News for hackers. Stuff that matters.
Re:Zoom says it won’t encrypt free calls so it can work more... by jrochkind1 on Wednesday June 03, 2020 @12:40PM (#23405434)
You think it's just cover for it being a hard technical problem for zoom?

But... what the fuck?

Also... I have a paid account. How can I tell if my connection is encrypted or not? Is it only if all other parties have paid accounts? Is there an indicator?

Under an "encrypt some calls" approach, if even paid users can't tell easily and reliably if they have an encrypted connection... basically nobody can count on it.

Re:Zoom says it won’t encrypt free calls so it can work more... by bonestamp2 on Wednesday June 03, 2020 @01:08PM (#23405817)
I don't think it's a hard problem, they're already doing it for paid calls. It's probably more work to do it for some calls but not others. From what I understand, zoom has the encryption keys anyway, and they decrypt and encrypt on their server during routing, which can have some benefits. But, that means it's more processor intensive (costly) to use encryption. So, I think they're not encrypting free calls just because it's an added expense (which really adds up at scale).

Working with law enforcement might be true, but it doesn't make sense that it has anything to do with free calls. Again, they have the encryption keys so they could decrypt any calls that they want to work with law enforcement on. This might even be a really poor attempt at upselling to paid accounts.

If you're concerned about security, I don't think zoom is the conference tool of choice -- maybe they've fixed everything I mentioned, but they still have among the worst track records.

Security aside, the feature set and user experience is attractive. Except for one thing, why does it take two clicks to end a call? That's awkward every time. If people are accidentally leaving calls, that's a different problem and two clicks is a lazy solution.

Re:Zoom says it won’t encrypt free calls so it can work more... by zys5945 on Wednesday June 03, 2020 @12:49PM (#23405546)
I don't think zoom provides e2e encryption. iirc zoom decrypts all messages at their server before encrypting it again and forwarding it to the destination.
Re:Zoom says it won’t encrypt free calls so it can work more... by jrochkind1 on Wednesday June 03, 2020 @04:08PM (#23408042)
Huh, right.. so this makes it all even more confusing.

Are they saying that WHEN they implement true e2e encryption, it will only be for paid accounts?

Or are they saying the encryption they've already got, which they are inaccurately calling "e2e" when it is not, was formerly enabled for free accounts, but no longer will be?

Or something else?

(Who would have thunk that lying and calling something "e2e" that wasn't would end up confusing!)

I also still don't understand if you get the encryption (whichever one they are disabling for free accounts) if the 'host' is a paid account but some/all of guests are not...

Re:Zoom says it won’t encrypt free calls so it can work more... by Technetium on Wednesday June 03, 2020 @12:57PM (#23405667)
Exactly this. End to end encryption does NOT mean "Encrypted on each end but not in the middle".
Re:Zoom says it won’t encrypt free calls so it can work more... by softawre on Wednesday June 03, 2020 @01:48PM (#23406362)
On the desktop app there's a green icon at the top left that says encrypted when you hover it. Not sure about mobile.