Zoom Meetings Aren't End-to-End Encrypted, Despite Misleading Marketing (theintercept.com) 74
An anonymous reader shares a report: Zoom, the video conferencing service whose use has spiked amid the Covid-19 pandemic, claims to implement end-to-end encryption, widely understood as the most private form of internet communication, protecting conversations from all outside parties. In fact, Zoom is using its own definition of the term, one that lets Zoom itself access unencrypted video and audio from meetings. With millions of people around the world working from home in order to slow the spread of the coronavirus, business is booming for Zoom, bringing more attention on the company and its privacy practices, including a policy, later updated, that seemed to give the company permission to mine messages and files shared during meetings for the purpose of ad targeting.
Still, Zoom offers reliability, ease of use, and at least one very important security assurance: As long as you make sure everyone in a Zoom meeting connects using "computer audio" instead of calling in on a phone, the meeting is secured with end-to-end encryption, at least according to Zoom's website, its security white paper, and the user interface within the app. But despite this misleading marketing, the service actually does not support end-to-end encryption for video and audio content, at least as the term is commonly understood. Instead it offers what is usually called transport encryption. Further reading: Regarding Zoom.
Still, Zoom offers reliability, ease of use, and at least one very important security assurance: As long as you make sure everyone in a Zoom meeting connects using "computer audio" instead of calling in on a phone, the meeting is secured with end-to-end encryption, at least according to Zoom's website, its security white paper, and the user interface within the app. But despite this misleading marketing, the service actually does not support end-to-end encryption for video and audio content, at least as the term is commonly understood. Instead it offers what is usually called transport encryption. Further reading: Regarding Zoom.
The Slack (Score:1)
Their datacenter is in China. (Score:4, Interesting)
As such they are required to provide any and all information to the CCP at their request without a shadow of the due process and rule of law in the West.
If you're doing this for a local book store that usually has an in person get together like once a month (like my wife attends) it's fine. If you're going to talk about trade secrets, you're a moron.
Re: (Score:1)
Listen to waspleg! Don't be a moran!
Re: (Score:3)
Re: (Score:2)
Sounds like a real possibility, most companies (have to) do that.
Re:Their datacenter is in China. (Score:4, Insightful)
Re: (Score:1)
Re: (Score:1)
Re: (Score:3)
This is just bullshit FUD. If literally every single connection through ZOOM ran through China, then latency would be through the roof.
Global telecommunications companies have regionally distributed datacenters all over the world, this is normal. This is also often required by local law to have local data centers, so content doesn't leave the boarders of the country.
If you're in any country outside of China, odds of your traffic hitting a Chinese data center is next to zero.
The fact that post is modded +5 I
Re: (Score:2)
If you're in any country outside of China, odds of your traffic hitting a Chinese data center is next to zero.
Right.
Except... when you're in government, or are an interesting company in an industry that they're interested in snooping on, then they could easily gather all of the next-to-zero percentage of the overall traffic produced by you and others like you... and store it wherever the hell they wanted, no?
As the OP said, "If you're going to talk about trade secrets, you're a moron."
Same goes if you're a state or local government agency.
If it's an under-lockdown birthday party playdate your kid is "attending" via
Except BULLSHIT (Score:1)
Except... when you're in government, or are an interesting company in an industry that they're interested in snooping on
Zoom is not run by the Chinese government, so why would Zoom do any of that and risk arrest?
You are an Idiot. Please note that I was capitalized.
Re: (Score:2)
AWS has a pair of China regions available...
Are you going to accuse literally every single company in the world who uses any AWS infrastructure of the same?
If so, please turn in your internet card at the door, because there is basically nothing left for you to use here.
Re: (Score:2)
Except for a LOT of the folks you say may need to watch what is happening - state/fed govn't stuff, etc - suddenly had to start working from home in the past few weeks for some silly reason.
And I know Zoom sent out mails to .edu places saying "come use us free for a few months and see if you like it" as did just about every other online meeting, online course delivery, screen sharing, screen recording, etc. company out there. While I know the education dollars are tempting, I'm also fairly sure quite a few
Re: (Score:2)
Well, there was that BGP leak that routed US traffic through China that one time (that we know of).
Re: (Score:1)
It's even better! (Score:5, Funny)
It's actually end-to-end-to-end encryption! It's even better than end-to-end! There's an extra end!
I think I missed my calling as a marketing exec.
Re: (Score:2)
Re:It's even better! (Score:5, Funny)
A linguistics professor was lecturing a class. He explained that there are languages where a double negative is a positive, and where a double negative is a negative. But there are no languages where a double positive is a negative.
From the back row he hears: "Yeah, right."
Re: (Score:2)
You know, they probably encrypt twice in OFB or CTR mode for even better security!
Re: (Score:3)
Best to apply ROT-13 twice!
Re: (Score:2)
Amateur. Four times is four times as good. That's one of the reasons ROT-13 is so great: it's fast enough you can easily apply it several times.
Re: (Score:2)
You really are stuck in the dark ages! Use ROT-26 just once, and you have even better security!
Re:It's even better! (Score:5, Insightful)
I mean they don't hide it at all. They state:
Cloud Recordings are processed and stored in Zoomâ(TM)s cloud after the meeting has ended; these recordings can be password protected or available only to people in your organization.
Clearly Zoom's servers have to have access to one 'end' of the contents of a meeting if they are being recorded and stored. They also only use the term End-To-End here
End-to-End Chat Encryption allows for a secured communication where only the intended recipient can read the secured message.
So the text chats are End-to-End but the video and audio is accessible by Zoom to allow the service to do its servicey things.
Also if they are HIPAA compliant then that's good enough for my security needs.
Re: (Score:2)
It's perfectly possible for zoom to archive an encrypted recording that they cannot decrypt.
Zoom says they are HIPPA compliant... if you give them $200 a month. Like Google I guess: if you pay them, they won't sell your data. If you don't, prepare to be mined.
Re: (Score:2)
Does Grandma care? (Score:2)
People don't understand what E2E means (Score:3, Informative)
Unfortunately, this isn't terribly surprising. The problem stems from most people (including tech people) simply not understanding the difference between "encrypted" (client-to-server) and "end-to-end encrypted" (client-to-client). I've even heard people outright assume that end-to-end meant "from your end to ours", as this article claims Zoom was.
This first became painfully obvious to me when a product I used to work on first announced that it was now "end-to-end encrypted." In so many comments online, the initial reaction was simply "You mean they weren't encrypted before?". (Of course it was encrypted before. Its just that it was client-to-server before, like everyone else does.)
Re: (Score:2)
Microsoft and Apple should build end-to-end encryption into Windows, just for media. The application would have no way to know what audio or video it was playing, that would have to happen in a layer beneath the app and above a trusted/signed driver. A "good" use of DRM.
I know, I know, you can balk that Microsoft and Apple aren't trustworthy, but it wou
Re: (Score:3)
Indeed. The problem is that most people do not understand attack modelling at all. In actual end-to-end you have to attack the endpoints to get at the content and nothing else will help (provided the encryption is good).
Re: (Score:2)
I think there has been a shift in the meme "end to end encryption. For most of my professional journey in telecommunications, end-to-end stood for "endpoint to endpoint", and a multi-point conference server was definitely an "end point" as it had lots of audio and/or video processing that it needed to do in order to provide the conference service (things like transcoding from one format to another etc.). At some point people who probably were not familiar with the "endpoint to endpoint" (with the server b
Re: People don't understand what E2E means (Score:2)
WebRTC works just fine, it's supported by all major browsers, and delivers video and audio with end-to-end encryption.
So, I would expect Zoom to work like that. Except then why would Zoom even exist if they just used an open and secure protocol? Where's the money in that?
Slashdot's Alternatives? (Score:2)
Se we're aware the Zoom, Slack, Discord, * all "suck".
So what is a FOSS, self hosted alternative that offers the features of the above with the ease of use for the *Non* Slashdotter?
Mattermost? RocketChat? Jitsi? What alternatives have people actually setup and used regularly?
Re:Slashdot's Alternatives? (Score:5, Interesting)
Re: (Score:2)
Never heard of it, looks interesting, thanks.
Re: (Score:2)
Can't decide which name is more terrible Jitsi or Devuan.
Re: (Score:2)
This name originates from the Bulgarian "" (wires)
Damn other languages for existing.
Re: (Score:2)
We tries Jitsi last week with 8 people and the latency and audio feedback issues made it unuseable. The team had to go back to zoom.
This was using Synologies Jitsi service, so that may have been the issue.
Re: (Score:2)
This was after the youtube integration with Google Hangouts was retired last Fall. Zoom would not have functioned with the particular equipment we were using at the time in the fashion it was required. However, after countless audio sync issues, streaming equipment near catching fire due to the loading from all the softwa
Re: (Score:2)
I am using mumble (voice only) with my own server, but the server-side config is somewhat obscure.
Re: Slashdot's Alternatives? (Score:2)
https://www.google.com/search?... [google.com]
Re: (Score:2)
Se we're aware the Zoom, Slack, Discord, * all "suck".
You left Microsoft Teams out of that list. Apparently Apple thinks it sucks so much that they won't allow Microsoft Teams into the macOS App Store with all of the other Microsoft Office apps. You have to download a .pkg installer from teams.microsoft.com and trust that they're not back-dooring your computer with all of their telemetry crap - which, of course, they are and is why Apple won't allow it in the macOS app store in the first place.
Trust (Score:1)
Is it even possible (Score:3)
Wouldn't end to end encryption require that each user send a copy of their video stream to each participant encrypted with a different key, requiring much more bandwidth.
Re:Is it even possible (Score:4, Informative)
No, you'd just have a structure at the beginning of the stream where a copy of the session key is encrypted once, using each recipient's public key. Not big at all, especially within the context of audiovideo streaming! You're throwing around gigabytes and worried about a few extra copies of 128-to-256-bit keys?
This is the Netflix era. Whatever else you're doing in addition to AV, probably isn't within a few orders of magnitude as the size of the AV itself.
Re: (Score:2)
Yes, that would probably work.
Re: (Score:2)
Wouldn't end to end encryption require that each user send a copy of their video stream to each participant encrypted with a different key, requiring much more bandwidth.
Nope. You can do end-to-end in an 1:n fashion. After all each endpoint already has the full stream and hence no reason to attack the others. But since multicast does not really work, there is a separate stream going to each receiver anyways.
Re: (Score:2)
I don't know about Video, but you can setup multiple recipients in GPG and the magic math does the rest.
Open Source video conferencing: BigBlueButton (Score:5, Informative)
There are a couple of open source video conferencing solutions out there.
Thanks to a member of our local LUG [kwlug.org], who setup instances for us to tests, we can tell you what works and what doesn't.
First, Jitsi [wikipedia.org] was tested. It was found to be CPU intensive on the client side. Some say this is specific to Firefox only, and Chrome does not suffer from that, but it was unusable.
Then he setup BigBlueButton [wikipedia.org] on an Intel Core i7 desktop. It worked perfectly. The sound was clear, and CPU usage was reasonable on Firefox (from Xubuntu 18.04). I was also able to get Opera to work with it. Falkon did not work.
There is no need to install anything on the client, since it only needs a browser with WebRTC. That is very convenient.
One caveat: it runs on Ubuntu 16.04 LTS (not the current 18.04). And it required some hoops to go through to open ports.
Re: (Score:1)
Dude, anything is going to "work great" on a freakin' Intel i7. Only a small minority have those in their computers. I don't know if you're aware, but some companies are still selling Atom-powered laptops.
Re: (Score:3)
Read my post again: there is nothing to install on the client (meeting participants).
The Intel Core i7 is the server that runs the BigBlueButton server software.
The client is just about anything. Mine is a Core i5 laptop with just Firefox.
Re: (Score:2)
Re: (Score:3)
It used to be, but it is no longer so.
Now it uses WebRTC, and works really well.
Re: Open Source video conferencing: BigBlueButton (Score:2)
Did you generate a key? (Score:2)
Did you generate a key and then share it out of band with the people you're communicating with?
If you can't say "yes" with certainty to that question, then you have no reason to suspect that you might be going things securely. It might actually be technically "end to end encrypted" but that doesn't mean it's even slightly secure, because you have no idea how the key(s) were generated, and who has them.
Fun fact: and besides the fact that you're using shitty encryption, by using someone else's service to en
Re: (Score:2)
Did you generate a key and then share it out of band with the people you're communicating with?
If you can't say "yes" with certainty to that question, then you have no reason to suspect that you might be going things securely.
Of course you can. You can't verify the identify of the other party but you can certainly communicate with them without anyone eavesdropping.
Re: (Score:2)
You and your friend can communicate through an eavesdropping middleman without anyone else eavesdropping? Maybe, but only if your first eavesdropper had the good sense to verify you both.
Re: (Score:2)
You and your friend can communicate through an eavesdropping middleman without anyone else eavesdropping? Maybe, but only if your first eavesdropper had the good sense to verify you both.
Seems like you are repeating what I just said. Just because you can't verify identity of the peer does not mean that anyone else can listen in. So, sure, you could be talking to the wrong peer, but you'll be talking securely.
But it works (Score:3)
So far, it's the only thing that works with 10+ persons in video. All the other I have tested (webrtc, skype, hangouts, adobe connect, starleaf) do not work properly when there are more than 10 participant that stream their video.
I'll gladly accept other propositions to test, but so far, only zoom was somewhat usable.
(Needs to work with linux, win and osx with a backup telephone communication for those who are not admin of their computer)
If not E2E, then they cannot be HIPPA-compliant (Score:2)
Re: If not E2E, then they cannot be HIPPA-complian (Score:2)
My guess it that HIPAA designates compliant data processors. Zoom is like a medical supplier used to ship you your drugs. As long as both parties are HIPAA compliant, then there are simply two compliant end-to-end encrypted transactions between parties.
Telehealth? (Score:1)
Screen capture of British Govt using ZooM (Score:1)
https://i.imgur.com/1L8azlF.png
It's a feature, not a bug... (Score:2)
If you dont want those features, install Zoom's Meeting Connect on your premises and host your own meetings by your self.
Communication passes through Zoom’s cloud (Score:2)
Why would this, not-really end-to-end communication need to pass through Zoom’s cloud, in the first place?
Re: (Score:2)
I think its wrong for them to claim end-to-end encryption as a feature for their platform. But to support features like that, I think it would be rather difficult for them to avoid stages of decryption and then re-encryption just due to the nature of how they must work.
WTF? (Score:1)