Zoom lied to users about end-to-end encryption for years, FTC says
arstechnica.com
arstechnica.com
Right now I know of at least half a dozen products that are marketed as having E2E encryption but do not actually implement this (no, I'm not going to out them. See second to last paragraph as to when to be wary). In part because executives, marketers and salespeople don't know what it means. And in part because when explained what it means they will insist on their own definition/interpretation and demand the product is marketed as E2E.
It is also important to note that quite often you are not dealing only with the company that makes a product, but the regulatory bodies that can pressure companies into complying with their wishes.
As for Zoom, I don't understand why people trust them or still use their product if they are at all concerned about security. It makes very little sense.
In the meantime be very careful to monitor anything your name is associated with, just in case any of your customers get wind of the situation and sue-balls are thrown.
AI module:
If something
Else if something else
Else if
Else if
...
Else Call Human
(It just so happens that the set of things the AI can handle is empty.)
At my previous job I had a ML-based service that used a basic random-forest model instead of a neural net because it was faster to train and operate, not to mention easier to maintain and had equivalent accuracy with little to no effort required on my part. It was a solid little service.
Even back in the 80's, the computer algorithms that played the other side in computer games was called "the AI".
While considering the regulatory requirements helps explain the desire to lie, it does not make the lie any more defensible. Even if a regulatory body is making impractical demand, I very much doubt they are demanding companies lie to their users and potential users. Even if they were "just following orders guv" is not an acceptable excuse.
The key facts: Zoom lied. They didn't have to. They could have accurately reported what encryption they use and what they were working towards if that was due to change.
Even if we accept that the initial claims were wrong due to executives misunderstanding what their own security/dev people had stated, that doesn't defend continuing to make the claim without seeking further clarity after questions were raised.
I certainly don't trust them, but I do use Zoom (from a dedicated unprivileged user, so it can't do any harm beyond recording my conversations), because my colleagues use Zoom, and because there doesn't seem to be any working alternative. I got them to try Jitsi once, which simply didn't work.
PS. There may be working /secret-source/ alternatives, but I don't know why one should think Zoom /more/ untrustworthy than them.
How can you say there is no alternative?
Yes, but it seems like Skype was doing that prior to being acquired (though Microsoft seems to have accelerated things). From some quick Googling to refresh on PRISM –
>• In July last year, nine months after Microsoft bought Skype, the NSA boasted that a new capability had tripled the amount of Skype video calls being collected through Prism;
>• Microsoft helped the NSA to circumvent its encryption to address concerns that the agency would be unable to intercept web chats on the new Outlook.com portal;
>Eight months before being bought by Microsoft, Skype joined the Prism program in February 2011.
> According to the NSA documents, work had begun on smoothly integrating Skype into Prism in November 2010, but it was not until 4 February 2011 that the company was served with a directive to comply signed by the attorney general.
https://www.theguardian.com/world/2013/jul/11/microsoft-nsa-...
What is immensely important is to raise the cost of lying to where it becomes something investors care about. The only real thing a company and its investors are afraid of is losing its customers.
If we teach companies it is okay to lie by staying with them, they will lie more.
For instance Big Blue Button : it's not perfect, because it's Canadian, it's hosted on Microsoft's Github, and might have some outstanding security issues [1], but I would probably still trust it more than Zoom or anything GAFAM.
When you use these platforms all the time, you find these little issues. Generally speaking, Zoom does it best, despite their problems.
Maybe there is a way to automate this with some VB/Python script?
These are companies that deal with some very sensitive data.
I'm not sure I consider not crashing the OS when the conference starts 'good performance' so much as 'working'. Running it in Firefox at the time was bad performance (sluggish), haven't tested since.
I'm not a company, I'm at a university, and the u. has decided to use Zoom, perhaps because it doesn't care about security, or because it thinks being concerned about Zoom is being paranoid.
So jitsi might work for one-on-ones but slightly bigger conference calls are a no-go.
Unless I'm misunderstanding what you mean by that, I don't really see the point in it, TBH.
Have there been cases of Zoom infecting machines with malware or transmitting viruses? The whole concern, as far as I know, is terrible security on their end, allowing people into calls without permission, not having E2E encryption, etc, and running as an unprivileged user won't help with that at all.
The reason that people went with Zoom is "because it worked." As other products improve it's hard to see what Zoom's moat is and why we should continue to pay for it.
Ironically, I would say Google Meet defines "it just works" for me way more than does Zoom.
Joining a Google Meet:
1. Enter the URL in your browser.
2. Click join.
Joining a Zoom:
1. Enter the URL in your browser.
2. Accept launching an executable.
3. Watch a window or two pop up and close.
4. Decide if you're using video or not.
5. Watch more windows pop up and close.
6. See the main Zoom window appear.
7. Decide if you're using audio or not.
Perhaps part of my beef with Zoom is how many times its window shuffling steals focus during the several seconds needed to join a meeting. If I'm trying to get work done while waiting for a meeting to start, the focus stealing is very obnoxious.
1. Enter the URL in your browser.
2. Choose a nickname or log in.
3. Click join.
4. Decide if you're using video or not.
5. See a video test.
6. Decide if you're using audio or not.
7. See an audio test.
(steps 5 and 7 are absent in a Jitsi meeting)
I'm curious - is there a video service out there you would recommend if you're conscious about security? Your third paragraph makes me think your opinion will be that no large company can be trusted, because they become a target for nation-state regulatory bodies.
For instance in the telco world you have a much more direct dependence on regulators because you need a stack of expensive and hard to acquire licenses to operate a network in most parts of the world. Some worse than others. In that environment there is a very high degree of compliance with regulators because they have to be given explicit permission to operate.
For pure internet services or P2P applications it is quite a bit different. You don't actually need anyone's permission to distribute software. And you can move your servers around the world. You don't depend on permission - just that nobody comes after you with warrants you cannot ignore.
So the advice is really to look at who you are dealing with and how dependent they are on regulators to operate.
Large internet companies tend to have entire divisions whose job it is to tell regulators to get lost or at the very least maintain a really high bar for interference. Of course, this becomes difficult when the government is also a large customer. So for instance you might want to be careful with vendors who make a lot of money in / off of the defense and intelligence sectors.
I really appreciate your insight.
Unfortunately, Jitsi isn't a viable solution at this point except for 1 on 1.
No, I don't. I don't want companies to lie. You can collect intelligence the same way we've been collecting intelligence for our entire history on this planet prior to E2E comms. E2E isn't a hindrance, it's a way to enforce limitations on government overreach.
No freedom is without compromise.
It already exists. It's called "fraud".
On the other hand, I think things involving cryptography at scale ought to come with regulations on language
For example, look at how the word "bank" is specially regulated by most governments. I can't just call myself a bank without meeting specific guidelines or else it's not just typical fraud, it's major financial fraud coupled with putting sensitive customer data at risk.
Same here. We need specific legislation targeting these scummy businesses who use corporate ignorance as an excuse for selling a product under false pretenses of end-to-end encryption.
Being a technical founder, I found some non-technical founders use this an advantage. They can lie to customers without guilt or investors with brimming confidence about their "MVP". They can use "making it simple" or "ignorance" as an excuse, if at all they get caught. These kind of lies are grey lines and exist everywhere.
I've also been in situations where an ultimatum like E2E encryption is dictated by a marketing team and then expected to be created without adequate budgeting or time, essentially creating pressures on development teams, project/product managers, etc to lie.
The conclusion I've come to in business is that ultimately, your product or service is going to be falsely advertised and oversold one way or another. It's a lot easier for some to lie, act deceitful, and/or feign ignorance than it is to actually deliver. Your competitors are doing it, if you don't, you lose.
The way I deal with this nonsense is that I make it a point at least once in meeting or fairly tracable record like an email that others know what is and isn't true once and it's up to them to decide who they want to lie to. I've been on the other side being pressured to lie and its not fun so I'll happily pass that responsibility. I didn't pursue a career in computing to be a constant liar, I'll let the people who want to lie, lie.
What's far more interesting to me is the fact that your vendors are doing it. I wonder how much business efficiency could be gained by taking advantage of the fact that we all know the products our businesses are buying are oversold?
Malwarebytes spends a whole lot of time defending the fact it recommends software from these companies for removal and the recent SCOTUS memo on the topic sort of implies that the problem -- how do we determine the voracity of statements made by businesses regarding their software, especially software which exists in a constantly changing state -- may be headed towards getting worse as so few people are familiar with legislation also have good understanding of the inherent complexity of software.
They don't mention that their installer ships with tons of malware that they install, and more that they try to trick you into installing but you can technically opt-out.
Not much tbh. Our only other option is to not buy, and build in-house instead. Sometimes that's worthwhile, but other times (like in the case of zoom) it still makes sense to buy the vendor's product, even if you know that it's not everything it's advertised as being.
The real efficiency is found in having people who can determine which and if you should buy a vendor's product, or if you should go in house. Specifically people who can see through the marketing BS and evaluate technologies without personal or hype bias.
We expect name brand products to indemnify their vendors to an extent. Consumers don't want to chase down the guy who made the screw that failed and caused a bunch of excess deaths. You put the screw in the assembly, you took most of the profit margins. So you get the lawsuit.
If you want to go and sue your vendor to recover damages, that's between you and the vendor. But the class action goes to Acme Inc, not Acme Screws and Fasteners.
Similarly, I'm not getting a mansion. I can barely get you to buy the servers we need to make half of what you say not a blatant lie. I'm not the one who should be punished when they find out about it. I'm not the one lying to people's faces while I pocket their checks.
I doubt the same would have happened, if Ford or GM would have been the one caught in the act.
Side note but I think he was grabbed at the airport, not extradited from abroad.
Basically "Our customers have been asking for E2E encryption, so I'm adding that to our next sprint."
Ever since I have told anyone that would listen that science is broken and I rarely believe anything until there is a working product. It is beyond sickening how much and how often people lie and how it is constantly covered up by their colleagues who don't want to cause a fuss.
I am sure they already lied in the past too https://news.ycombinator.com/item?id=22711169 preaching ignorance as an excuse.
I've been a Zoom apologist from the beginning, and this is the money shot for me. What exactly do you mean by "security"? You're concerned zoom servers are recording your video - on purpose or because theyre compromised? thats too much data to dragnet (even for the NSA), so you think the servers are recording and theyre targeting your meeting specifically? the threat model here is very small and very specific.
who are the ultrasecret sensitive information folks buying the newest, shiniest, unvetted tool for use where infosec matters? i bought zoom because the ui has simple, big, colorful buttons for my unskilled users where g2m et al. are just a little too complicated.
if i needed an SLA specifying encryption models because of "security", I'd have a contract I could sue over. yes, zoom was wrong. they did a wrong thing, but the outcry against them has just been disproportionate.
If someone can get a transcript of what was said, let alone record, in these therapy sessions, they'd have a goldmine to blackmail from.
Please note, this has legal significance for her and other doctors, who'd started seeing patients over Zoom. So it's not just an abstract, "lulz security"
There are people out there with different threat models from you. Please refrain from talking about use cases you may not understand.
e2e is not a hipaa requirement.
> So it's not just an abstract, "lulz security"
by all means, show me all the concrete harm zoom has done.
But HIPAA does (iirc) require not having arbitrary third-parties to communication. E2E prevents that, but if there wasn't E2E… fairly sure Zoom isn't meant to be a third-party to therapy sessions.
> by all means, show me all the concrete harm zoom has done.
“Oh, they built houses badly? Show me all the concrete harm that's done.” We might not know until the next (metaphorical) earthquake.
Encryption between the last HIPAA covered entity (including business associates) on one end and the first covered entity (including BAs) on the other (or between covered entity on one end and patient on the other) is effectively a requirement of HIPAA in communications between HIPAA covered entities of PHI, since anything else would constitute an unauthorized intentional disclosure of PHI to the third party intermediary (which is a crime, as well as triggering civil liability), and even a third party gaining access to unencrypted PHI without an intentional disclosure is a breach of unsecured PHI triggering mandatory reporting requirements under the HITECH Act.
Because plain old telephone service is not E2E and the phone company can eavesdrop on you quite easily (as can the government with a warrant, or a bad guy with a phone tap on your line...)
Not saying that e2e shouldn’t be used when practicable but a blanket assertion that e2e is required for HIPAA seems a little unbelievable to me when I’ve recently received COVID test results from providers via a cell phone call.
Phone and fax are not considered “electronic” under HIPAA, so the rules, including the rule regarding encryption for exposed PHI to be considered secured vs. unsecured, specific to electronic communication don't apply. I think they may be explicitly given special treatment for some of the not-electronic-specific rules, too. They are well-known to be legacy loopholes to HIPAA privacy/security rules, which is one of the reasons fax held on so long in healthcare as a way of minimizing compliance costs.
You absolutely should not try to intuit what HIPAA requires for anything else by how fax and phone communication in healthcare operates.
Lolwut? Have they confused "electronic" with "computerized" ?
We had a dedicated room with a single computer hooked up only to a dial-up line to submit claims forms to a specific insurance company.
are you saying you have evidence of zoom retaining PHI and not safeguarding appropriately? because that would be a different conversation than everyone yelling because zoom said they were e2e and werent.
All of those have legal requirements for privacy, and many of them used Zoom because it was supposed to meet those requirements. Zoom lied and failed to meet those requirements. There are other ways to meet those requirements (instead of E2E encryption you can have other kinds of controls) but since Zoom claimed to have E2E, they didn't bother with those other ways of meeting the requirements.
This wasn't an accident or a discrepency. Zoom didn't accidentally have some kind of fancy attack that could be pulled off. They literally, knowingly and plainly misrepresented their product, to get sales they shouldn't have. There are words for that like "Fraud".
People at Zoom should be getting jail sentences.
did it? non-e2e is not the same as non-encrypted.
> They literally, knowingly and plainly misrepresented their product
Where has that been proven? as the parent pointed out, there is a wide gulf between misunderstanding and knowingly misrepresenting.
> People at Zoom should be getting jail sentences.
this is precisely why i lean against the anti-zoom sentiment. jail sentences - seriously?! what is the maximum possible harm zoom could have caused? they were wrong and they deserve to be punished, but lets keep things in perspective.
People have paid them some money because of an intentional lie - that's fraud, and fraud (above a certain amount) means jail sentences. There does not necessarily need to be some grievous consequences to justify jail - let's keep things in perspective, "just" defrauding your customers isn't innocuous, it absolutely justifies a criminal investigation and putting people behind bars, not just some monetary fine to the organization.
> Where has that been proven? as the parent pointed out, there is a wide gulf between misunderstanding and knowingly misrepresenting.
...Is this not literally the point of the article that we're discussing? Relevant sections:
> "[S]ince at least 2016, Zoom misled users by touting that it offered 'end-to-end, 256-bit encryption' to secure users' communications, when in fact it provided a lower level of security," the FTC said today in the announcement of its complaint against Zoom and the tentative settlement. Despite promising end-to-end encryption, the FTC said that "Zoom maintained the cryptographic keys that could allow Zoom to access the content of its customers' meetings, and secured its Zoom Meetings, in part, with a lower level of encryption than promised."
> The FTC complaint says that Zoom claimed it offers end-to-end encryption in its June 2016 and July 2017 HIPAA compliance guides, which were intended for health-care industry users of the video conferencing service. Zoom also claimed it offered end-to-end encryption in a January 2019 white paper, in an April 2017 blog post, and in direct responses to inquiries from customers and potential customers, the complaint said.
+ HIPAA violation
+ Violation of jury secrecy
+ FERPA violation
+ False advertising and fraud
That's US specific. I'm sure foreign governments will have their own opinions.
You're right, you can be HIPAA compliant and not be E2E encrypted - if you have the right paperwork and auditing process. Zoom didn't because they claimed to be E2E encrypted.
There are some things you can lie about and it's crappy but not a big deal. "Lag free video streaming!" - Sure, whatever. "The best quality!" Again, don't care. When it comes to information security claims though, lying has very serious penalties because the damage you cause is extremely serious. This wasn't them telling a white lie about how awesome they are, this is them intentionally and knowingly engaging in fraudulant behavior to make profit at the expense and security of users - and we should absolutely punish the hell out of people who do that to line their own pockets with a few extra dollars.
We're migrating stuff to a cloud provider, and they wanted to expose an internal only API to the internet so that the things could reach it. I was strongly against that, as it has no security involved at all. Fast and loose and all of that.
Two, count them, two people wanted to "just change it to use port 443, that way it's encrypted". I had to explain that you could pick any valid TCP port to pass TCP traffic, but simply changing a nonstandard port to "443" doesn't automatically make it start being encrypted. I had to explain that several times in order for it to sink in.
I have also used certificate authentication on TLS-terminating reverse proxies (e.g., this is easy to do with HAProxy) to do the same in other environments. You can pin the API's certificate on the client end in order to further reduce MITM risks.
If you don't want to supply a client certificate in your client application, Stunnel[1] is an acceptable wrapper that lets your clients remain TLS-unaware. You could use it for both ends of the tunnel, if you felt like it.
Either way, you end up with a secure tunnel through the internet to the proxy, at which point you're back inside private networks.
(Source: I build this kind of thing for a living.)
[0]: https://aws.amazon.com/blogs/compute/introducing-mutual-tls-...
Client certs are quite easy to setup. Create a CA cert, sign client certs with it, and allow only clients who have a cert signed by you.
Client cert on Nginx: https://fardog.io/blog/2017/12/30/client-side-certificate-au...
Bonus about client certs: https://drewdevault.com/2020/06/12/Can-we-talk-about-client-...
Phone calls and text messages aren't particularly secure either, doesn't stop people using them
Actually it makes a lot of sense. Your boss sends you a Zoom link and asks you to install Zoom. Or you're having a meeting with the CEO of some company and they send you a Zoom link, saying it's the only thing their company uses. Or you are a high school student learning online and your teacher only delivers lectures on Zoom. Most people listen to their bosses and superiors instead of protesting their viewpoints about security.
Only privileged people can protest. Others just lose their jobs, or don't get their high school diploma.
No, it's not right, but it is the reality.
This sounds like precisely how Grammarly claim they're not a keylogger by trying to change the very definition of what a keylogger is.
Perhaps the term "security" suffers from the same problem as "E2E encryption".
The same reason I use Slack, because I have to.
That is the moment when one calls up the corporate lawyer and asks about "false advertising"...
The university has a MS365 license free for all students, but for video lectures nobody uses it. Why? Because it is really, really cumbersome to use compared to zoom. Teachers and students alike love the functionality, the quality of video/sound and esp. the ease of use.
Compared to all other solutions available to students and teachers - in terms of what they all want to use Zoom just blows the competition out of the water.
And who is to blame them? These are regular folks. They wouldn't even care, if the lectures were tranmitted in the clear, without any encryption. Most regular students fresh out of school I talked to don't even know the difference between https/http, why it is important to have encryption or what end-to-end means.
It has no meaning to nearly all of them.
What a slap on the wrist. "You blatantly lied to your customers for years. How about you just continue to implement the thing that you were working on anyways."
I don't think punishment is always the best solution but it seems that you should at least set some sort of example.
[1] https://www.amazon.com/Dont-Shoot-Dog-Teaching-Training/dp/0...
But more generally, it's not obvious that individual, "reptile-brain" incentives translate to large company leadership. I'd be hugely skeptical of applying positive psychology to international corporate leadership, but what do I know anyway.
--Mitt Romney [0]
So we should all remember that Zoom is probably depressed right now and could probably use some support from its friends. Maybe urge GCal to send it a nice note.
[0] https://www.npr.org/sections/itsallpolitics/2011/08/11/13955...
I hate the
(1) cheat to win and vanquish your competitors
(2) when you're caught, say you're sorry,
(3) win anyway because your competitors are gone
progression. It seems like the penalty for that should be existential or at least something painfully severe.
It's like RealPlayer. By the time the courts catch up, the game is over.
Several people are on zoom instead of Google, for instance, even though I pay for Google. I don't know the other players in the space.
Zoom, unbelievably, built a better video conferencing solution than any product by any other company. Their top competitors were Google, Microsoft, and Cisco - several orders of magnitude larger than them.
In this case, I believe the underdog won.
InfoSec cuts both ways in the market. Sure, products with lower standards “poison the well.” But purchasers with burdensome, pointless, obsolete security audits do far more damage to the ecosystem. It certainly cost my startup a tremendous amount of potential growth. We far exceeded security standards like SOC Type II, but still had to bend how we solved security/user problems to Excel sheet checklists.
Zoom was facing a similar issue - they delivered “secure enough” until it wasn’t. Then they, in months, made massive, productive, effective changes that addressed the new issues from skyrocketing growth.
If our standards for good actors in the tech space is higher than that, I don’t know how humans can achieve them.
In other words: "appealing to the people" instead of addressing the corporation itself is like trying to heat up a climate-controlled room by lighting a small fire in it. You'll be fighting the AC unit all the way and causing lots of unnecessary damage, when the right way to do it is to adjust the thermostat on the AC unit.
https://www.sciencedirect.com/topics/psychology/intermittent...
Honestly - that's inline with the severity of the crime.
>I don't think punishment is always the best solution but it seems that you should at least set some sort of example.
I'm not a fan of regulatory bodies making examples of companies for minor infractions. And this is a very minor infraction.
From my perspective, making security guarantees about a product is the same whether that product is software or hardware. If somebody guaranteed that their ferris wheel had x safety feature, then it turned out to be untrue, nobody would call that a minor infraction.
Obviously we should be utilizing critical thinking ourselves, but I think that we also need the threat of punishment. Because if we have that threat one critical thinker can report the problem and it will be solved for everyone. If there is no punishment then there is no incentive for companies to tell the truth.
https://www.theglobeandmail.com/opinion/article-participatin...
Exactly. Any small startup owners would see jail time. Similar case in recent History is Trump non-profit (please no flamewars). There are tens of thousands of business-owners rotting in jail today because they embezzled half a million bucks or more - here with Trump charity you have case of at least $2 million stolen plus self-dealing and basically living your whole life/paying personal bills out of charity and what does the judge do? - "Here Mr. Trump is a $99 training seminar on "How not to steal" from your own charity. Go get you and your children watch this online class and report back when you done".
Unbelievable.
Why did they have to "agree" to that? Shouldn't that already not be allowed? Also, this sounds a bit like they're allowed to misrepresent other things...
The former still could've been a bit weaselly and misleading (many non-technical users would probably have assumed "encrypted" implied total confidentiality), but what they actually did was so much worse. I hope they get hit hard on that.
Did they? Which people? When? How?
Also, think of the competitors of zoom who lost customers to them due to their lying, that's a harm too, eh?
These are hard to quantify but they're not nothing.
It was encrypted, but not E2EE, so the only person who could have spied was Zoom itself, and we know the how too - by the same mechanism it performs a video recording, for example.
We just don't know if. But seeing as we've had zero reports of any real-world consequences that could only have come about by Zoom spying, combined with the fact that "spying on your customers" is anathema to your business model and therefore a risk no sane and rational board of directors would ever approve (moderate upside, enormous possibly business-ending downside if ever discovered)... Occam's Razor says no spying ever occurred.
And that's not what Occam's Razor means.
Non-E2E encryption doesn't give access to just "the company" (which probably doesn't care to spy on you, true), but absolutely anyone who can bribe/trick/coerse anyone in their "supply chain" (from the CEO to the sysadmins, hosting provider, even janitor...). Not to mention a data leak due to a vulnerability in any part of their stack.
The company has shown complrte disregard for security multiple times in the past and I wouldn't be at all surprised if they had major security holes. And since they already lied about E2EE, it would be entirely safe to assume they would not have disclosed a breach either.
You can know that nobody external to Zoom spied on those streams as they were encrypted between client and Zoom servers. The fact that Zoom had access to your stream, in principle, is par for course.
>These are hard to quantify but they're not nothing.
And they got in trouble. There is the FTC slap and the PR cost associated with the negative publicity. That feels about right for the level of infraction. But when these kinds of articles come out, people are calling for regulatory bodies to 'make examples' of the companies in question. That's not how it works. That's not how it should work.
Why are people still able to pretend otherwise without being laughed out of the room?
It is a variant of a Bible Thumper & Bootlegger coalition.
A large portion of the population really doesn't want to believe it. A small population with a vested interest (and lots of relevant tools at its disposal) is happy to help them.
1. All cryptographic keys controlled by the users.
2. Some way to confirm you are actually connected to who you think you are connected to.
3. A way to confirm that the code you are running is not leaking keys/content.
So Zoom failed on all 3 points. There are lots of things out there claiming E2EE that fail on one or more of these points. Almost all fail on point 2 unless the user does things that they almost never do. Is the FTC going to come up with a E2EE definition for trade and start prosecuting those that don't meet that definition? Otherwise it would seem unfair that they only went after the entity that ended up in the general media.
Are you referring to the "scan this QR code to verify your partner's key" function in secure messaging apps? I definitely use that. I try to keep all my primary contact's keys verified. It's harder during COVID when you're not meeting up in person as often, because anything besides meeting in person and verifying the two devices directly exposes you to another unverified channel.
It's very hard to bootstrap this stuff. Sure, "web of trust" but that's hard too. Speaking of which, didn't Keybase get bought by zoom to help with exactly these issues?
Yes. Or read the weird numbers/letters over the phone. Or look at the strange image and compare it somehow.
For all I know there is something out there that wants you to compare a tune...
I trust Telegram’s E2E, but not Zoom - unless Zoom’s client is on GitHub with deterministic build steps?
[1] https://security.stackexchange.com/a/49802/29703 (a bit dated but AFAIK nothing changed)
A lot dated. The current thing is described here:
That's the concept of E2Z2EE (End2Zoom2End Encryption)
Zoom was thinking of giving only them E2E encryption, and actually I would pay for that service if I would trust Zoom. Currently I use telegram to speak with my friends, but the call drops quite often as we don't have stable internet connection.
Can you provide a better legal definition than what I see? (Only the legal meaning of the word matters in the current context).
We're talking about hundreds of millions of people being effected vs few million people, it matters a lot. You would understand that it's very far from pedantry if you followed all announcements that Zoom had in the past.
Not that it should matter in the context of the feature being described.
Also as I wrote, Zoom was thinking of selling E2E encryption as a payed feature, that's why the distinction really matters (I would happily pay for it if that would give me a strong assurance that I just don't have so far).
I'm not even talking about the gradient ranging from innocent bugs to incompetent coders and how that gets papered over. When you buy shoddy physical goods, there are typically characteristics you can't hide, like cheap materials. But with software like this of course the only function your average person can verify is that the transmission happens, not how it is encoded. Neither Grandma nor your manager are likely to break out tcpdump to check.
And of course the DMCA complicates this in the US, and things are even worse for researchers elsewhere.
Third party audit and reputation are the only fixes I see. And the second one requires a commercial environment that rewards it. The current one doesn't; it rewards novelty and lies, so that's what we get.
Third party audits aren't a silver bullet. Enron and Worldcom had third party audits.
This means that I try to design in such a way that a reasonably competent dev could sit down and rewrite the whole system in a couple hours/days/weeks.
Briefly, the issue with auditing, as with most things, is incentives over time. The difference between fraud in finance and software engineering is how long the bezzle[1] lasts. In finance, it can last a very long time in up economies, leaving Big Three auditors plenty of time to scurry off. In software you have to deliver at some point, leaving lying auditors exposed to discovery by security researchers immediately.
There is certainly still room for shenanigans if not set up correctly, but less than in finance.
I suppose rebranding and transferring assets is kind of like a Chapter 7 "destroyed their business completely", but no one involved went to jail, no one lost their Series 7 or any other kind of licensing, no one was ever barred for life from ever managing at a public company ever again, etc. Sure, to laypeople a selling off of assets and rebranding sounds pretty "destroyed...completely", but unless there are lifelong, severe, natural person repercussions, business people are thrilled with the results. No clawbacks, no offender registration, can always point the blame elsewhere in future discussions (like job interviews). This is mostly regulatory theater, and all net upside for those who benefited by unethical action or by unethical omission.
https://www.wsj.com/articles/string-of-firms-that-imploded-h...
https://news.ycombinator.com/item?id=24802741
Nobody at Arthur Andersen went to prison and SCOTUS reversed their conviction. The firm may have gone up in smoke, but nobody was actually punished for their crimes. Who at Ernst and Young has gone to prison for Wireguard or WeWork? None by my count.
Reproducible builds remove this requirement.
Legal / Terms of Service / Terms of Use / Usage Policy
I find that a majority don't even hide unreasonable conditions in 'legal' terms anymore. Whilst there may be tens, hundreds, of pages in that ToS you tick before using the product - there's a few solid, clear, one sentence dot points that protect from all issues. The best of these is similar to: "We reserve the right to amend, change, or otherwise modify this agreement with - or without - notice.", or "We reserve the right to withdraw services/solutions with - or without - notice." Some, like the famous early React licenses (by Facebook), had indemnity clauses for simply using the product - even if your then legal engagement was entirely unrelated to your use of React. Impacted by Cambridge Analytica? Sorry. Many years ago you experimented with React. Immunity.
I don't think a third party audit is a fix. Even dismissing these previous statements. The volume of 'independent' auditors that are then found corrupt, or otherwise bias/incompetent in result, is pretty regular news. More often than not. Based on some experience with how contracts and engagements go with big corporations - some even factor in known 'expected losses' (such as fines, failing to meet SLA, etc) in their actual budget of contract.
The real fix is users taking responsibility. Don't like the ToS (And, believe me; you won't..). Don't accept it.
(@USERS, not @_jal) But don't complain that the product you did, or did not, pay a cent for - but blindly accepted the ToS - fails to deliver to your expectation. Sure.. It suggested, or possibly even states 'end to end encryption'. But the ToS clarifies context of that.
” The European Commission has told its staff to switch to the encrypted Signal messaging app in a move that’s designed to increase the security of its communications.”
This was February 2020, has something changed?
This level of planning is like the US govt outlawing all guns tomorrow, it just isn't going to happen any time soon since not only are gun-owners usually not the type to want to give up a gun, the prevalence of gun ownership is so massive that it would take equally massive resources to run a completely successful confiscation program.
You mean like what happened with PRISM ?
They don't even need to tell their customers that they lied [2]
1: https://www.ftc.gov/system/files/documents/cases/1923167zoom... 2: https://www.ftc.gov/system/files/documents/public_statements...
>"Today, the Federal Trade Commission has voted to propose a settlement with Zoom that follows an unfortunate FTC formula," FTC Democratic Commissioner Rohit Chopra said. "The settlement provides no help for affected users. It does nothing for small businesses that relied on Zoom's data protection claims. And it does not require Zoom to pay a dime. The Commission must change course."
Under the settlement, "Zoom is not required to offer redress, refunds, or even notice to its customers that material claims regarding the security of its services were false," Democratic Commissioner Rebecca Kelly Slaughter said. "This failure of the proposed settlement does a disservice to Zoom's customers, and substantially limits the deterrence value of the case."
So the right fine here is their entire market cap. That would put them back at square one, which is where an honest competitor would be right now.
That doesn't make sense.
I guess it's the same on Zoom and your company doesn't pay for it.
But Zoom, alone, already has a marketcap of $117.534B (https://finance.yahoo.com/quote/ZM/)
I really think there is an unsustainable distortion happening.
Market cap is a multiplier of revenues, easily 10 or 20 for a tech company, that means a $1T market cap to be taken across the videoconference companies.
Wondering how numbers can be so high? Count $10 per month * 12 months in a year * 100 million employees in the US... that is $12B per year going to video software!
- AMZN: 92
- GOOG: 34
- FB: 33
- NFLX: 76
- AAPL: 35
- MSFT: 35
Compare this to, say, 3M, at 19, or GM with 17.
edit: incidentally, apparently Zoom's P/E is... 527, which is grossly inflated even for a tech company. Tesla is also in the same category with a P/E of 834.
Side note - Go read about Japan's lost decade and you'll see how dangerously close our (US) current speculative investing environment is to theirs before it fell.
Zoom went bananas because they won the space at a point in time that mattered. FaceTime is too proprietary and lacks features due to E2E, WebEx is run by incompetents, Google Meet is hard to use, and Teams is too complex. There’s a thousand other competitors with a few users.
Speculators poured billions into the consort and the valuation went nuts. That could go away in a week.
Yes, soon any website can have their own videoconferencing using web technology like WebRTC. And implementation will be as simple as running "npm install".
> But Zoom, alone, already has a marketcap of $117.534B
Yes. Zoom having a market cap that's more than half of Intel? Come on now ...
Everybody used to have Skype and I would have gladly handed over my data to MS if only it would have been able to do stable video calls. It was often a disaster for just 2-way calls, let alone group.
I imagine some people at Skype probably kept a few instances of Skype running at the office. So they technically hosted a few super nodes, but it wasn't necessarily that they were running some vastly different server version of the app. It wasn't until Microsoft decided to cut down on the P2P aspect of the app and hardcode only Azure-hosted super nodes into the application that this changed.
Stability was the main draw, but company IT departments would have had more power to ban it if there were bigger and clearer risks of corporate secrets escaping.
Some folks are concerned with more than stability and ease of use.
This would mean using only libre/open source software like Jitsu or Linphone, as one could verify the code or higher experts to verify the code.
If this was happenening in any other industry (except fonance?), the perpetrators would be in jail.
That doesn't justify zoom making false claims--I just don't think the companies you're describing would be using zoom.
Defending against sophisticated state-level actors goes even further beyond the requirements of most businesses. Unless you had a specific reason to believe that you were a target of such actors (dealing with national security, or matters of significant national strategic importance), you couldn't justify investing much resource into such defensive measures.
Also due to deception, it auto reinstalled on macs until they were caught.
Just look at the troubles and hurdles Signal messenger need to overcome to implement some features, while the competition that is not so security focused has them since forever.
That is what was great about zoom. The security becomes important after it works.
They did not provide the service the advertised: they provided something much inferior (and that's actually unsuitable for many industries).
It's not really really about "what would clients have done otherwise". It's a matter of giving money back.
If you pay me to write a program, and it only does half of what I promise, wouldn't you want [part of] your money back?
This is absolutely huge. We've tried Teams (and I have previously used Webex and Hangouts).
It seems like there is _always_ one person that struggles with other video services. Can't join, video/audio issues, CPU usage, latency, etc. Painful when 10%+ of a meeting is consumed by getting one last, key person trying to fix their issues.
Otherwise we had hangouts/meet with very basic features and jet-taking-off Mac behaviour, chime which is really good but nobody heard of it (Amazon is not interested in that market apparently), Skype which aims for social chat consumers, slack which works only within the org, jitsi, and a thousand of me-too apps with very basic feature set.
Zoom could kick your puppy at the end of each call, and it would likely still be the best choice at the time :-(
Very few things that are hosted are immune to employee buggery, that’s why companies invest in third party risk management; to assess those risks, which are always material and non-zero and determine if they are within the appetite of the organization.
So there was a competitor after all?
But that's not how capitalism works.
You can be honest business or you can steal billions, get caught and pay a millions in fines. I think everyone can see a problem here. You pay back less then you stole so this is an active encouragement to steal.
Most recent example, morgan stanley fraud for bilions in profit pays fine of 1.5 mil [0].
Reality is borrowing from Kafka.
[0] https://coinweek.com/bullion-report/morgan-stanley-mitsubish...
edit: That was for video streams. For audio streams, certainly the cpus cost is lower - about 10%.
FaceTime is the big E2E service. Most anything else allows dial in, and is not E2E. Zoom’s sin is bad marketing copy.
I don't think Zoom has transgressed anywhere nearly this badly, but even if I did it doesn't make sense to fine any company their entire value unless your goal is simply to destroy them. The company is only worth as much as it is because it is expected to continue as a company, and there would be no way for it to continue if it owed that much money to the government. Unless it was nationalized and run by the government, but I doubt you're proposing that? Which means instead the company liquidates, and its liquidation value is far less than it's value as a business.
Effectively, allow the company to continue as before, but wipe out all shareholders. After all, they are the people who allowed this behaviour. They are the ultimate decision makers.
Which competitors offered true E2E?
I think mostly they were (misleadingly/lyingly) promissing something above what most of their competitors offered, no?
If the clients are open-source and properly implement end-to-end encryption, and you verify that they are not sending your keys to the servers, then what is running on the servers is irrelevant.
Verification can be made with the security code that WhatsApp uses, and the safety number that Signal uses (same thing, different name). Other systems have other, similar methods.
You can verify that they match in order to verify that you're not communicating with a man-in-the-middle, and if the key changes then both apps show a prominent warning.
Granted, a lot of people may not actually bother to verify.
The only relevant vulnerability is stealth updates infecting the client, but the client could disallow it as well.
"Where are the wheels?"
"Well... we delivered most of what was purchased so you don't get to complain."
Ford once paid $300M for a faulty airbags thing, but that was negligence whereas this is fraud. Of course this isn't a lethal risk.
I would think the case would have legs. Haven't a clue how much for.
Go to the supermarket, but a box that says "ten apples". You get home and open it, there's just five apples. You'll want money back. What "damages" do you have to prove?
Unlike that example, it's difficult to know if there were direct damages, but some big companies can come together and try to make a case and sue them and demand huge compensations. Zoom could have spied on your conversations and sold your information to competitors even though they sold the product claiming that they couldn't.
It sounds like OP is referring to a breach of contract. Even if they can't prove damages, they could still be entitled to some other remedy, like a partial refund. It would depend on the language of the contract, of course.
I wish executives would start going to jail over this stuff. Bet they'd stop lying to their customers then.
so, drop Zoom, use a Free and Open-Source alternative. Example: Jitsi (jitsi.org) . It has more rough edges, but it works.
Telephones (VoIP, PSTN, SMS, etc) do not have end-to-end encryption - or any encryption - and we've been using them for conferences since always. Hell, we use them for Zoom calls!
This is some kind of government vendetta, probably pushed by Zoom's competitors who make a bundle in government contracts. Because they're currently the biggest provider, they're the biggest target. But this standard has not been (and will not be) held up to any of its competitors who make similar claims. The political party that is sabre-rattling in this article is just making themselves look good to their constituents.
https://www.blackberry.com/us/en/products/bbm-enterprise
Turns out that by default, BBME is not end-to-end. The initial handshake is transparent to Blackberry, and they could use that to decrypt future messages without your knowledge.
To enable true end-to-end, you have to opt in to an out of band handshake to start each new conversation, an option you can turn on in their admin console.
How many people are actually going to opt in to dealing with a confirmation SMS for every new thread?
I reached out to Blackberry at the time to update their literature as it was misleading, but no action was taken by them.
> The defence in the case surmised that the RCMP must have used the "correct global encryption key," since any attempt to apply a key other than BlackBerry's own global encryption key would have resulted in a garbled mess. According to the judge, "all parties"—including the Crown—agree that "the RCMP would have had the correct global key when it decrypted messages during its investigation."
https://www.vice.com/en/article/mg77vv/rcmp-blackberry-proje...
I'm exaggerating a bit with the above example, but how much corners can someone cut and how much lies can they get away with when it comes to security? Because finding the right balance seems like a serious competitive advantage in the startup space.
No. Because we nerds aren't holding organizational leaders accountable for their IT staffer's choices and diligence owed to purchases.
I suppose the risk with Zoom is leaks due to incompetence rather than leaks due to government intervention.
All e2e claims with closed source software must be dismissed by default. The burden of proof is on the seller.
But yes, impossible-to-verify claims are not worth very much at all.
Yes, I did. Thanks for asking.
> They don't have to pay anything
Yes, but they endured reputational damage, and companies hypothetically lying about it now could reasonably expect to have to pay something in future enforcements, which is what I was trying to get at in my previous comment. Reading it now, it was really sloppily worded by lumping together those things, but I'll leave it as it was so that the rest of this thread makes sense.
> they don't have to actually fulfill their prior claims
Given that they don't claim it any more, I'm not sure that they could be forced to start doing it -- put another way, not having E2E encryption is not a crime as long as you don't claim to have it.
It's a consent order. They're willingly agreeing to it in order to avoid other costs (like fines and a lengthy trial). There's no "forced to" involved.
I think this probably varies a lot between social groups; I know of many people (including non-technical) who were motivated to explore alternatives after reading news articles about Zoom's behaviour. A bunch of non-technical friends subsequently started to use meet.jit.si for meeting up, playing board games, etc, for example.
As for 3reputational damage, that’s a long term effect. A few events won’t have a lasting impact. If it turns out that Apple Key Chain is not e2e, or worse iOS exfiltrates key material from apps, that would be major news, but soon people will forget (if they ever cared in the first place) and keep buying iPhones unless the misbehavior is a recurrent problem. A company like Apple will make it extremely difficult to discover such misconduct.
I wrote:
> the penalties (both in terms of reputation and in terms of monetary fines) for this kind of misbehaviour
You wrote:
> What penalties?
"Apple has a market incentive not to lie!" is an argument I find compelling, but the NSA has a bigger incentive to make Apple lie, and more power than Apple. If Apple & friends were ever offering a truly secure communication channel it is unlikely that was/will be allowed to continue.
https://www.acquired.fm/episodes/the-zoom-ipo-with-santi-sub...
Think of other popular messaging systems that claim to offer some kind of E2EE, but are proprietary software: WhatsApp, Skype, FB Messenger, Viber, Threema, Line…
Distrust by default!
I am always amazed when folks even consider the alleged support for strong E2E encryption in those apps… the value of those claims is exactly zero.
- Open protocols would be helpful. Then you can implement it by yourself and you can see if it is encrypted (and implement whatever other features you may need, including saving energy).
- If they lied to users about end-to-end encryption, then it is false advertising. It is important to avoid false advertising.
Surprised to see them mention the web server thing and not mention that it was so bad that Apple actually updated its antivirus software to remove the Zoom web server.
https://news.ycombinator.com/item?id=25028411
Where the EU is planning to add backdoors to E2E services.
I have often wondered if I should do it at work as well.
I remember reading a while back that Zoom claimed a few times they were e2e-encrypted, but what they meant was transport encryption.
-> Jami (according to their website, I only ever used their chat and regular one-on-one calls)
-> Wire (client and server open source, but not community-lead development)
-> WhatsApp (if you trust Facebook, proprietary back-end)
And if you consider open source & on-premises / "can be completely locked off from the Internet so only you can access it" software to be end to end encrypted (if you personally run the server, you're one of the endpoints):
-> Jitsi Meet (full e2ee is under development, collab with Matrix I think)
-> BigBlueButton
-> Apache OpenMeetings (I never used this one, can't vouch for it)
Signal and Threema don't do group calls as far as I can quickly find online, correct me if I'm wrong.
Anyhow, plenty of options whether you like to self host (saves a ton of CPU on encryption and lets the server do stream mixing) or have full end to end encryption. Why do you care whether they're used by a billion people / "popular"? You can still choose to use them and improve the status quo because why not?
Some notes:
- Wire has published a detailed whitepaper on e2ee. https://wire-docs.wire.com/download/Wire+Security+Whitepaper...
- Jami (formerly GNU Ring) has an interesting post about having e2e here: https://security.stackexchange.com/a/162603/243716
- Jitsi e2e is testable, but they note that it's not completely finished. Key exchange has to be done manually.
- https://github.com/bigbluebutton/bigbluebutton/issues/9893 suggests BigBlueButton don't have e2e yet
- Wikipedia claims "no encryption protocol" for OpenMeetings https://en.wikipedia.org/wiki/Apache_OpenMeetings
---
So that leaves Wire and Jami. Thanks for the info!
As for Jitsi, BigBlueButton, and OpenMeetings, no indeed they don't do encryption currently, hence them being in the second section with open source self-hostable conference software rather than the e2ee section above. To me, depending on the use-case (if you can self host on a trusted system) that would be equally secure and also doesn't leak metadata (who calls who) to some central system.
Wire's most recent system (launched a few weeks ago to make the video conferencing more efficient, bumping max participants from 4 to 12) also tries to avoid learning who is in a conference with who, but fact is that if you observe their datacenter there'll be traffic going to certain IP addresses that starts and stops at the same time.
For what it's worth, to add my experience/recommendations: I really liked the BBB setups I've been in (largest was a hundred or so people) and would recommend that if you're looking for an alternative. Wire also works reasonably and because it's end to end encrypted you don't need your own setup to get started, but isn't as open source oriented as BBB/Jitsi and the CPU load from the encryption during video or screen sharing is quite significant. Jami, last I tested, was quite buggy, but that was way before the pandemic. Full disclose: so far I've only had to decline one Zoom request and so I've never been in a Zoom® call (not a single of our clients uses Zoom, yet people use the brand name as a synonym for video call? I don't get it), so I can't compare any of these with Zoom.
p2p tech that uses e2e and only uses servers to establish a key handshake
It is fact to say that Zoom could be compelled by the CCP to plant backdoors in software to siphon valuable IP for use by Chinese companies, as is usually the case with CCP-aligned companies like Huawei (Huawei had a cash incentive program for employees who delivered stolen IP to them).
e.g.: "You have control over your data"... no, you don't.
How is this getting almost no attention from the ms media?
Are they the same people who want to get rid of encryption?
you, people should believe or trust no one! thats the number one rule for [e2e, or else] security I think.
2021 Nobody can have end to end encryption
Along with is growth in users, Zoom has seen concerns spike about how it is protecting users’ privacy. The Senate advised members not to use the service, according to Ars Technica and the New York City Department of Education banned its use for remote learning. A group of state attorneys general are probing the company after one of the officials was “zoombombed” on a forum about the Census, meaning the chat box was filled with profanities.
Ellison’s support could prove useful to Zoom as it wades through the new challenges of becoming a consumer tech company. Ellison is an influential billionaire with ties to the Trump administration. He has supported Trump’s campaign and even told the President about an anti-malaria drug Trump ended up touting as a possible treatment for the coronavirus, according to The New York Times. Oracle CEO Safra Catz served on Trump’s transition team in 2016.
Both are news "aggregators"
At least their feet will held to the fire!
/s
Tbh though, they will only be held to account, if another big player wants to cripple them and take their market.
>Despite promising end-to-end encryption, the FTC said that "Zoom maintained the cryptographic keys that could allow Zoom to access the content of its customers' meetings, and secured its Zoom Meetings, in part, with a lower level of encryption than promised."
Not wonderful but that still, technically, is an E2E encryption scheme. Is it not? Or do they mean one end terminates in Zoom's servers and it's not E2E through the whole pipe, but rather two pipes stitched together?
Agreed it's not as secure as they marketed, but this seems to suggest if you want to offer E2E you need a specific kind of key storage to meet this new precedent. Good in practice, but maybe the FTC are not the right people to placing such a hurdle down?
I'm sure I've missed something though.
At no point is there encryption directly from one user to anothre.
Our company had stop using zoom for security reasons.
Ah, thank you. That was the bit I was missing.
Silly question I know but I couldn't wrap my head around the wording
The FTC not doing something unreasonable here, I would wager you are by implying they're placing undue hardship on a company that peddles bald-faced lies.
A good E2E-encrypted system would involve Zoom never having the keys at all, so "key storage" would be irrelevant.
The issue here is merely that Zoom claimed to be E2E-encrypted when they were not. They could have simply said "encrypted" and there would be no issue.
Is there anyone doing group videoconferencing with E2E encryption, for more than a handful of participants?
FaceTime supports group calls and claims E2E encryption for them. WhatsApp does too, I believe? I'm not sure how many participants you can have.
I think you use public key cryptography to securely distribute an encryption key for that call. So the host sends 39 messages encrypted with different keys containing a shared key. Then everyone uses the shared key to encrypt/decrypt the call data.