Hacker News Reader

Comment by crazygringo | Hacker News Reader

Now, I don't think Zoom should have been advertising E2EE when it isn't.

But I think some people are still missing the general point that E2EE is fundamentally incompatible with general-purpose business/educational videoconferencing.

It works for Facetime which is designed for small groups exclusively using a Facetime app.

But the second you allow phone dial-in (virtually always a hard requirement), the second you allow cloud recording (which the article acknowledges), E2EE becomes meaningless, because the server itself necessarily becomes another endpoint.

For >99.9% of people this is fine.

For the <0.1% who might be the hand-selected targets of government spying, industrial espionage, or crime enforcement, then no, you shouldn't be using Zoom. But if that's a top priority for you, you weren't already using Zoom anyways -- I assume you'd be using auditable open-source encryption. You wouldn't have trusted Zoom marketing terms in the first place.

View on HN

I don't understand you.

Being from Romania, in all the companies I worked on, we had the need to communicate online by voice and video (mostly with Americans and among ourselves), plus I tended to work in companies with a remote culture. The last time somebody needed to dial into a call I was in was ... 10 years ago. Given we have nearly unlimited 4G data plans for cheap and smartphones, being on the go isn't a problem either.

Since when is this ability to dial-in such a hard requirement?

> "For >99.9% of people this is fine."

99.9% of people don't understand what end-to-end encryption is and why it is needed, because they think their calls are secure, when in fact they aren't. It is actually our responsibility to make end-to-end encryption mainstream and to educate people.

I dial in to calls all the time. Frequently when driving / on public transport. Phone system is much more reliable.

Largely depends on business and culture (also Romania has abnormally good internet).

Where I work nobody calls in and everyone uses webcams for VTC (software company, skews younger), but at my girlfriend's company a lot of people call in and nobody uses webcams.

It was a surprise for me as well, but people in the US dial into meetings using their phone all the time. I don't understand it either.

It's like pagers, fax, checks and chip-less credit cards - Americans take a long time to abandon their legacy tech.

Often I’ve seen that the one person calling in the most senior person in the meeting, or anyone involved in sales. Someone who is traveling around to meet in person a lot. Often they are calling from the road or an airport. The mobile phone connection is more reliable than mobile data in these scenarios.

This feels like the equivalent of sending tweets by sms or dialing by tapping tones. People use it mostly because it’s supported, they’d use different workarounds otherwise.

Then it’s cool when it works and allows niche uses, but you can’t expect the feature to be there forever and can’t keep optimizing a service for these use cases.

> Since when is this ability to dial-in such a hard requirement?

The main reason I see people use dial-in, is when their audio or meeting client is not working, for whatever reason. The phone is a nice backup in those cases, and it (almost) always works.

>Since when is this ability to dial-in such a hard requirement?

Any time you have groups at two companies calling each other it's going to be a decently common requirement. Each company has X people in a conference room. Those X people need to all be able to talk and hear. Thus you use the room's audio equipment which is basically an expensive telephone to dial in.

Here in the US, we don't generally have unlimited data, but have unlimited phone minutes.

Also, cell audio is much more reliable than cell data.

I call into meetings with my phone all the time. Especially when the meeting is an emergency, and I'm not home (obviously not applicable now).

It's a lot easier to pull out a phone and dial a number than to find my laptop, set up the hotspot, fire up the videoconference software, and then worry about running out of hotspot data in the middle of the call.

> 99.9% of people don't understand what end-to-end encryption is and why it is needed, because they think their calls are secure, when in fact they aren't. It is actually our responsibility to make end-to-end encryption mainstream and to educate people.

I'm an academic and a long-time Hacker News reader. It seems that the tech community has collectively decided that all internet communication -- of whatever sort -- should be secure, all the time.

My first thought, is an outsider, is that this is unnecessarily anal-retentive. But upon reflection, I'm very grateful for this. The more anal-retentive that developers have to be, the less I have to be. If HN is so up in arms about this, it's a very good sign for Internet security overall.

What is it that you'd educate me about? That someone could have snooped in on my departmental meeting? Before Covid-19, these meetings were held in in an open room, in an unlocked building where people walk in and out all day. Anyone with the desire to snoop would have had no difficulty.

From what I understand, enough pressure is being placed on Zoom that they are cleaning up their act. From where I sit as an outsider, the system seems to mostly be working. I'm not angry at Zoom, but I'm very happy that others are.

I think the argument would be that you could secure those meetings if your management felt it was necessary. Many large companies have badge readers, cameras, and the like at various places in their buildings. If they need to hold a secure meeting, they can hold it in a secure area.

With Zoom, there's no such thing as a secure area. Your company is basically forced to hold meetings in a wiretapped room.

If you have an office where random people can walk in off the street and out again unfettered, that's probably an even greater vulnerability to your company than anything Zoom is doing.

It's like having a car company and saying, "I don't know why anybody would want seatbelts in their car, our cars explode when hit at over 5mph."

>If you have an office where random people can walk in off the street and out again unfettered, that's probably an even greater vulnerability to your company than anything Zoom is doing.

This is my point, in reverse.

I work in a university. Thousands of students come each day, to attend class, to show up to professors' office hours, to attend special events. Having physical security in the building would be a huge pain, extremely impractical. I have never heard anyone call for it.

Are there problems? Yes, but they are either minor or very rare. For example, sales reps for publishers will walk in and go to professors' offices door to door. A nuisance to be sure, but not that common.

Occasionally there are more serious problems. For example, in 1978, a Stanford professor was murdered by a disgruntled former grad student [1]. If this sort of thing was even remotely common, I expect you'd see some building security. But it's not.

In the analog world, on average people are just not all that concerned about security. I'm not terribly convinced that they should be.

[1] https://en.wikipedia.org/wiki/Theodore_Streleski

Universities are kind of a special case, I wouldn't generalize on them.

I think this is an important point not just in the context of Zoom, but every time privacy (or the lack of) gets thrown around in an argument.

It's perfectly possible to have end to end encrypted email, text, payments etc, but: 1. You will always loose features. 2. The "endpoint" (you) becomes responsible for a much bigger part of the protocol.

Most modern applied crypto is just shuffling trust and responsibility around.

A reasonable tradeoff could be a federated structure, where a local server in federation (school/corporate/...) acts as a trusted 3rd party.

> The second you allow cloud recording (which the article acknowledges), E2EE becomes meaningless

Not sure I agree with this one. Assuming a design where the server is just jockeying around encrypted streams because it doesn't have the keys, it could store the encrypted stream upon instructions from the client. The client would need to keep the key so it can retrieve and decrypt the recording later.

often time meetings are recorded so they can be played back later for people who didn't attend the meeting.

> For the <0.1% who might be the hand-selected targets of government spying

The US government engages in bulk spying; this comment is a red herring. Without end to end cryptography, even normal, everyday people are at risk.

This trivializes a very important issue.

So basically, if you're comfortable having your business meeting in a crowded restaurant, then Zoom is an okay tool to use.

with the recent news of SpaceX banning Zoom [1] I wonder how many defense contractors or other organizations with high security clearances use Zoom.

[1]: https://www.reuters.com/article/us-spacex-zoom-video-commn/e...

The main concern with spacex was that it probably was not it administrated and employees were using it adhoc with no security audit oversight. With the other vector of attacks(zero days, email leak) that is why they stopped it.

You could actually have an e2ee conference. Even with FaceTime you trust Apple to give you the users' private keys, and not MITM-ed ones.

With a conference, the server could generate a private/public key pair for each dialed-in phone number. That way you could retain hope that they were giving you non-MITM-ed keys for participants when no phones are involved.

Generally though, Apple's "end-to-end encryption" is a false promise and SHOULD NOT be trusted. If they wanted to provide privacy and weren't bound by the government (like they were when they tried to encrypt backups), they'd follow whatsapp and allow offline comparison of keys via QR codes and notify of changes. But they didn't.

Apple won the marketing battle on privacy, but please don't trust them. They have access to all backups, all your pictures, and they can MITM your iMessage/FaceTime when the government requests it (or whenever they want to, really).

I always think of encryption of a preventive thing. A bit like maintaining redundancy in hospitals and healthcare it might seem a bit cumbersome and overkill during calm times, but it has to be there once you need it. The similarities won't end there: encryption for everybody is needed just to protect the few really vulnerable ones.

Encryption is directly linked to freedom in a society, because the lack of encryption acts as a power multiplier for those who are already in power, because it makes manipulating the masses easier even if single individuals are not at all hurt by it.

> But the second you allow phone dial-in (virtually always a hard requirement)

I'm really curious about this one — I've noticed that indeed in the US people tend to expect to be able to dial-in using the PSTN. Why would people do that? I haven't seen this happening much in Europe, and the Whereby (https://whereby.com/) conferencing tool doesn't even offer dial-in, which isn't a problem.

Why is dialing in using the PSTN a thing?

Because everyone has a phone pretty much everywhere, and knows how to use it. So its the ultimate fallback channel for people having computer issues, network issues, being on the move or in remote locations, ...

I've participated in Zoom meetings while driving.

I've participated in Zoom meetings while sitting in a conference room with a speakerphone of considerably higher quality than any laptop mic.

The first case is probably unsafe. The second was very common back when we had offices with high-quality speakerphones.

Dialing in via phone works for everybody, no app needed, no app to use etc. it works with all sorts of conf room setup and even the use case of "assistant sets up the phone call for the CEO and then transfers the call" works.

Not using Zoom but I have one coworker with a new Dell laptop that won't properly detect headphone jack events. He has to dial in.

I had the same problem but found a way to fix it. The Waves Maxx Audio tool which is apparently responsible for managing the hardware is useless junk.

In my experience at large corporations, it's mainly used when you're participating in the meeting from your cellphone, because you're on your way to the airport, on the train, in a hotel lobby, etc., but it's crucial they don't make a decision without you or that you hear all the details or correct misunderstandings. Obviously this is more common day-to-day for management/sales who are constantly traveling, than engineering.

For whatever technological reason, cell phone calls tend to be far more reliable than internet calls. Especially if you're in a taxi or on a train, you may get so many dropped packets it's literally unusable. While an actual phone calls works perfectly fine.

Not sure if it's how carriers prioritize traffic, or different technologies, or what. I'd be curious if anyone has the answer.

I'm also not sure why this would be any different in Europe.

(It's also, of course, the option of last resort when you can't get the damned app/microphone to work for whichever of a million reasons.)

Also most conference/meeting rooms in companies are setup to only use a specific meeting platform, forcing you to dial in if the meeting is with a client/vendor on a different platform.

I'm in engineering and often traveling, and thus dial in. One thing I do get from others is complaints that the voice quality on a mobile phone is far less than using data.

Zoom does seem to be more reliable than skype for business.

It's QoS and bufferbloat: https://www.bufferbloat.net/projects/

Low latency, more reliable, works on any device without needing to monkey with settings or policies or install a client app.

> But the second you allow phone dial-in (virtually always a hard requirement), the second you allow cloud recording (which the article acknowledges), E2EE becomes meaningless, because the server itself necessarily becomes another endpoint.

This isn't true if one of the involved parties hosts their own video server. With jitsi I found it tremendously easy to set up a server.

Right, but I'd also say that where E2EE is not available, there is a strong incentive for companies to go with something self-hosted rather than SaaS.

Plenty of companies seem fine with storing all their communications on Slack's servers, storing all their IP on Github's servers, storing all their data in Office 365, all their confidential email in GSuite etc. Why is Zoom so different? There is some subset of organisations for which none of these things are acceptable of course.

Zoom made a lot of features like passwordless meeting links and join-by-phone the default, most likely to help with early adoption. Now they are working on making them optional and even making some runnable on-prem. I think thats fine if you let users opt in and clearly explain the tradeoffs. But it was risky to make so many security tradeoffs in the name of ease-of-use. Somebody at Zoom has the fundamental belief that these services are over complicated but lacks the empathy of having been a victim of a major hack.

I think they made a poor word choice in an effort to simplify the message while saying something less vague than "military grade encryption" or whatever. The transit legs of a Zoom meeting are TLS, which is what the customer cares about.

Most of the vitriol about this issue is from a subset of security and IT people for whom E2EE is a term of art. In most any commercial service setting, E2EE is always going to be a bullshit term for someone.

Maybe there should be a radio button upon installation that asks people whether they have something to hide and offers a special version with super good encryption for those who say yes.

Reply on news.ycombinator.com