitted in the clear, without any encryption. Most regular students fresh out of school I talked to don't even know the difference between https/http, why it is important to have encryption or what end-to-end means. It has no meaning to nearly all of them.

by bborud 6y ago

qazxcvbnmlp 6y ago

My boss is one of those people. He insists to our customers (and engineers) our product has encryption. It does not.

dspillett 6y ago
I strongly recommend attempting to fix that and/or (while I am aware that it may be difficult in the current climate) searching for a new boss. In the meantime be very careful to monitor anything your name is associated with, just in case any of your customers get wind of the situation and sue-balls are thrown.
atn89 6y ago
had a boss that marketed our product as having AI solutions while it had nothing to do with AI, lol.
- Jasper_ 6y ago
  Given how most actual AI solutions work under the hood, this might not even be a lie!
  - wil421 6y ago
    Our system has an AI module. AI module: If something Else if something else Else if Else if ... Else Call Human
    - TeMPOraL 6y ago
      We practice responsible and safe approach to AI, by detecting situations the AI can't handle and deferring to human response. (It just so happens that the set of things the AI can handle is empty.)
    - Jasper_ 6y ago
      To be honest, before the modern machine learning approach, this was known as a decision tree and was thought to be a valid way to approach "artificial intelligence". Lots of "AI" hype in the 80s was based around "Expert systems" and "Decision trees".
      - zelphirkalt 6y ago
        And there are even modern tree based approaches, that beat some of the modern artificial neural network approaches! It's not like it has become an absolutely unusable class of algorithms.
        FridgeSeal 6y ago
        People seem to think that the presence of neural nets and deep learning means that most of types of models are practically superseded whereas in my experience if some non-deep-learning model even gets you mostly there, then the efficiency and explain-ability wins make it worth it. At my previous job I had a ML-based service that used a basic random-forest model instead of a neural net because it was faster to train and operate, not to mention easier to maintain and had equivalent accuracy with little to no effort required on my part. It was a solid little service.
- BlueTemplar 6y ago
  AI is pretty meaningless. Any computer program or robot-executed algorithm can be called AI.
vorpalhex 6y ago
I would have a conversation with your companies legal department.
- cortesoft 6y ago
  A lot of startups don't have a legal department.

dspillett 6y ago

> It is also important to note that quite often you are not dealing only with the company that makes a product, but the regulatory bodies that can pressure companies into complying with their wishes. While considering the regulatory requirements helps explain the desire to lie, it does not make the lie any more defensible. Even if a regulatory body is making impractical demand, I very much doubt they are demanding companies lie to their users and potential users. Even if they were "just following orders guv" is not an acceptable excuse. The key facts: Zoom lied. They didn't have to. They could have accurately reported what encryption they use and what they were working towards if that was due to change. Even if we accept that the initial claims were wrong due to executives misunderstanding what their own security/dev people had stated, that doesn't defend continuing to make the claim without seeking further clarity after questions were raised.

dheera 6y ago
Unless there was a gag order. We should make gag orders unconstitutional.
- NeutronStar 6y ago
  Gag orders don't force you to state wrong facts about your products in the first place.
  - rational_indian 6y ago
    What if they do?
    - dspillett 6y ago
      Then it is not a gag order. A gag order means "don't say anything about X" and is not concerned with what you might or might not say instead.
    - thw0rted 6y ago
      Look up "warrant canary". IANAL, but my understanding is that you can be secretly compelled to not speak, but you cannot be legally compelled to actively tell a lie -- the Wikipedia page agrees with my interpretation. So, you can just publish "I am not subject to a gag order" every day until you are subject to one.

desilentio 6y ago

> As for Zoom, I don't understand why people trust them or still use their product if they are at all concerned about security. It makes very little sense. I certainly don't trust them, but I do use Zoom (from a dedicated unprivileged user, so it can't do any harm beyond recording my conversations), because my colleagues use Zoom, and because there doesn't seem to be any working alternative. I got them to try Jitsi once, which simply didn't work. PS. There may be working /secret-source/ alternatives, but I don't know why one should think Zoom /more/ untrustworthy than them.

robotnikman 6y ago
Cisco Webex is used in my workplace. We forbid anyone from installing Zoom over security concerns
- pbhjpbhj 6y ago
  What specific concerns that aren't also relevant to Webex?
wil421 6y ago
As another poster said, the very large company I work at bans Zoom. We can use Teams, Webex, Skype, etc. How can you say there is no alternative?
- desilentio 6y ago
  Sorry, I didn't think in terms of degrees of untrustworthiness. What I miss is an open-source alternative. Doesn't Microsoft let the NSA tap into Skype calls?
  - acoard 6y ago
    >Doesn't Microsoft let the NSA tap into Skype calls? Yes, but it seems like Skype was doing that prior to being acquired (though Microsoft seems to have accelerated things). From some quick Googling to refresh on PRISM – >• In July last year, nine months after Microsoft bought Skype, the NSA boasted that a new capability had tripled the amount of Skype video calls being collected through Prism; >• Microsoft helped the NSA to circumvent its encryption to address concerns that the agency would be unable to intercept web chats on the new Outlook.com portal; >Eight months before being bought by Microsoft, Skype joined the Prism program in February 2011. > According to the NSA documents, work had begun on smoothly integrating Skype into Prism in November 2010, but it was not until 4 February 2011 that the company was served with a directive to comply signed by the attorney general. https://www.theguardian.com/world/2013/jul/11/microsoft-nsa-collaboration-user-data https://www.theguardian.com/world/2013/jul/11/microsoft-nsa-...

wsinks 6y ago

Hi there! I'm in the video meeting space, and always looking to find that blend between usable and secure. I'm curious - is there a video service out there you would recommend if you're conscious about security? Your third paragraph makes me think your opinion will be that no large company can be trusted, because they become a target for nation-state regulatory bodies.

bborud 6y ago
Yes, although there are degrees and differences in culture. For instance in the telco world you have a much more direct dependence on regulators because you need a stack of expensive and hard to acquire licenses to operate a network in most parts of the world. Some worse than others. In that environment there is a very high degree of compliance with regulators because they have to be given explicit permission to operate. For pure internet services or P2P applications it is quite a bit different. You don't actually need anyone's permission to distribute software. And you can move your servers around the world. You don't depend on permission - just that nobody comes after you with warrants you cannot ignore. So the advice is really to look at who you are dealing with and how dependent they are on regulators to operate. Large internet companies tend to have entire divisions whose job it is to tell regulators to get lost or at the very least maintain a really high bar for interference. Of course, this becomes difficult when the government is also a large customer. So for instance you might want to be careful with vendors who make a lot of money in / off of the defense and intelligence sectors.
- wsinks 6y ago
  Thank you for the explanation! Seems to me that you're describing a trust chain where the product is directly affected by the landscape in which the parent company operates and their biggest customer base. I really appreciate your insight.
atsmyles 6y ago
Use Jitsi (https://jitsi.org https://jitsi.org). You can find people to host or host your own. Open Source. No downloads for participants. try their instance meet.jit.si

snarf21 6y ago

You answered your own question in your last statement. People don't care about security. They care about it being easy to use and Zoom works better and for more (non-technical) users than any other tool of its kind.

dnautics 6y ago
For a long time zoom was the best choice for technical users too, as webex, Skype, and everything except for google hangouts had terrible Linux support.

soulofmischief 6y ago

Regulation should prevent this from occurring. If you use a product that claims it is E2E and it is not, you should be able to sue wildly for potential damages given the sensitive nature of the software.

WalterBright 6y ago
> Regulation should prevent this from occurring. It already exists. It's called "fraud".
- soulofmischief 6y ago
  On one level, yes. On the other hand, I think things involving cryptography at scale ought to come with regulations on language For example, look at how the word "bank" is specially regulated by most governments. I can't just call myself a bank without meeting specific guidelines or else it's not just typical fraud, it's major financial fraud coupled with putting sensitive customer data at risk. Same here. We need specific legislation targeting these scummy businesses who use corporate ignorance as an excuse for selling a product under false pretenses of end-to-end encryption.
  - Drakim 6y ago
    Exactly. Look at what Zoom is doing, they simply redefined end2end to mean something else so that they could brag about having it.
bborud 6y ago
Well, there might be conflicting interests within government. From a consumer advocate perspective government might want to demand this. From an intelligence services perspective you might want companies to lie.
- soulofmischief 6y ago
  > From an intelligence services perspective you might want companies to lie. No, I don't. I don't want companies to lie. You can collect intelligence the same way we've been collecting intelligence for our entire history on this planet prior to E2E comms. E2E isn't a hindrance, it's a way to enforce limitations on government overreach. No freedom is without compromise.

QueensGambit 6y ago

"In part because executives, marketers and salespeople don't know what it means." Being a technical founder, I found some non-technical founders use this an advantage. They can lie to customers without guilt or investors with brimming confidence about their "MVP". They can use "making it simple" or "ignorance" as an excuse, if at all they get caught. These kind of lies are grey lines and exist everywhere.

rutthenut 6y ago
Have also encountered founders that know the difference, but lie about things by using 'weasel words' that are chosen to suit their audience, who may not be so knowledgeable :(
Frost1x 6y ago
I've worked with these types of people and what I've noticed is, even after you explain to them simply what they're saying is false, they insist or pushing those statements or as close to those labels as they can. They may even be angry after you inform them because they lose plausible deniability. I've also been in situations where an ultimatum like E2E encryption is dictated by a marketing team and then expected to be created without adequate budgeting or time, essentially creating pressures on development teams, project/product managers, etc to lie. The conclusion I've come to in business is that ultimately, your product or service is going to be falsely advertised and oversold one way or another. It's a lot easier for some to lie, act deceitful, and/or feign ignorance than it is to actually deliver. Your competitors are doing it, if you don't, you lose. The way I deal with this nonsense is that I make it a point at least once in meeting or fairly tracable record like an email that others know what is and isn't true once and it's up to them to decide who they want to lie to. I've been on the other side being pressured to lie and its not fun so I'll happily pass that responsibility. I didn't pursue a career in computing to be a constant liar, I'll let the people who want to lie, lie.
- whatshisface 6y ago
  >Your competitors are doing it, if you don't, you lose. What's far more interesting to me is the fact that your vendors are doing it. I wonder how much business efficiency could be gained by taking advantage of the fact that we all know the products our businesses are buying are oversold?

kryogen1c 6y ago

> I don't understand why people trust them or still use their product if they are at all concerned about security. I've been a Zoom apologist from the beginning, and this is the money shot for me. What exactly do you mean by "security"? You're concerned zoom servers are recording your video - on purpose or because theyre compromised? thats too much data to dragnet (even for the NSA), so you think the servers are recording and theyre targeting your meeting specifically? the threat model here is very small and very specific. who are the ultrasecret sensitive information folks buying the newest, shiniest, unvetted tool for use where infosec matters? i bought zoom because the ui has simple, big, colorful buttons for my unskilled users where g2m et al. are just a little too complicated. if i needed an SLA specifying encryption models because of "security", I'd have a contract I could sue over. yes, zoom was wrong. they did a wrong thing, but the outcry against them has just been disproportionate.

areoform 6y ago
My therapist uses Zoom for her clients, as she was assured that the E2E would help her meet HIPAA requirements and protect her patients. If someone can get a transcript of what was said, let alone record, in these therapy sessions, they'd have a goldmine to blackmail from. Please note, this has legal significance for her and other doctors, who'd started seeing patients over Zoom. So it's not just an abstract, "lulz security" There are people out there with different threat models from you. Please refrain from talking about use cases you may not understand.
- kryogen1c 6y ago
  > E2E would help her meet HIPAA requirements e2e is not a hipaa requirement. > So it's not just an abstract, "lulz security" by all means, show me all the concrete harm zoom has done.
  - wizzwizz4 6y ago
    > e2e is not a hipaa requirement. But HIPAA does (iirc) require not having arbitrary third-parties to communication. E2E prevents that, but if there wasn't E2E… fairly sure Zoom isn't meant to be a third-party to therapy sessions. > by all means, show me all the concrete harm zoom has done. “Oh, they built houses badly? Show me all the concrete harm that's done.” We might not know until the next (metaphorical) earthquake.

antonzabirko 6y ago

Tell us!

NDizzle 6y ago

Oh man I had a great one last week. We're migrating stuff to a cloud provider, and they wanted to expose an internal only API to the internet so that the things could reach it. I was strongly against that, as it has no security involved at all. Fast and loose and all of that. Two, count them, two people wanted to "just change it to use port 443, that way it's encrypted". I had to explain that you could pick any valid TCP port to pass TCP traffic, but simply changing a nonstandard port to "443" doesn't automatically make it start being encrypted. I had to explain that several times in order for it to sink in.

vngzs 6y ago
If it's AWS, the quickest path to doing this securely is AWS API Gateway mTLS authN[0]. You generate some certs, stuff the public halves in S3, slap an ACM cert on the Gateway, and you're done. I have also used certificate authentication on TLS-terminating reverse proxies (e.g., this is easy to do with HAProxy) to do the same in other environments. You can pin the API's certificate on the client end in order to further reduce MITM risks. If you don't want to supply a client certificate in your client application, Stunnel[1] is an acceptable wrapper that lets your clients remain TLS-unaware. You could use it for both ends of the tunnel, if you felt like it. Either way, you end up with a secure tunnel through the internet to the proxy, at which point you're back inside private networks. (Source: I build this kind of thing for a living.) [0]: https://aws.amazon.com/blogs/compute/introducing-mutual-tls-authentication-for-amazon-api-gateway/ https://aws.amazon.com/blogs/compute/introducing-mutual-tls-... [1]: https://www.stunnel.org/auth.html https://www.stunnel.org/auth.html
- NDizzle 6y ago
  Thanks a lot for this comment. I really appreciate it. That mTLS solution is something that would solve this problem immediately.
- MayeulC 6y ago
  I'd just like to point out that it's also very easy to do on most reverse proxies. Client cert, or even regular password protection. Client certs are quite easy to setup. Create a CA cert, sign client certs with it, and allow only clients who have a cert signed by you. Client cert on Nginx: https://fardog.io/blog/2017/12/30/client-side-certificate-authentication-with-nginx/ https://fardog.io/blog/2017/12/30/client-side-certificate-au... Bonus about client certs: https://drewdevault.com/2020/06/12/Can-we-talk-about-client-side-certs.html https://drewdevault.com/2020/06/12/Can-we-talk-about-client-...

nsgi 6y ago

> As for Zoom, I don't understand why people trust them or still use their product if they are at all concerned about security. It makes very little sense. Phone calls and text messages aren't particularly secure either, doesn't stop people using them

whomst 6y ago
At least phone calls are protected by law in some capacities (HIPAA allows for faxing but not email, warrants are supposed to be required for tapping phone lines but not email, etc)
- mjevans 6y ago
  Faxes are "exempt", not secure. The intent was that they die off sooner rather than later.

dheera 6y ago

> As for Zoom, I don't understand why people trust them or still use their product if they are at all concerned about security. It makes very little sense. Actually it makes a lot of sense. Your boss sends you a Zoom link and asks you to install Zoom. Or you're having a meeting with the CEO of some company and they send you a Zoom link, saying it's the only thing their company uses. Or you are a high school student learning online and your teacher only delivers lectures on Zoom. Most people listen to their bosses and superiors instead of protesting their viewpoints about security. Only privileged people can protest. Others just lose their jobs, or don't get their high school diploma. No, it's not right, but it is the reality.

iamacyborg 6y ago

> In part because executives, marketers and salespeople don't know what it means. And in part because when explained what it means they will insist on their own definition/interpretation and demand the product is marketed as E2E. This sounds like precisely how Grammarly claim they're not a keylogger by trying to change the very definition of what a keylogger is.

1vuio0pswjnm7 6y ago

"As for Zoom, I don't uderstand why people trust them or still use their product if they are at all concerned about security." Perhaps the term "security" suffers from the same problem as "E2E encryption".

ProAm 6y ago

> As for Zoom, I don't understand why people trust them or still use their product if they are at all concerned about security. The same reason I use Slack, because I have to.

TwoBit 6y ago

Disagree. Engineers of that system surely knew it wasn't E2E and voiced it, but marketing purposely lied. I will bet my farm on that.

bborud 6y ago
For Zoom I suspect you are right. I think the engineers know what it means. But I have met a disturbing number of engineers (in security oriented jobs) who do not understand what the term means.

mschuster91 6y ago

> And in part because when explained what it means they will insist on their own definition/interpretation and demand the product is marketed as E2E. That is the moment when one calls up the corporate lawyer and asks about "false advertising"...

wesleywt 6y ago

It doesn't make sense to a computer savvy hacker news poster perspective. But to everyone else, the reason they use it because they don't really care or thought about it. It will continue to be the most popular meeting app despite the wailing and gnashing from Hacker News.

sdoering 6y ago
I see my significant other using it on a nearly daily basis. She started a uiversity course in her 30ies and due to Corona is in her second semester from home. The university has a MS365 license free for all students, but for video lectures nobody uses it. Why? Because it is really, really cumbersome to use compared to zoom. Teachers and students alike love the functionality, the quality of video/sound and esp. the ease of use. Compared to all other solutions available to students and teachers - in terms of what they all want to use Zoom just blows the competition out of the water. And who is to blame them? These are regular folks. They wouldn't even care, if the lectures were tranmitted in the clear, without any encryption. Most regular students fresh out of school I talked to don't even know the difference between https/http, why it is important to have encryption or what end-to-end means. It has no meaning to nearly all of them.