Hacker News Reader

Comment by bborud | Hacker News Reader

Over the past decade I've had to deal with a lot of executives and security people who don't actually understand security all that well. Or at all. (Not that I'm a security expert, but that hardly makes it better when even I can see that something is nonsense).

Right now I know of at least half a dozen products that are marketed as having E2E encryption but do not actually implement this (no, I'm not going to out them. See second to last paragraph as to when to be wary). In part because executives, marketers and salespeople don't know what it means. And in part because when explained what it means they will insist on their own definition/interpretation and demand the product is marketed as E2E.

It is also important to note that quite often you are not dealing only with the company that makes a product, but the regulatory bodies that can pressure companies into complying with their wishes.

As for Zoom, I don't understand why people trust them or still use their product if they are at all concerned about security. It makes very little sense.

View on HN

> It is also important to note that quite often you are not dealing only with the company that makes a product, but the regulatory bodies that can pressure companies into complying with their wishes.

While considering the regulatory requirements helps explain the desire to lie, it does not make the lie any more defensible. Even if a regulatory body is making impractical demand, I very much doubt they are demanding companies lie to their users and potential users. Even if they were "just following orders guv" is not an acceptable excuse.

The key facts: Zoom lied. They didn't have to. They could have accurately reported what encryption they use and what they were working towards if that was due to change.

Even if we accept that the initial claims were wrong due to executives misunderstanding what their own security/dev people had stated, that doesn't defend continuing to make the claim without seeking further clarity after questions were raised.

Unless there was a gag order. We should make gag orders unconstitutional.

Gag orders don't force you to state wrong facts about your products in the first place.

What if they do?

Then it is not a gag order. A gag order means "don't say anything about X" and is not concerned with what you might or might not say instead.

Look up "warrant canary". IANAL, but my understanding is that you can be secretly compelled to not speak, but you cannot be legally compelled to actively tell a lie -- the Wikipedia page agrees with my interpretation. So, you can just publish "I am not subject to a gag order" every day until you are subject to one.

It's probably more feasible to require them to be disclosed after a period of time

"In part because executives, marketers and salespeople don't know what it means."

Being a technical founder, I found some non-technical founders use this an advantage. They can lie to customers without guilt or investors with brimming confidence about their "MVP". They can use "making it simple" or "ignorance" as an excuse, if at all they get caught. These kind of lies are grey lines and exist everywhere.

Have also encountered founders that know the difference, but lie about things by using 'weasel words' that are chosen to suit their audience, who may not be so knowledgeable :(

I've worked with these types of people and what I've noticed is, even after you explain to them simply what they're saying is false, they insist or pushing those statements or as close to those labels as they can. They may even be angry after you inform them because they lose plausible deniability.

I've also been in situations where an ultimatum like E2E encryption is dictated by a marketing team and then expected to be created without adequate budgeting or time, essentially creating pressures on development teams, project/product managers, etc to lie.

The conclusion I've come to in business is that ultimately, your product or service is going to be falsely advertised and oversold one way or another. It's a lot easier for some to lie, act deceitful, and/or feign ignorance than it is to actually deliver. Your competitors are doing it, if you don't, you lose.

The way I deal with this nonsense is that I make it a point at least once in meeting or fairly tracable record like an email that others know what is and isn't true once and it's up to them to decide who they want to lie to. I've been on the other side being pressured to lie and its not fun so I'll happily pass that responsibility. I didn't pursue a career in computing to be a constant liar, I'll let the people who want to lie, lie.

>Your competitors are doing it, if you don't, you lose.

What's far more interesting to me is the fact that your vendors are doing it. I wonder how much business efficiency could be gained by taking advantage of the fact that we all know the products our businesses are buying are oversold?

You may find it interesting that recently Malwarebytes was mentioned in relation to 230 of the DMCA which to my mind relates directly to this. They are an AV solution that holds "legitimate" software vendors that operate an above board business to the fire when they start any practice that they (Malwarebytes) determines is violating a PC users reasonable expectations. That software begins to be detected as "potentially unwanted software" and recommended for quarantine just like any other virus.

Malwarebytes spends a whole lot of time defending the fact it recommends software from these companies for removal and the recent SCOTUS memo on the topic sort of implies that the problem -- how do we determine the voracity of statements made by businesses regarding their software, especially software which exists in a constantly changing state -- may be headed towards getting worse as so few people are familiar with legislation also have good understanding of the inherent complexity of software.

Tangent: Cheat Engine, an amazing piece of software, mentions on their website that they may be detected as malicious software because they do a lot of the same things malicious software does - hook into other processes and modify their behaviour, optionally with a kernel hook.

They don't mention that their installer ships with tons of malware that they install, and more that they try to trick you into installing but you can technically opt-out.

> how much business efficiency could be gained by taking advantage of the fact that we all know the products our businesses are buying are oversold?

Not much tbh. Our only other option is to not buy, and build in-house instead. Sometimes that's worthwhile, but other times (like in the case of zoom) it still makes sense to buy the vendor's product, even if you know that it's not everything it's advertised as being.

The real efficiency is found in having people who can determine which and if you should buy a vendor's product, or if you should go in house. Specifically people who can see through the marketing BS and evaluate technologies without personal or hype bias.

In an unfortunately rare case of reason conquering madness, a VW exec (Oliver Schmidt) was extradited and convicted over the diesel emissions scandal, instead of the engineers taking the brunt of the punishment.

We expect name brand products to indemnify their vendors to an extent. Consumers don't want to chase down the guy who made the screw that failed and caused a bunch of excess deaths. You put the screw in the assembly, you took most of the profit margins. So you get the lawsuit.

If you want to go and sue your vendor to recover damages, that's between you and the vendor. But the class action goes to Acme Inc, not Acme Screws and Fasteners.

Similarly, I'm not getting a mansion. I can barely get you to buy the servers we need to make half of what you say not a blatant lie. I'm not the one who should be punished when they find out about it. I'm not the one lying to people's faces while I pocket their checks.

I doubt the case of the VW manager can be adressed to reason (alone). Lots of politics going on, too. US vs. EU.

I doubt the same would have happened, if Ford or GM would have been the one caught in the act.

> In an unfortunately rare case of reason conquering madness, a VW exec (Oliver Schmidt) was extradited and convicted over the diesel emissions scandal, instead of the engineers taking the brunt of the punishment.

Side note but I think he was grabbed at the airport, not extradited from abroad.

I was trying to recall his name and did some googling. One of the first articles said that he had been approved for extradition. Sounds like they just got to him before the state department had to step in.

It would be easy to ignore them, if they don't poison an entire startup ecosystem. If such founder gets into press and speaking circuit, lot of newbie founders assume such exaggeration is needed to succeed and this behavior becomes part of that ecosystem. Then it becomes hard to have authentic conversation with anyone there.

> I've also been in situations where an ultimatum like E2E encryption is dictated by a marketing team and then expected to be created without adequate budgeting or time, essentially creating pressures on development teams, project/product managers, etc to lie.

Basically "Our customers have been asking for E2E encryption, so I'm adding that to our next sprint."

Your experience sounds identical to my career in biotech. My PI wanted a new line that produced a certain transgenic protein. When I explained that it wasn't possible I was asked if one set of results from another assay could be "used" in the current project. I said no but still provided all the the necessary data to lie if that was what they wanted to do. The lab ended up getting a $75k plus grant because of the fabricated data and I was left disillusioned and quit soon afterward.

Ever since I have told anyone that would listen that science is broken and I rarely believe anything until there is a working product. It is beyond sickening how much and how often people lie and how it is constantly covered up by their colleagues who don't want to cause a fuss.

Some non-technical founders will just make stuff up. If they think it's a "small change", it may as well be done, so they speak about it as if it is. You correct them and you are ignored, or they tell you it's just for a high level discussion, so it doesn't matter. Sometimes they're right, sometimes they're not. It is a very fine line between stretching the truth and exaggeration, outright lies. As "technical" people we try to be precise on our language and want statements to reflect reality.

I totally agree with you.

I am sure they already lied in the past too https://news.ycombinator.com/item?id=22711169 preaching ignorance as an excuse.

Willful ignorance as a mask for fraud seems like a week defense when one is targeting regulated industries.

Oh man I had a great one last week.

We're migrating stuff to a cloud provider, and they wanted to expose an internal only API to the internet so that the things could reach it. I was strongly against that, as it has no security involved at all. Fast and loose and all of that.

Two, count them, two people wanted to "just change it to use port 443, that way it's encrypted". I had to explain that you could pick any valid TCP port to pass TCP traffic, but simply changing a nonstandard port to "443" doesn't automatically make it start being encrypted. I had to explain that several times in order for it to sink in.

If it's AWS, the quickest path to doing this securely is AWS API Gateway mTLS authN[0]. You generate some certs, stuff the public halves in S3, slap an ACM cert on the Gateway, and you're done.

I have also used certificate authentication on TLS-terminating reverse proxies (e.g., this is easy to do with HAProxy) to do the same in other environments. You can pin the API's certificate on the client end in order to further reduce MITM risks.

If you don't want to supply a client certificate in your client application, Stunnel[1] is an acceptable wrapper that lets your clients remain TLS-unaware. You could use it for both ends of the tunnel, if you felt like it.

Either way, you end up with a secure tunnel through the internet to the proxy, at which point you're back inside private networks.

(Source: I build this kind of thing for a living.)

[0]: https://aws.amazon.com/blogs/compute/introducing-mutual-tls-...

[1]: https://www.stunnel.org/auth.html

Thanks a lot for this comment. I really appreciate it. That mTLS solution is something that would solve this problem immediately.

I'd just like to point out that it's also very easy to do on most reverse proxies. Client cert, or even regular password protection.

Client certs are quite easy to setup. Create a CA cert, sign client certs with it, and allow only clients who have a cert signed by you.

Client cert on Nginx: https://fardog.io/blog/2017/12/30/client-side-certificate-au...

Bonus about client certs: https://drewdevault.com/2020/06/12/Can-we-talk-about-client-...

> As for Zoom, I don't understand why people trust them or still use their product if they are at all concerned about security. It makes very little sense.

I certainly don't trust them, but I do use Zoom (from a dedicated unprivileged user, so it can't do any harm beyond recording my conversations), because my colleagues use Zoom, and because there doesn't seem to be any working alternative. I got them to try Jitsi once, which simply didn't work.

PS. There may be working /secret-source/ alternatives, but I don't know why one should think Zoom /more/ untrustworthy than them.

Cisco Webex is used in my workplace. We forbid anyone from installing Zoom over security concerns

What specific concerns that aren't also relevant to Webex?

As another poster said, the very large company I work at bans Zoom. We can use Teams, Webex, Skype, etc.

How can you say there is no alternative?

Sorry, I didn't think in terms of degrees of untrustworthiness. What I miss is an open-source alternative. Doesn't Microsoft let the NSA tap into Skype calls?

>Doesn't Microsoft let the NSA tap into Skype calls?

Yes, but it seems like Skype was doing that prior to being acquired (though Microsoft seems to have accelerated things). From some quick Googling to refresh on PRISM –

>• In July last year, nine months after Microsoft bought Skype, the NSA boasted that a new capability had tripled the amount of Skype video calls being collected through Prism;

>• Microsoft helped the NSA to circumvent its encryption to address concerns that the agency would be unable to intercept web chats on the new Outlook.com portal;

>Eight months before being bought by Microsoft, Skype joined the Prism program in February 2011.

> According to the NSA documents, work had begun on smoothly integrating Skype into Prism in November 2010, but it was not until 4 February 2011 that the company was served with a directive to comply signed by the attorney general.

https://www.theguardian.com/world/2013/jul/11/microsoft-nsa-...

Don't forget about teams.

I wouldn't assume that any given service is secure just because it hasn't been outed yet. Your guess is as good as mine with regard to which service is more secure or less secure.

What is immensely important is to raise the cost of lying to where it becomes something investors care about. The only real thing a company and its investors are afraid of is losing its customers.

If we teach companies it is okay to lie by staying with them, they will lie more.

How about Jitsi?

https://meet.jit.si/

https://jitsi.org/

They said: "I got them to try Jitsi once, which simply didn't work."

Ah thanks, I didn't see that was the same person higher up.

There are at least half a dozen of open-source alternatives. Have you tried all of them ?

For instance Big Blue Button : it's not perfect, because it's Canadian, it's hosted on Microsoft's Github, and might have some outstanding security issues [1], but I would probably still trust it more than Zoom or anything GAFAM.

[1] https://en.wikipedia.org/wiki/BigBlueButton#Security

Each of those alternatives is just as likely to offer government wiretap support to any government that asks as Zoom is, unless I’ve missed statements of refusal to do so to the contrary from them.

I think the concern is trade secret theft. Sure the US or EU might demand a wiretap but their goals are different. You don't see the CIA stealing trade secrets and handing them over to Apple or Microsoft. Businesses are primarily worried about their IP.

That would probably be the NSA, and why would you expect them to NOT do industrial espionage ?

Well they do...it's not new:

https://www.bbc.com/news/25907502

Teams does not allow users to place themselves in breakout rooms. Webex does not allow Linux users to grant control of their screens.

When you use these platforms all the time, you find these little issues. Generally speaking, Zoom does it best, despite their problems.

You can set up channels in a ‘team’ and use those for breakouts.

This would require all the attendees to be members of the team ahead of the meeting; this isn't how we use Zoom.

Ya, definitely requires more pre-planning, but maybe it’s still a hack that could be used. Just delete the ‘team’ afterwards.

Maybe there is a way to automate this with some VB/Python script?

I know of more than one company where installing zoom on any company owned equipment, or using zoom on your own client devices for company business is a fireable offense.

These are companies that deal with some very sensitive data.

never heard of these also-rans

What does not work with jitsi? I've been using a lot recently and it is by far the easiest one to use. One link and done. I have lots of video and audio issues with zoom. Now, if you're a company, bluejeans may be the best one.

There was a period a few months ago where jitsi was consistently crashing chromebooks. Obviously, if a webpage can crash the OS, it's an OS problem, but it still made jitsi unusable for those with chromebooks.

Well, obviously you're not going to have good performance from a web app. Why didn't they install the native app ?

The native app doesn't work with the free 8x8 rooms, as far as I could tell.

I'm not sure I consider not crashing the OS when the conference starts 'good performance' so much as 'working'. Running it in Firefox at the time was bad performance (sluggish), haven't tested since.

I think both video and audio were skippy to the point of uselessness. I've also used Jitsi with moderate success with a couple of interlocutors, where video disappeared now and then.

I'm not a company, I'm at a university, and the u. has decided to use Zoom, perhaps because it doesn't care about security, or because it thinks being concerned about Zoom is being paranoid.

If you're going to have 10+ People in the meeting, there will be issues. Video/Audio getting bad, People loose have signal, etc. There is also a very noticable load on even more powerful PCs once you have some more people in the call.

So jitsi might work for one-on-ones but slightly bigger conference calls are a no-go.

I tried this and can confirm! I always had about 6-8 persons and never got this issue before. Well, this actually explains a lot of comments I see about Jitsi.

For 10-100 people, use BigBlueButton instead.

Yes, retention by strong network effect is scary. But I'm being Captain Obvious here :-)

A working alternative is google _meet_

right - since google is well know for its privacy and telling the truth.

> from a dedicated unprivileged user, so it can't do any harm beyond recording my conversations

Unless I'm misunderstanding what you mean by that, I don't really see the point in it, TBH.

Have there been cases of Zoom infecting machines with malware or transmitting viruses? The whole concern, as far as I know, is terrible security on their end, allowing people into calls without permission, not having E2E encryption, etc, and running as an unprivileged user won't help with that at all.

There's been a few zero day client remote code execution vulnerabilities, along with some problems withe installer AFAIK.

You don't see the point of being suspicious of secret-source? and especially of an entity that is known to be dishonest? unless it is known to have been dishonest in the precise manner in question?

Google's Meet has improved considerably and most importantly it comes free with G-Suite. They are also pushing it quite hard as every calendar invite has a Google Meet link automatically included.

The reason that people went with Zoom is "because it worked." As other products improve it's hard to see what Zoom's moat is and why we should continue to pay for it.

> The reason that people went with Zoom is "because it worked." As other products improve it's hard to see what Zoom's moat is and why we should continue to pay for it.

Ironically, I would say Google Meet defines "it just works" for me way more than does Zoom.

Joining a Google Meet:

1. Enter the URL in your browser.

2. Click join.

Joining a Zoom:

1. Enter the URL in your browser.

2. Accept launching an executable.

3. Watch a window or two pop up and close.

4. Decide if you're using video or not.

5. Watch more windows pop up and close.

6. See the main Zoom window appear.

7. Decide if you're using audio or not.

Perhaps part of my beef with Zoom is how many times its window shuffling steals focus during the several seconds needed to join a meeting. If I'm trying to get work done while waiting for a meeting to start, the focus stealing is very obnoxious.

It's not necessary for everyone to have a Google account?

"You don't need a Google Account to participate in Meet video meetings. However, if you don’t have a Google Account, the meeting organizer or someone from the organization must grant you access to the meeting."

https://support.google.com/meet/answer/9303069

Joining a BigBlueButton/Jitsi meeting:

1. Enter the URL in your browser.

2. Choose a nickname or log in.

3. Click join.

4. Decide if you're using video or not.

5. See a video test.

6. Decide if you're using audio or not.

7. See an audio test.

(steps 5 and 7 are absent in a Jitsi meeting)

you could try: https://xroom.app or https://go.xroom.app

I have an entire Windows VM set up just for Zoom meetings.

that's kind of sad if you really think about it.

My boss is one of those people. He insists to our customers (and engineers) our product has encryption. It does not.

I strongly recommend attempting to fix that and/or (while I am aware that it may be difficult in the current climate) searching for a new boss.

In the meantime be very careful to monitor anything your name is associated with, just in case any of your customers get wind of the situation and sue-balls are thrown.

had a boss that marketed our product as having AI solutions while it had nothing to do with AI, lol.

Given how most actual AI solutions work under the hood, this might not even be a lie!

Our system has an AI module.

AI module:

If something

Else if something else

Else if

...

Else Call Human

We practice responsible and safe approach to AI, by detecting situations the AI can't handle and deferring to human response.

(It just so happens that the set of things the AI can handle is empty.)

To be honest, before the modern machine learning approach, this was known as a decision tree and was thought to be a valid way to approach "artificial intelligence". Lots of "AI" hype in the 80s was based around "Expert systems" and "Decision trees".

And there are even modern tree based approaches, that beat some of the modern artificial neural network approaches! It's not like it has become an absolutely unusable class of algorithms.

People seem to think that the presence of neural nets and deep learning means that most of types of models are practically superseded whereas in my experience if some non-deep-learning model even gets you mostly there, then the efficiency and explain-ability wins make it worth it.

At my previous job I had a ML-based service that used a basic random-forest model instead of a neural net because it was faster to train and operate, not to mention easier to maintain and had equivalent accuracy with little to no effort required on my part. It was a solid little service.

And you can even do both. Decision tree to get to a smaller problem space, then NN on the output. You end up with a bunch of neural nets, each of which performs better than a single monolithic net due to solving a simpler problem.

Yeah! Stacking models and playing on each types strength is a great strategy.

Decision trees/behaviour trees are still the most widely used way to build video game AI. Of course video game AI just has to appear smart, really you're solving a different problem a lot of the time.

That many (most?) companies in this space lie through their teeth doesn't excuse the lie.

> Given how most actual AI solutions work under the hood, this might not even be a lie!

Even back in the 80's, the computer algorithms that played the other side in computer games was called "the AI".

AI is pretty meaningless. Any computer program or robot-executed algorithm can be called AI.

I would have a conversation with your companies legal department.

A lot of startups don't have a legal department.

You answered your own question in your last statement. People don't care about security. They care about it being easy to use and Zoom works better and for more (non-technical) users than any other tool of its kind.

For a long time zoom was the best choice for technical users too, as webex, Skype, and everything except for google hangouts had terrible Linux support.

> As for Zoom, I don't understand why people trust them or still use their product if they are at all concerned about security. It makes very little sense.

Phone calls and text messages aren't particularly secure either, doesn't stop people using them

At least phone calls are protected by law in some capacities (HIPAA allows for faxing but not email, warrants are supposed to be required for tapping phone lines but not email, etc)

Faxes are "exempt", not secure. The intent was that they die off sooner rather than later.

Hi there! I'm in the video meeting space, and always looking to find that blend between usable and secure.

I'm curious - is there a video service out there you would recommend if you're conscious about security? Your third paragraph makes me think your opinion will be that no large company can be trusted, because they become a target for nation-state regulatory bodies.

Yes, although there are degrees and differences in culture.

For instance in the telco world you have a much more direct dependence on regulators because you need a stack of expensive and hard to acquire licenses to operate a network in most parts of the world. Some worse than others. In that environment there is a very high degree of compliance with regulators because they have to be given explicit permission to operate.

For pure internet services or P2P applications it is quite a bit different. You don't actually need anyone's permission to distribute software. And you can move your servers around the world. You don't depend on permission - just that nobody comes after you with warrants you cannot ignore.

So the advice is really to look at who you are dealing with and how dependent they are on regulators to operate.

Large internet companies tend to have entire divisions whose job it is to tell regulators to get lost or at the very least maintain a really high bar for interference. Of course, this becomes difficult when the government is also a large customer. So for instance you might want to be careful with vendors who make a lot of money in / off of the defense and intelligence sectors.

Thank you for the explanation! Seems to me that you're describing a trust chain where the product is directly affected by the landscape in which the parent company operates and their biggest customer base.

I really appreciate your insight.

Use Jitsi (https://jitsi.org). You can find people to host or host your own. Open Source. No downloads for participants. try their instance meet.jit.si

I'd love to, but IME it's unstable with more than a handful of participants and doesn't offer stuff I need, such as breakout rooms.

Unfortunately, Jitsi isn't a viable solution at this point except for 1 on 1.

https://xroom.app/

> As for Zoom, I don't understand why people trust them or still use their product if they are at all concerned about security. It makes very little sense.

Actually it makes a lot of sense. Your boss sends you a Zoom link and asks you to install Zoom. Or you're having a meeting with the CEO of some company and they send you a Zoom link, saying it's the only thing their company uses. Or you are a high school student learning online and your teacher only delivers lectures on Zoom. Most people listen to their bosses and superiors instead of protesting their viewpoints about security.

Only privileged people can protest. Others just lose their jobs, or don't get their high school diploma.

No, it's not right, but it is the reality.

Disagree. Engineers of that system surely knew it wasn't E2E and voiced it, but marketing purposely lied. I will bet my farm on that.

For Zoom I suspect you are right. I think the engineers know what it means. But I have met a disturbing number of engineers (in security oriented jobs) who do not understand what the term means.

Regulation should prevent this from occurring. If you use a product that claims it is E2E and it is not, you should be able to sue wildly for potential damages given the sensitive nature of the software.

Well, there might be conflicting interests within government. From a consumer advocate perspective government might want to demand this. From an intelligence services perspective you might want companies to lie.

> From an intelligence services perspective you might want companies to lie.

No, I don't. I don't want companies to lie. You can collect intelligence the same way we've been collecting intelligence for our entire history on this planet prior to E2E comms. E2E isn't a hindrance, it's a way to enforce limitations on government overreach.

No freedom is without compromise.

You don't. But I'm afraid that is the reality. The only way to change that is by law and then vigorous enforcement of law. That isn't likely to happen.

You are presumably not an intelligence agency.

> Regulation should prevent this from occurring.

It already exists. It's called "fraud".

On one level, yes.

On the other hand, I think things involving cryptography at scale ought to come with regulations on language

For example, look at how the word "bank" is specially regulated by most governments. I can't just call myself a bank without meeting specific guidelines or else it's not just typical fraud, it's major financial fraud coupled with putting sensitive customer data at risk.

Same here. We need specific legislation targeting these scummy businesses who use corporate ignorance as an excuse for selling a product under false pretenses of end-to-end encryption.

Exactly. Look at what Zoom is doing, they simply redefined end2end to mean something else so that they could brag about having it.

"As for Zoom, I don't uderstand why people trust them or still use their product if they are at all concerned about security."

Perhaps the term "security" suffers from the same problem as "E2E encryption".

> As for Zoom, I don't understand why people trust them or still use their product if they are at all concerned about security.

The same reason I use Slack, because I have to.

> In part because executives, marketers and salespeople don't know what it means. And in part because when explained what it means they will insist on their own definition/interpretation and demand the product is marketed as E2E.

This sounds like precisely how Grammarly claim they're not a keylogger by trying to change the very definition of what a keylogger is.

It doesn't make sense to a computer savvy hacker news poster perspective. But to everyone else, the reason they use it because they don't really care or thought about it. It will continue to be the most popular meeting app despite the wailing and gnashing from Hacker News.

I see my significant other using it on a nearly daily basis. She started a uiversity course in her 30ies and due to Corona is in her second semester from home.

The university has a MS365 license free for all students, but for video lectures nobody uses it. Why? Because it is really, really cumbersome to use compared to zoom. Teachers and students alike love the functionality, the quality of video/sound and esp. the ease of use.

Compared to all other solutions available to students and teachers - in terms of what they all want to use Zoom just blows the competition out of the water.

And who is to blame them? These are regular folks. They wouldn't even care, if the lectures were tranmitted in the clear, without any encryption. Most regular students fresh out of school I talked to don't even know the difference between https/http, why it is important to have encryption or what end-to-end means.

It has no meaning to nearly all of them.

> And in part because when explained what it means they will insist on their own definition/interpretation and demand the product is marketed as E2E.

That is the moment when one calls up the corporate lawyer and asks about "false advertising"...

Tell us!

> I don't understand why people trust them or still use their product if they are at all concerned about security.

I've been a Zoom apologist from the beginning, and this is the money shot for me. What exactly do you mean by "security"? You're concerned zoom servers are recording your video - on purpose or because theyre compromised? thats too much data to dragnet (even for the NSA), so you think the servers are recording and theyre targeting your meeting specifically? the threat model here is very small and very specific.

who are the ultrasecret sensitive information folks buying the newest, shiniest, unvetted tool for use where infosec matters? i bought zoom because the ui has simple, big, colorful buttons for my unskilled users where g2m et al. are just a little too complicated.

if i needed an SLA specifying encryption models because of "security", I'd have a contract I could sue over. yes, zoom was wrong. they did a wrong thing, but the outcry against them has just been disproportionate.

My therapist uses Zoom for her clients, as she was assured that the E2E would help her meet HIPAA requirements and protect her patients.

If someone can get a transcript of what was said, let alone record, in these therapy sessions, they'd have a goldmine to blackmail from.

Please note, this has legal significance for her and other doctors, who'd started seeing patients over Zoom. So it's not just an abstract, "lulz security"

There are people out there with different threat models from you. Please refrain from talking about use cases you may not understand.

> E2E would help her meet HIPAA requirements

e2e is not a hipaa requirement.

> So it's not just an abstract, "lulz security"

by all means, show me all the concrete harm zoom has done.

> e2e is not a hipaa requirement.

But HIPAA does (iirc) require not having arbitrary third-parties to communication. E2E prevents that, but if there wasn't E2E… fairly sure Zoom isn't meant to be a third-party to therapy sessions.

> by all means, show me all the concrete harm zoom has done.

“Oh, they built houses badly? Show me all the concrete harm that's done.” We might not know until the next (metaphorical) earthquake.

> e2e is not a hipaa requirement.

Encryption between the last HIPAA covered entity (including business associates) on one end and the first covered entity (including BAs) on the other (or between covered entity on one end and patient on the other) is effectively a requirement of HIPAA in communications between HIPAA covered entities of PHI, since anything else would constitute an unauthorized intentional disclosure of PHI to the third party intermediary (which is a crime, as well as triggering civil liability), and even a third party gaining access to unencrypted PHI without an intentional disclosure is a breach of unsecured PHI triggering mandatory reporting requirements under the HITECH Act.

Does that mean whenever medical information is sent via phone or Fax, HIPAA is being violated today?

Because plain old telephone service is not E2E and the phone company can eavesdrop on you quite easily (as can the government with a warrant, or a bad guy with a phone tap on your line...)

Not saying that e2e shouldn’t be used when practicable but a blanket assertion that e2e is required for HIPAA seems a little unbelievable to me when I’ve recently received COVID test results from providers via a cell phone call.

> Does that mean whenever medical information is sent via phone or Fax, HIPAA is being violated today?

Phone and fax are not considered “electronic” under HIPAA, so the rules, including the rule regarding encryption for exposed PHI to be considered secured vs. unsecured, specific to electronic communication don't apply. I think they may be explicitly given special treatment for some of the not-electronic-specific rules, too. They are well-known to be legacy loopholes to HIPAA privacy/security rules, which is one of the reasons fax held on so long in healthcare as a way of minimizing compliance costs.

You absolutely should not try to intuit what HIPAA requires for anything else by how fax and phone communication in healthcare operates.

> Phone and fax are not considered “electronic”

Lolwut? Have they confused "electronic" with "computerized" ?

Former HIPAA security officer here. Yes, mostly.

We had a dedicated room with a single computer hooked up only to a dial-up line to submit claims forms to a specific insurance company.

Keep in mind that, while the current phone system is very much electronic, the phone system historically predates electronics. It is electric, but not inherently electronic.

Yes, this is a long way of saying e2e is not a hipaa requirement.

are you saying you have evidence of zoom retaining PHI and not safeguarding appropriately? because that would be a different conversation than everyone yelling because zoom said they were e2e and werent.

Therapists, lawyers, courts including closed door courts, confidential internal meetings for publically traded companies, doctors appointments, exchanging passwords/etc. Even my mom just telling me about a medical situation she's having.

All of those have legal requirements for privacy, and many of them used Zoom because it was supposed to meet those requirements. Zoom lied and failed to meet those requirements. There are other ways to meet those requirements (instead of E2E encryption you can have other kinds of controls) but since Zoom claimed to have E2E, they didn't bother with those other ways of meeting the requirements.

This wasn't an accident or a discrepency. Zoom didn't accidentally have some kind of fancy attack that could be pulled off. They literally, knowingly and plainly misrepresented their product, to get sales they shouldn't have. There are words for that like "Fraud".

People at Zoom should be getting jail sentences.

> Zoom lied and failed to meet those requirements.

did it? non-e2e is not the same as non-encrypted.

> They literally, knowingly and plainly misrepresented their product

Where has that been proven? as the parent pointed out, there is a wide gulf between misunderstanding and knowingly misrepresenting.

> People at Zoom should be getting jail sentences.

this is precisely why i lean against the anti-zoom sentiment. jail sentences - seriously?! what is the maximum possible harm zoom could have caused? they were wrong and they deserve to be punished, but lets keep things in perspective.

> jail sentences - seriously?! what is the maximum possible harm zoom could have caused?

People have paid them some money because of an intentional lie - that's fraud, and fraud (above a certain amount) means jail sentences. There does not necessarily need to be some grievous consequences to justify jail - let's keep things in perspective, "just" defrauding your customers isn't innocuous, it absolutely justifies a criminal investigation and putting people behind bars, not just some monetary fine to the organization.

>> They literally, knowingly and plainly misrepresented their product

> Where has that been proven? as the parent pointed out, there is a wide gulf between misunderstanding and knowingly misrepresenting.

...Is this not literally the point of the article that we're discussing? Relevant sections:

> "[S]ince at least 2016, Zoom misled users by touting that it offered 'end-to-end, 256-bit encryption' to secure users' communications, when in fact it provided a lower level of security," the FTC said today in the announcement of its complaint against Zoom and the tentative settlement. Despite promising end-to-end encryption, the FTC said that "Zoom maintained the cryptographic keys that could allow Zoom to access the content of its customers' meetings, and secured its Zoom Meetings, in part, with a lower level of encryption than promised."

> The FTC complaint says that Zoom claimed it offers end-to-end encryption in its June 2016 and July 2017 HIPAA compliance guides, which were intended for health-care industry users of the video conferencing service. Zoom also claimed it offered end-to-end encryption in a January 2019 white paper, in an April 2017 blog post, and in direct responses to inquiries from customers and potential customers, the complaint said.

> what is the maximum possible harm zoom could have caused?

+ HIPAA violation

+ Violation of jury secrecy

+ FERPA violation

+ False advertising and fraud

That's US specific. I'm sure foreign governments will have their own opinions.

You're right, you can be HIPAA compliant and not be E2E encrypted - if you have the right paperwork and auditing process. Zoom didn't because they claimed to be E2E encrypted.

There are some things you can lie about and it's crappy but not a big deal. "Lag free video streaming!" - Sure, whatever. "The best quality!" Again, don't care. When it comes to information security claims though, lying has very serious penalties because the damage you cause is extremely serious. This wasn't them telling a white lie about how awesome they are, this is them intentionally and knowingly engaging in fraudulant behavior to make profit at the expense and security of users - and we should absolutely punish the hell out of people who do that to line their own pockets with a few extra dollars.

Reply on news.ycombinator.com