They need clearer warnings this will happen, or a design which clearly separates the two info-streams, of differing sensitivity, into separate download steps & filenames.
In a lot of businesses this really is not an issue. Many businesses don't want a lot of bob mockery in private chat. Webinars people want these questions to go over with a supervisor (common question analysis etc). Hosts can set appropriate controls (public chat only / host only etc).
I hope zoom continues to cater to people trying to get work done - which they seem to be, and not this hyper paranoid, totally misleading title crowd.
The solution on hacker news seems to always be to add lots of new steps, warnings, device authentications, encryption keys, block the host from doing this or that etc. I'm already tired to the endless cookie acceptance popups on the public web.
> In a lot of businesses this really is not an issue.
I don't think anyone cares about the business in this situation. Individual privacy and freedoms are more important than shareholder value and micromanager snooping. When you force everyone to engage with their coworkers online, you need to find a way to preserve basic human rights -- like two individuals having a private conversation. Tech that obfuscates that, or exposes the contents of private conversations, should be called out for doing so.
Yes, we want business discussions to be open. But at the same time you have to remember that it's humans that conduct the business (as little as VCs may like that, because they're so hard to control and pacify), and that those humans have human needs and emotions, and will have private conversations wherever conversations can be had.
It is conferencing -> generally public / group meetings.
The permissions are VERY loose by default - anyone can join your personal meeting room if you don't put a password based on a simple set of digits after a URL. People can join with NO account, no login. My own experience trying to do a lot more lockdown - people don't like it, they WANT this free and open approach.
If you want private conversations - lots of apps out there support that. But many apps targeting business have a corporate / compliance / discovery API option. For example, slack is very popular, and admins can get corporate export turned on or discovery API which allows exports of your PRIVATE direct messaging conversations by the company. So if you think zoom letting a user see their OWN messages is bad, slack (often a popular programmer system) let's admins get everything you ever typed.
The one I hate the most are the SSL middleware boxes and decrypt everything.
Somewhat ironic for someone taking so much care to maintain an anonymous 'thoraway' account to give so little weight to other users' desire for robust privacy, that doesn't collapse via confusing docs/interfaces & transient accidents.
If you think privacy is enhanced by all these cookie warnings (when YOU can control / clear etc your cookies) you are probably mistaken.
If Zoom goes to full E2E encrypted chat (this means on-boarding is FAR more complicated than clicking a totally simple URL with some digits) they will likely loose a lot of their market. If they go to E2E encrypted chat and block users from downloading their own chat, even more market share lost.
But the issue here is not your nonsensical digression into cookie warnings. It is: Zoom's docs & UI are confusing ordinary, mass users into inadvertently revealing private chats. Zoom should fix that.
I believe a simple baseline fix would be: offer 2 downloads, one clearly marked/named as "shared transcript - what all participants saw", another clearly marked/named as "personal transcript - what you saw".
Edit: In case it is removed this was the original headline "Zoom private chat text between attendees is actually public"
From the zoom docs.
"If you save the chat locally to your computer, it will save any chats that you can see-- those sent directly to you and those sent to everyone in the meeting or webinar.
If you save the chat to the cloud, it will only save chats that were sent to everyone and messages sent while you were cloud recording."
This is TOTALLY different than all private chat text is public. 100% false. Private chat text is available to the folks who were participants in the private chat. That would be a much more accurate headline.
Now if the recipient of a chat first downloads it to their computer (zoom auto-scrubs if you upload to cloud) and THEN uploads it to the cloud - then whoever has access to it can see it. But this takes a number of steps. Download your chat and then publish your chat publicly. The headline is completely wrong.