Re:Zoom has a signed binary that runs any unsigned script
by lukeschlather on Wednesday April 01, 2020 @11:52AM
(#22749983)
There are a lot of people blowing things out of proportion who don't know what they're talking about. However these things are newsworthy and probably worth Zoom fixing. (I think to a certain extent if I say something like "It's dumb that Zoom doesn't have real e2e encryption and they should fix it." That sounds harsh and I mean it. That said I'm still going to use Zoom unless something with equivalent UX and e2e encryption comes along.
(Someday there will be a solid cross-platform native p2p video client with e2e encryption.)
Re:Zoom has a signed binary that runs any unsigned script
by ptlu on Wednesday April 01, 2020 @12:47PM
(#22750732)
FaceTime? It probably doesn't work at conference scale but it is E2E.
> We designed iMessage and FaceTime to use end-to-end encryption, so there’s no way for Apple to decrypt the content of your conversations when they are in transit between devices.
Re:Zoom has a signed binary that runs any unsigned script
by thu2111 on Wednesday April 01, 2020 @01:23PM
(#22751202)
But that's a total lie, isn't it? They can just send your iPhone a public key owned by Apple. Or they can put a backdoor in the app and get you to install an upgrade.
Re:Zoom has a signed binary that runs any unsigned script
by mulmen on Wednesday April 01, 2020 @01:56PM
(#22751593)
FaceTime isn’t cross platform.
Re:Zoom has a signed binary that runs any unsigned script
by thu2111 on Wednesday April 01, 2020 @01:23PM
(#22751195)
E2E is snake oil at the moment. Nobody has developed a reasonable UX to let people exchange keys, and closed source clients that can be centrally updated render any such encryption pointless. It could be disabled at a moment's notice and you'd never know. I don't blame Zoom for not investing in it.
Consider that any Mac app that:
* Supports plugins that aren't signed by Apple
* Executes scripts or macros from a file
would technically have the same "problem". That's a heck of a lot of apps.
On iOS Apple do insist on a full chain of security, which is why only Apple's own browser app can JIT code. It's an extremely perverse and serious limitation that has no real security justification: consider that Android manages just fine without it.
As far as I can tell, Zoom is currently the target of a witchhunt. People are digging for dirt and blowing stuff well out of proportion.