2 ms·

I think this highlights a problem in trusting 3rd party services just because they claim to have high quality of service. As a security prof, I am surprised you

I think this highlights a problem in trusting 3rd party services just because they claim to have high quality of service. As a security prof, I am surprised you didn’t just try to intercept the zoom conversations and see if they actually are encrypted before trusting them. I know being busy can prevent things like that from happening but the problem is people were using this and similar services to work on other peoples data who never had used zoom. This means that it’s very likely that our participation is not even required for our private information to be stolen.

stevenicr 5y ago
you are right. I recall reading an HN comment a while back where someone did check the data on the wire with one of those 'no-name cheap wifi home cameras' that claimed encryption for privacy and they did see scrambled stuff - so good. But I also recall a recent comment (I think from a saas founder?) - where they don't claim E2E with thier service as it's using webrtc(?) that needs to decrypt at the relay (stun/turn?) server - then re-encrypt to deliver. (Which is how I will be preferring ro deliver with webrtc so to avoid direct p2p and ipaddy leaking (trading a user to user privacy for trust in the server relay - good for my situation, not what I'd suggest for most other) anyhow - that kind of thing would get tricky, is the soft wiregaurd? that is used to peek at the traffic - would (could) show encrypted stuff leaving my box - and give me a false sense of security if zoom was decrypting in the middle - I guess I'd need to find if the data was going p2p somehow. (still learning to be security professional) we need some way to codify parts of your comment into law, and into people's understanding of the need to have encryption for data others get to play with. - There is a tinge of this in the hippa.

stevenicr 5y ago

you are right. I recall reading an HN comment a while back where someone did check the data on the wire with one of those 'no-name cheap wifi home cameras' that claimed encryption for privacy and they did see scrambled stuff - so good. But I also recall a recent comment (I think from a saas founder?) - where they don't claim E2E with thier service as it's using webrtc(?) that needs to decrypt at the relay (stun/turn?) server - then re-encrypt to deliver. (Which is how I will be preferring ro deliver with webrtc so to avoid direct p2p and ipaddy leaking (trading a user to user privacy for trust in the server relay - good for my situation, not what I'd suggest for most other) anyhow - that kind of thing would get tricky, is the soft wiregaurd? that is used to peek at the traffic - would (could) show encrypted stuff leaving my box - and give me a false sense of security if zoom was decrypting in the middle - I guess I'd need to find if the data was going p2p somehow. (still learning to be security professional) we need some way to codify parts of your comment into law, and into people's understanding of the need to have encryption for data others get to play with. - There is a tinge of this in the hippa.