Hacker News Reader

Hacker News

Comment by encoderer | Hacker News Reader

Parent Full thread

encoderer

Blows my mind that a shareholder might have a cause of action for this.

1) Buy volatile stock with recent IPO

2) Sue them for their volatility

3) ?????

View on HN

> Zoom documentation claims that the app uses “AES-256” encryption for meetings where possible. However, we find that in each Zoom meeting, a single AES-128 key is used in ECB mode by all participants to encrypt and decrypt audio and video. The use of ECB mode is not recommended because patterns present in the plaintext are preserved during encryption.

https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto...

You know, I had never considered being a shareholder and using said standing to sue a company into security best practices when they lie about it, considering regulation has failed to create the appropriate incentives.

Neither have I, but figured I’d link this since it is more than likely why they are suing

Oh wow. ECB mode? That's horrifying.

For those that don't know much about encryption, here is an example image for why ECB mode is trash: https://i.stack.imgur.com/bXAUL.png

I would say that anyone who ever tries to encrypt some data and does the bare minimum google/stackoverflow search for how to do it would see extremely vigorous warnings not to touch ECB with a 10 foot pole.

Unfortunately, crypto libraries have a history of having a terrible UI and defaulting to ECB. Years ago I ran into this with pycrypto. I worked on a team that joked about how important it was not to do ECB and it turns out they had done ECB. https://www.dlitz.net/software/pycrypto/api/current/Crypto.C...

Images are uniquely bad for ECB mode since they almost definitionally will have repeated material. ECB mode is bad and shouldn't be used. But it isn't like somebody listening to your zoom traffic can transparently see penguins.

Isn't an h264 stream even worse given that unlike a random image it has a very well defined repeating structure? The risk isn't that someone will look at zoom traffic directly and see the content Matrix-style. The risk is that it should become possible to just completely decode the encryption given what you know about the plaintext. In that context the penguin image is a great illustration.

Shareholders can sue you for pretty much anything you do that damages your value that you didn't warn them about.

I.e. they put in their IPO prospectus that there might be a negative impact on their reputation from them having Chinese R&D, so they have a defense against that. They didn't put "We have misleading marketing materials that might become subject to widespread public attention" in there I think.

That doesn’t mean it’s a sound policy.

Public markets bid up a stock to an insane valuation in a matter of weeks and then the price comes down (due to technicals, fundamentals, whatever) and you have shareholders trying to weasel out of their gambling losses by suing company.

Let a customer who was actually harmed by this sue. Much more compelling to me.

It should teach companies not to lie in their marketing, or as Zoom calls it, "have a discrepancy between the commonly accepted definition of e2e and how [they're] using it".

If they weren't making shit up, stocks go up, stocks go down, but the gamblers wouldn't have any grounds to sue.

Reply on news.ycombinator.com