11 ms·

How can they do training in the first place if everything is E2E...?

by bhhaskin 3y ago

cced 3y ago
E2E means everything between two ends is encrypted. Once it gets on their end, they can do what they please.
- traek 3y ago
  This isn’t what E2E means for communication software. E2E means only the participants have the keys. Signal is a good example of this, the message is encrypted from the sender to the receiver and Signal themselves cannot decrypt it. Separately, most Zoom meetings are not E2EE. That’s why features like live transcription work.
  - JonChesterfield 3y ago
    Only the participants do have the keys. You, the other people on the meeting, the company running Zoom, at least one government. It's still usefully encrypted to stop (at least some) other companies/countries benefiting from the information. I think zoom probably have a defence against the fraud accusation that no reasonable person would believe end to end encrypted meant zoom doesn't have the data as that's the whole point of the service existing.
    - greiskul 3y ago
      Zoom has not committed any fraud. They clearly state that by default their meetings are encrypted, but not end to end encrypted. And that you can turn on end to end encryption, but that it causes a bunch of features to be disabled. I think this is a great balance between being able to add features that are impossible with E2EE, but allowing privacy concious users to choose if they need stronger encryption. https://support.zoom.us/hc/en-us/articles/360048660871-End-to-end-E2EE-encryption-for-meetings https://support.zoom.us/hc/en-us/articles/360048660871-End-t...
- bhhaskin 3y ago
  That's not what E2E means at all. E2E means only the parties communicating can decrypt the data i.e. the sender and the receiver. Anything short of that isn't E2E. https://en.m.wikipedia.org/wiki/End-to-end_encryption https://en.m.wikipedia.org/wiki/End-to-end_encryption
  - wahnfrieden 3y ago
    it's what it means when zoom says they have E2E. it is a deception.
    - bhhaskin 3y ago
      I agree with you, but to be honest I don't care what zoom says. I am not going to let them redefine something so it suits them. Might as well call it potato encryption.
      - waithuh 3y ago
        Yeah, that explanation is just TLS.
  - cced 3y ago
    > That's not what E2E means at all. It’s kind if what it means? OP’s question is w.r.t to the receiving party’s ability to consume the data. The point that’s being made is that E2E doesn’t mean encrypted at rest and receiver can’t consume the data. I see a lot of comments nitting on the wording for a lack of specificity but, IMO, OP’s question was more about understanding what goes on at the two ends of the pipe. The point being made is that the recipient can still chose to do whatever it is they want with the content.
    - bhhaskin 3y ago
      I am the op? E2E dose mean that only the sender and receiver has the keys. You can't redefine what E2E is.
- paulirwin 3y ago
  For some definition of "end." Semantically, E2E encryption should mean encrypted end-to-end between you and the person you're calling, without Zoom having the key or ability to decrypt it. For example, this is Signal's definition of E2E encryption.
- deleted 3y ago
  [deleted]
- mercora 3y ago
  E2EE implies both ends have an encrypted channel to transport data to each other directly, without an intermediary step. this is the very definition of the term, at least it is in my mind. Having the data only encrypted to and from their servers would merely be transport layer encryption. Although i have no idea whether they implement one, the other or both. In context of video conferencing software (WebRTC specifically) this is actually somewhat interesting, because typically the signaling server is the one who hands out the public key of the other peer and needs to be trusted, so they could by all means deliver public keys to which they posses the keys for decryption and it therefore would allow them to play man in the middle in a typically relayed call. So even if E2EE is implemented, it might be done poorly without figuring out how to establish trust independently.
  - greiskul 3y ago
    Yeah, the key delivery is the hardest part if you are privacy focused. Signal and Whatsapp have a screen, where you can generate a QR code, and use that to verify that you and your contact have exchanged keys without a man in the middle attack.
    - mercora 3y ago
      I wish browser would do something similar with their WebRTC stack. Something that shows independently of the site (out of its execution context) which keys are used and allow for an easy comparison of them independently. But i don't know of such functionality being there yet.
- ghkbrew 3y ago
  e2e means/implies that only the endpoints (i.e. the users) get to see the unencrypted signal. If Zoom truely uses e2e encryption no trainable data would exist on their servers. Of course, they control the endpoint software too so they could make it do whatever they want realistically.
- PeterisP 3y ago
  Yes, E2E means everything between two ends is securely encrypted, but there is no "their end" between participants in a Zoom call, the Zoom company isn't an "end" in this conversation. If someone like them between the speaker and the listener can decode the data, that's not E2E.
JonChesterfield 3y ago
Either machine learning is so good it can pick details out of an encrypted stream or the company is using end-to-end to mean end-to-middle-to-end where company records everything in the middle. One of those explanations seems much more likely than the other to everyone, but curiously I think some people will disagree about which side is implausible.
- giantrobot 3y ago
  They can have E2E and have a secret participant in meetings recording anything. So while technically E2E they can have access to whatever meetings they want.
  - marcosdumay 3y ago
    It's E2E, but one of the ends is on the middleman. That's a new fun and exciting definition of E2E a lot of people are pushing.
    - screamingninja 3y ago
      Translation: not E2E
remote_phone 3y ago
What is zoom’s definition of End-to-end?
- greiskul 3y ago
  The standard industry definition. It's just that not everything is E2EE, you have to turn it on: https://support.zoom.us/hc/en-us/articles/360048660871-End-to-end-E2EE-encryption-for-meetings https://support.zoom.us/hc/en-us/articles/360048660871-End-t...
barathr 3y ago
I see lots of comments about the meaning of end-to-end encryption but less about what actually happens here. Zoom, like Meet, Teams, WebEx, and many others to my knowledge is "encrypted" but not by default "end-to-end encrypted" in the normal meaning of the term. (Some of these have options for E2EE but it's buried in the service configs and not easy to enable.) So they can and do see audio and video on their servers (as can anyone who breaches their infrastructure) by design. The encryption in this default mode only prevents your ISP from seeing the content of the call. As a distinction, Signal calls are E2EE -- Signal doesn't see unencrypted video/audio for calls, even ones that are relayed through Signal servers. And even in that case, Signal still knows the participants of the call, just not what is being said. (As a side note, this is why we built Booth.video -- to demo that this isn't a fundamental tradeoff and it's possible to have E2EE, metadata-secure video conferencing in the browser.)
- greiskul 3y ago
  Yup, Signal is the industry standard into getting actual privacy. But one player that deserves a shoutout when it comes to privacy, is Whatsapp. Even after becoming a Facebook company, it has kept E2EE, for messagings, group chats, and calls. And they do so by using the library that the greak folks from Signal put out.
  - facu17y 3y ago
    Except Signal's founder probably has/had a connection with the NSA. All security is for making it hard for the common attacker, and hostile countries. The NSA, most likely, has social engineered its way into every stack and every important org.
    - reciprocity 3y ago
      What? Where did you get that from?
  - sundarurfriend 3y ago
    > Even after becoming a Facebook company, it has kept E2EE, for messagings, group chats, and calls. According to their own claims, right? There's no way for anyone to verify that they're actually E2EE, just Meta's word that it is so.
avrionov 3y ago
Not all meetings are e2e encrypted, because encryption disables tons of features, like cloud recordings, apps, etc.
greiskul 3y ago
It's not. You have to turn E2E on: https://support.zoom.us/hc/en-us/articles/360048660871-End-to-end-E2EE-encryption-for-meetings https://support.zoom.us/hc/en-us/articles/360048660871-End-t...

How can they do training in the first place if everything is E2E...?

cced 3y ago

E2E means everything between two ends is encrypted. Once it gets on their end, they can do what they please.

traek 3y ago
This isn’t what E2E means for communication software. E2E means only the participants have the keys. Signal is a good example of this, the message is encrypted from the sender to the receiver and Signal themselves cannot decrypt it. Separately, most Zoom meetings are not E2EE. That’s why features like live transcription work.
- JonChesterfield 3y ago
  Only the participants do have the keys. You, the other people on the meeting, the company running Zoom, at least one government. It's still usefully encrypted to stop (at least some) other companies/countries benefiting from the information. I think zoom probably have a defence against the fraud accusation that no reasonable person would believe end to end encrypted meant zoom doesn't have the data as that's the whole point of the service existing.
  - greiskul 3y ago
    Zoom has not committed any fraud. They clearly state that by default their meetings are encrypted, but not end to end encrypted. And that you can turn on end to end encryption, but that it causes a bunch of features to be disabled. I think this is a great balance between being able to add features that are impossible with E2EE, but allowing privacy concious users to choose if they need stronger encryption. https://support.zoom.us/hc/en-us/articles/360048660871-End-to-end-E2EE-encryption-for-meetings https://support.zoom.us/hc/en-us/articles/360048660871-End-t...
bhhaskin 3y ago
That's not what E2E means at all. E2E means only the parties communicating can decrypt the data i.e. the sender and the receiver. Anything short of that isn't E2E. https://en.m.wikipedia.org/wiki/End-to-end_encryption https://en.m.wikipedia.org/wiki/End-to-end_encryption
- wahnfrieden 3y ago
  it's what it means when zoom says they have E2E. it is a deception.
  - bhhaskin 3y ago
    I agree with you, but to be honest I don't care what zoom says. I am not going to let them redefine something so it suits them. Might as well call it potato encryption.
    - waithuh 3y ago
      Yeah, that explanation is just TLS.
- cced 3y ago
  > That's not what E2E means at all. It’s kind if what it means? OP’s question is w.r.t to the receiving party’s ability to consume the data. The point that’s being made is that E2E doesn’t mean encrypted at rest and receiver can’t consume the data. I see a lot of comments nitting on the wording for a lack of specificity but, IMO, OP’s question was more about understanding what goes on at the two ends of the pipe. The point being made is that the recipient can still chose to do whatever it is they want with the content.
  - bhhaskin 3y ago
    I am the op? E2E dose mean that only the sender and receiver has the keys. You can't redefine what E2E is.
paulirwin 3y ago
For some definition of "end." Semantically, E2E encryption should mean encrypted end-to-end between you and the person you're calling, without Zoom having the key or ability to decrypt it. For example, this is Signal's definition of E2E encryption.
deleted 3y ago
[deleted]
mercora 3y ago
E2EE implies both ends have an encrypted channel to transport data to each other directly, without an intermediary step. this is the very definition of the term, at least it is in my mind. Having the data only encrypted to and from their servers would merely be transport layer encryption. Although i have no idea whether they implement one, the other or both. In context of video conferencing software (WebRTC specifically) this is actually somewhat interesting, because typically the signaling server is the one who hands out the public key of the other peer and needs to be trusted, so they could by all means deliver public keys to which they posses the keys for decryption and it therefore would allow them to play man in the middle in a typically relayed call. So even if E2EE is implemented, it might be done poorly without figuring out how to establish trust independently.
- greiskul 3y ago
  Yeah, the key delivery is the hardest part if you are privacy focused. Signal and Whatsapp have a screen, where you can generate a QR code, and use that to verify that you and your contact have exchanged keys without a man in the middle attack.
  - mercora 3y ago
    I wish browser would do something similar with their WebRTC stack. Something that shows independently of the site (out of its execution context) which keys are used and allow for an easy comparison of them independently. But i don't know of such functionality being there yet.
ghkbrew 3y ago
e2e means/implies that only the endpoints (i.e. the users) get to see the unencrypted signal. If Zoom truely uses e2e encryption no trainable data would exist on their servers. Of course, they control the endpoint software too so they could make it do whatever they want realistically.
PeterisP 3y ago
Yes, E2E means everything between two ends is securely encrypted, but there is no "their end" between participants in a Zoom call, the Zoom company isn't an "end" in this conversation. If someone like them between the speaker and the listener can decode the data, that's not E2E.

JonChesterfield 3y ago

Either machine learning is so good it can pick details out of an encrypted stream or the company is using end-to-end to mean end-to-middle-to-end where company records everything in the middle. One of those explanations seems much more likely than the other to everyone, but curiously I think some people will disagree about which side is implausible.

giantrobot 3y ago
They can have E2E and have a secret participant in meetings recording anything. So while technically E2E they can have access to whatever meetings they want.
- marcosdumay 3y ago
  It's E2E, but one of the ends is on the middleman. That's a new fun and exciting definition of E2E a lot of people are pushing.
  - screamingninja 3y ago
    Translation: not E2E

remote_phone 3y ago

What is zoom’s definition of End-to-end?

greiskul 3y ago
The standard industry definition. It's just that not everything is E2EE, you have to turn it on: https://support.zoom.us/hc/en-us/articles/360048660871-End-to-end-E2EE-encryption-for-meetings https://support.zoom.us/hc/en-us/articles/360048660871-End-t...

barathr 3y ago

I see lots of comments about the meaning of end-to-end encryption but less about what actually happens here. Zoom, like Meet, Teams, WebEx, and many others to my knowledge is "encrypted" but not by default "end-to-end encrypted" in the normal meaning of the term. (Some of these have options for E2EE but it's buried in the service configs and not easy to enable.) So they can and do see audio and video on their servers (as can anyone who breaches their infrastructure) by design. The encryption in this default mode only prevents your ISP from seeing the content of the call. As a distinction, Signal calls are E2EE -- Signal doesn't see unencrypted video/audio for calls, even ones that are relayed through Signal servers. And even in that case, Signal still knows the participants of the call, just not what is being said. (As a side note, this is why we built Booth.video -- to demo that this isn't a fundamental tradeoff and it's possible to have E2EE, metadata-secure video conferencing in the browser.)

greiskul 3y ago
Yup, Signal is the industry standard into getting actual privacy. But one player that deserves a shoutout when it comes to privacy, is Whatsapp. Even after becoming a Facebook company, it has kept E2EE, for messagings, group chats, and calls. And they do so by using the library that the greak folks from Signal put out.
- facu17y 3y ago
  Except Signal's founder probably has/had a connection with the NSA. All security is for making it hard for the common attacker, and hostile countries. The NSA, most likely, has social engineered its way into every stack and every important org.
  - reciprocity 3y ago
    What? Where did you get that from?
- sundarurfriend 3y ago
  > Even after becoming a Facebook company, it has kept E2EE, for messagings, group chats, and calls. According to their own claims, right? There's no way for anyone to verify that they're actually E2EE, just Meta's word that it is so.

avrionov 3y ago

Not all meetings are e2e encrypted, because encryption disables tons of features, like cloud recordings, apps, etc.

greiskul 3y ago

It's not. You have to turn E2E on: https://support.zoom.us/hc/en-us/articles/360048660871-End-to-end-E2EE-encryption-for-meetings https://support.zoom.us/hc/en-us/articles/360048660871-End-t...