I've been currently using Zoom during the pandemic because as a product it's still the best (and I signed up for a discounted year of pro), but I won't give them any money again.
The same cannot be said of Google. Heck, as a technical person I have trouble getting Google Meet to work consistently. That was Zoom's main advantage -- their ease of setup and use, and "it just works". We now know that part of the reason that is the case is because they do some very unorthodox things that are security nightmares.
Security and ease of use are always a tradeoff. Zoom has always been on the very far end towards ease of use and away from security.
Security and ease of use are not by default mutually exclusive. Depending on circumstances satisfying both may be a challenge, but it’s not a blanket impossibility and we could probably hold certain companies up to a standard that corresponds to their multi-billion valuations.
A virtual “slider” on which you can only dial up security by hurting usability is only a useful map, not the territory.
I actually disagree with you. I think security and ease of use are mutually exclusive.
I can't think of a single counterexample where security did not have an effect on usability.
Now to be clear, I absolutely believe we should have a lot more security than we do, and we should be giving up usability to do it. But I think that it is necessary to give up usability.
(Edit: remove many words)
1. HTTPS everywhere has zero impact on the usability of a website, but makes visiting those sites much more secure.
2. Apple's App Store model for installing applications improves security and is also easier to use for the average user.
3. 1Password with Touch/Face ID can actually be easier these days than entering emails and passwords manually.
4. And more…
Security doesn't always have an immediate effect on usability, and even when it does it isn't always negative.
You have to install a plugin on every browser and device. That's not user friendly. Also some sites break and you have to understand why.
> 2. Apple's App Store model for installing applications improves security and is also easier to use for the average user.
You have to have an account on the app store. You can't log into the same account on more than five machines. You have to put your password in every time you install an app.
That's all a lot harder than clicking on a link in an email.
> 3. 1Password with Touch/Face ID can actually be easier these days than entering emails and passwords manually.
You have to install 1password on all your devices. You have to mange your passwords with 1password. I'm an expert and even I have a hard time getting it to catch every update and every password field. 1password is a usability nightmare. Having the same password everywhere is a lot easier (and obviously less secure).
You're looking at one aspect after the initial setup and ignoring maintenance.
Again I’m not saying it’s bad, quite the opposite. I’m just saying we have to acknowledge it’s always a trade off.
First, does that always hold true?
Second—if we pretend it’s an axiom—careful and competent approach may allow to shift such degradation to aspects orthogonal to usability (instead of being perceivable by end user, failure modes could cause overhead, say, to maintenance or engineering teams).
"Usability can be described as the capacity of a system to provide a condition for its users to perform the tasks safely, effectively, and efficiently while enjoying the experience." (https://en.wikipedia.org/wiki/Usability)
Notice the presence of "safely" there. You should be penalizing the alternative in each of these examples for the non-zero risk of data breaches and getting pwned. Then we can have a more productive debate about which cost is greater.
> I can't think of a single counterexample where security did not have an effect on usability.
Sticking with the "mutually exclusive" criterion, wouldn't ssh vs. rsh serve as a counterexample? How about https vs. http?
Both replacements brought us greatly improved security, with no effect on usability in the vast majority of time I've spent with them.
Https is worse from a usability standpoint because of the need for trust stores and keeping them up to date. While it's mostly taken care of by the browser, it can still cause problems when you don't have anything in your truststore that can verify the other certificate.
Ssh vs rsh suffers a similar problem. If the certificate on the other side changes, you have to update your local config to allow the new certificate and will either be blocked or have warnings until you do so.
Pretty much with anything that requires certificates, usability is worse because you have to maintain the trust store in some way.
In both cases you mentioned the effects are very negligible and certainly worth the tradeoff, but strictly speaking, the usability is worse.
In my experience setting up accounts and installing the Windows software for 15+ people in one afternoon, I cannot believe what you're saying. Unless Zoom has gotten way easier to setup and use since March, it is a nightmare.
It's been a while, but I'm fairly sure was basically like this: 1) Enter email into website 2) Click link in email 3) Enter name and password 4) Invite others or skip 5) Click to start a meeting, which actually starts a download 6) Install software, meeting starts automatically 7) End meeting 8) Manually log in to Windows client despite it starting a meeting on your account immediately after installation
That is not easy or accessible to non-technical people at all, especially with how they hid certain buttons as really pale grey during the signup process. It was also a nightmare trying to oversee this process, and repeating it on each machine for those who got lost trying to do it themselves took ages due to waiting for emails, people deleting the email thinking it was spam, downloads not starting due to requests timing out, etc.
Then, a few weeks after we all started working from home, Zoom removed the automatic Company Contacts list and suddenly we could only contact colleagues through existing group chats. No warning, no explanation, not even a reference in the changelog or help pages on their website - rather, the help guides still said the feature was available and explained how to toggle it on or off. Everyone spent that morning adding all their colleagues as personal contacts by manually entering emails one-by-one and then accepting all the invites they received in return.
Zoom is useful once you get it working, but it is definitely not easy to get it working for non-technical people.
Note this is coming from someone who uses Firefox and Duck Duck Go to resist Google's monopoly (i.e., I'm not a Google fanboy.)
Why is that a surprise?
I’m glad Zoom is forcing Google Meet to innovate, though.
- General preference for non-ad supported business model.
- Google Meet wasn't an option until very recently.
- I really dislike hangouts and how it leaks chat all over Gmail (among other things), and this has biased me against their other products.
- Similarly, I was a huge fan of Google Voice which was way ahead of its time and which they abandoned for years until many other multi-billion dollar companies rose up and took the space.
- I've anecdotally heard Meet had worse video/audio quality from friends.
- I tend to try and avoid Google chat products since they're usually a mess and often killed.
Of all of these, the first and last are really the only valid reasons.
Google Meet does have its own scummy practices though (adding itself to meetings without asking which confuses participants and is extremely annoying, Benedict Evans tweeted/wrote about this).
Maybe Jitsi works well enough to actually use? I already have a Matrix server, I could try getting friends to use that instead (realistically probably will be difficult).
The best part of Zoom taking off is suddenly Meet appears to be getting new features almost daily. It's like a product Google suddenly cares about again. Audio and video quality have also greatly improved. It's really like a completely different product from 6 months ago.
And Google Meet is able to bring to bear some of their absolutely amazing advances with ML for things like predictive sound for dropped packets and the new denoiser function they've launched, along with live captioning and some other just incredible features.
There are a few little things that bug me with Google Meet: their newly introduced grid view doesn't display yourself as one of the tiles, for some reason. I don't want to pay $25/mo/user for an enterprise account _just_ for the video recording feature, which I will have to do come September, if they don't extend the current offer to make that available to all GSuite tiers. And I wish it recorded the transcription. But overall, it's a pretty great product, and its tight integration with Google Calendar and Slack, along with its frankly fantastic meeting room hardware has made it our software of choice for some time now for conferencing.
Plus, it's a sunk cost for GSuite users. Aside from a licensing fee for the meeting rooms, I'm not paying an _additional_ per-user monthly fee, which for a small consultancy like mine, matters.
I don't see how google meet is ad supported, but even if it was, there are paid options, so you are welcome to pay for it.
A week later, we tried Zoom instead. We could hear everyone clearly. We've used Zoom ever since.
I had some say in the decision to continue with Zoom, and I feel kind of bad about choosing it, but it's hard to argue with the results. We had similar issues with Slack video calls (although we still use those for small groups—not my decision!), Microsoft Teams, and a product from LogMeIn called Join.Me. Unlike Zoom but like Google Meet, these products are all based on WebRTC, and I'm starting to conclude that WebRTC is just a crappy technology for large-group video calls.
We admittedly haven't tried Jitsi. Perhaps I'm part of the problem, but I don't want to be the one to suggest a random product no one has heard of. Especially when that product is also based on WebRTC.
When was this? Google Meet has gotten a lot better in the last few weeks.
The more I learn about zoom as a company the more I can't wait to delete it but all the comparable products have all been terrible in comparison.
No need to emotionally invest.
I was on the team that chose zoom (which I now have reservations about, but that horse has bolted).
During the initial discussions, Google dropping products was brought up and was our primary reason for not picking their product.
Meet also has a very fixed layout. Its mic control bar on the bottom cuts off the names on the bottom row of participants. The UI on "waiting to connect" page is hilarious; it has a line of vertical dots for changing settings, and a line of horizontal dots for monitoring audio. There's a small concept in design called discoverability -- doesn't exist for Google, lol.
Zoom makes it also easy to see who has noise coming from their microphone, what audio and video up and down bandwidth is looking like. Lots of little things like this that matter if you spend most of your day in remote meetings.
Google seems like at best lateral step regarding moral computing.
Granted, I haven't used it in a while because they put me in a position where recovering my account is impossible.
If by 'recovering' you mean recover after a lost key, then I'd regard that as a feature not a bug!
Am looking for a keybase alternative now.
I ended up doing this anyway in the end, after deleting everything I could before I stopped using it.
They do make you wait seven days before you can do it after you make the request.
I still have the account because I don't want to lose access to my username (didn't delete it), but it's otherwise empty and unused with fresh keys that have no history with anything.