Hacker News Reader

Comment by cbg0 | Hacker News Reader

> Zoom does not and will not proactively monitor meeting contents, but our trust and safety team will continue to use automated tools to look for evidence of abusive users based upon other available data.

> Zoom has not and will not build a mechanism to decrypt live meetings for lawful intercept purposes.

> We also do not have a means to insert our employees or others into meetings without being reflected in the participant list. We will not build any cryptographic backdoors to allow for the secret monitoring of meetings.

One court + gag order and all of these promises are out the window.

View on HN

“...will not proactively monitor...”

“...will not build a mechanism to decrypt live meetings...”

So, this means that they can record meetings, then retroactively decrypt and monitor meeting contents :)

Well, yeah, duh.

What do you expect them to do? Hire a PMC and fight a war with the police when they come around to raid the server room? Go into hiding so that the security agency can't steal the upgrade signing key from them?

We can't expect all of the internet to operate like Wikileaks and The Pirate Bay. If the justice system is broken, then the people aren't safe.

>What do you expect them to do? Hire a PMC and fight a war with the police when they come around to raid the server room? Go into hiding so that the security agency can't steal the upgrade signing key from them?

No, we want them to assume the same thing we are assuming. That if their service becomes successful, they will be coerced to compromise their users, regardless of how frequently they promise that they would never do so.

If they are even bothering to make public announcements like this, then that means they believe the security of their system can be founded on the honor of their employees. It's important to recognize that this isn't even true if you assume every member of their team is an uncorruptible seraphim.

Instead, where possible, the service should be zero knowledge, where not possible, it should be considered insecure.

> We can't expect all of the internet to operate like Wikileaks and The Pirate Bay.

Why not? That's just what it takes.

> If the justice system is broken, then the people aren't safe.

It is, and they are. After 50 years under the heel of the war on drugs, how is it not 100% obvious?

Building reasonable end-to-end encryption in the first place isn't rocket science. In fact, Keybase have done just that. As well as WhatsApp, Signal, and many others.

Consider these promises a warrant canary. They will be removed at some point.

only that it is not.

warrant canaries must be written in the past tense. This is future tense. So they can monitor millions of calls, and give your information away at every second. This text only tells you about the next second (a promise they will break too, but then the text will be about the next second)

Perhaps it's my inexperience with the english language showing, but I thought "has" in this context was past tense.

Nope you’re right. They could use this as a warrant canary by removing the “has not” part

> Zoom has not and will not build a mechanism to decrypt live meetings for lawful intercept purposes.

That seems to include past tense.

I wonder how important the word "live" is there. Does this statement only apply to real-time decryption of ongoing meetings?

I think yes: they lack the technical infrastructure to decrypt the meeting in real time (which totally makes sense), rather than they have no plans to buid any infrastructure to decrpyt it afterwards (which cannot be guaranteed against a hostile actor).

And how long of a delay counts as no longer "live"? After the meeting ends? Five seconds? A millisecond? Does the latency to the server mean it's not "live", since it happened in the past?

One full meeting duration after the meeting ends.

I thought warrant canaries had to be in financial reports because those are one of the documents where companies are legally cannot lie under SEC rules?

Let alone the legalese included that makes 'will not' lose any meaning at all.

The statement about lawful intercept can only be considered a blatant lie. It’s a requirement in China and CALEA applies in the US. Europe, India and Australia have their own laws around this.

What makes you think that CALEA applies to Zoom (in the U.S.)?

IANAL, but I'm reasonably confident that it does not.

EFF says[1] it applies to Skype, so I think it should apply to Zoom as well.

[1] - https://www.eff.org/issues/calea

It also does not say that they have not provided key material or RNG output, or that they have not deliberately weakened any aspect of their design other than "cryptographic backdoors" to accommodate law enforcement desires.

These kinds of statements are typically most usefully interpreted as a template for the kinds of things they plan to do, just maybe not exactly in that way.

Reply on news.ycombinator.com