3 ms·

Disclaimer: Have worked with many smart folks who now work at Zoom. I agree that Zoom has had numerous security and privacy failings. I think it is important t

Disclaimer: Have worked with many smart folks who now work at Zoom. I agree that Zoom has had numerous security and privacy failings. I think it is important to color the characterization of their security teams with a timeline however. Looking at that gist - the majority of the content predates the conclusion of the "90 day security plan" [1]. The team, and product no doubt, has changed immensely in the past year. That doesn't wallpaper over the history here, but there is completely different security leadership (e.g the current CISO didn't start until late June 2020 [2]) and staffing in place at this point that means your statements on their team likely aren't reflective of Zoom today. [1] https://blog.zoom.us/ceo-report-90-days-done-whats-next-for-zoom/ https://blog.zoom.us/ceo-report-90-days-done-whats-next-for-... [2] https://blog.zoom.us/zoom-hires-jason-lee-as-chief-information-security-officer/ https://blog.zoom.us/zoom-hires-jason-lee-as-chief-informati...

toiletaccount 5y ago
and yet i still dont trust their shitware. there's a lesson to be learned there.
- the_reformation 5y ago
  You can't be pleased?
  - toiletaccount 5y ago
    by people who show themselves to be willfully negligent of the basics? fuck no.
  - krageon 5y ago
    The security issues were such that the product should be tainted forever, or at the very least for the next ten years.
lrvick 5y ago
It is easy to say "we are better now, we promise". They straight up lied about security features like e2e for years, and leadership is still mostly the same. They only started seriously hiring in security because they got caught over and over and over. I have worked with companies with some of the best security people in the world who had no cooperation from engineering to roll out basic risk reductions like code review because it might mean slowing down velocity a bit. To be blunt, security people as often hired with big pairs of golden handcuffs in order to make security marketing more believable, regardless of the reality. The only way to win back trust of the security minded at this point, is to do what strong competitors like BigBlueButton and Jitsi did: Open source, and invite anyone from the public to audit code and compile binaries as they like. There is virtually 0 chance they ever do this, but if they did, I would gladly audit it for free out of public interest, and have no problem doing a 180 and actively recommending zoom if it becomes easy to verify it is as good or better than the competition at security and privacy. For now I maintain my position of strongly urging all my clients to abandon Zoom in favor of historically honest and highly accountable alternatives that work just as well as Zoom without constantly pestering users to grant Zoom with blind sweeping remote code execution privileges on their systems.
- illiac786 5y ago
  I agree that company culture is something that goes top down and you do not change by simply swapping out the security team. Zoom has (had?) a culture of wilful negligence, taking dangerous shortcut (they are the only company whose mess Apple had to fix themselves with security patch for god sake – I still can't believe this one actually), etc. I might be pessimistic but I don't think such a culture is something you can correct very easily, because it is anchored at the very top of the company.

toiletaccount 5y ago

and yet i still dont trust their shitware. there's a lesson to be learned there.

the_reformation 5y ago
You can't be pleased?
- toiletaccount 5y ago
  by people who show themselves to be willfully negligent of the basics? fuck no.
- krageon 5y ago
  The security issues were such that the product should be tainted forever, or at the very least for the next ten years.

lrvick 5y ago

It is easy to say "we are better now, we promise". They straight up lied about security features like e2e for years, and leadership is still mostly the same. They only started seriously hiring in security because they got caught over and over and over. I have worked with companies with some of the best security people in the world who had no cooperation from engineering to roll out basic risk reductions like code review because it might mean slowing down velocity a bit. To be blunt, security people as often hired with big pairs of golden handcuffs in order to make security marketing more believable, regardless of the reality. The only way to win back trust of the security minded at this point, is to do what strong competitors like BigBlueButton and Jitsi did: Open source, and invite anyone from the public to audit code and compile binaries as they like. There is virtually 0 chance they ever do this, but if they did, I would gladly audit it for free out of public interest, and have no problem doing a 180 and actively recommending zoom if it becomes easy to verify it is as good or better than the competition at security and privacy. For now I maintain my position of strongly urging all my clients to abandon Zoom in favor of historically honest and highly accountable alternatives that work just as well as Zoom without constantly pestering users to grant Zoom with blind sweeping remote code execution privileges on their systems.

illiac786 5y ago
I agree that company culture is something that goes top down and you do not change by simply swapping out the security team. Zoom has (had?) a culture of wilful negligence, taking dangerous shortcut (they are the only company whose mess Apple had to fix themselves with security patch for god sake – I still can't believe this one actually), etc. I might be pessimistic but I don't think such a culture is something you can correct very easily, because it is anchored at the very top of the company.