This is good enough reason to not use it.

Also I stopped using zoom and trying to avoiding it as much as possible after the very first vulnerability scandal[0] came about

[0] https://medium.com/bugbountywriteup/zoom-zero-day-4-million-...

The NYC Department of Education (DOE), one of the largest in the nation, banned Zoom in April but "following several weeks of collaboration with the company, [NYC DOE is] now able to offer Zoom as a safe, secure platform for use across the DOE" as per a letter Chancellor Carranza wrote on May 6th, 2020.[1]

Public school teachers tried other video conferencing solutions but, for better or for worse, Zoom's UX was always easier to use or less janky than other paid or opensource offerings at scale -- and that's saying something because Zoom's UX isn't what any of us might call super smooth.

[1] https://connectdocs.blackboard.com/xythoswfs/webui/_xy-13091...

I used Zoom exactly once. I was invited, I installed the software and Chrome extension as a regular user. I had a mediocre experience in the meeting but didn't pay too much attention, and then proceeded to uninstall the software when I got a prompt that I need to do it as admin.

For me this was a clear warning signal that they want the software to be there especially in companies (that didn't block it) where many users may end up installing it but then aren't able to remove and just forget about it.

Then I started reading about their installer "mishap", their general encryption scheme weakness "mishap", their encryption key routing through China (!!!) "mishap", the redefining of E2EE "mishap", the default settings "mishap", and the mishaps just piled on to the point where I personally believe only a great deal of ignorance or blissfulness could allow a company to still use it.

I get schools and individuals do, it's "free", meaning they don't pay with money and they don't need to look any further than that. But I refuse to ever use it again and when I got Zoom invitations I politely declined, offered to host the meeting myself, or else just asked to be sent the meeting notes on mail. I have no reason to believe Zoom intends to fix their issues but rather to hide them better next time.

However, without some sort of reversal, this is enough for me to deal with the mess of doing that.

Does anyone have other suggestions? Either for other services or for troubleshooting Jitsi?

Whereby is, as far as I can tell, completely owned by a Norwegian registered company.

1: https://whereby.com

You can turn on "mobile mode" in advanced device settings, and it should be a bit better. But we're a bit limited in how CPU-friendly we really can be, living in the browser. Not that we can't improve, there's certainly extra tricks we could try - but not easily without also lowering fps and resolution.

I don't think "low resource use" is a big selling-argument for our product. Video can be quite heavy.

Just some feedback. I think the free tier was a little unclear.

> Free

> Personal use

> 1 user

> 1 meeting room

I have trouble reading this. It's as if I coule only create one room for myself without having anybody to chat with.

A p2p room can have 4 total people in it. So say you plus 3 concurrent guests, none of those guests need any account or "user".

Indeed even you don't have to log in after you've created the room if you leave it unlocked. :)

This "more than 4 room" is not p2p and end-to-end encrypted, since the server (SFU) needs to read and change some headers. So it is a tradeoff. There's now "insertable streams" which allow you to do encryption on the media client side, but it's a test for now: https://webrtchacks.com/true-end-to-end-encryption-with-webr...

However, I should mention that it's not possible to join calls through the mobile app (as far as I can tell), and the web app on mobile wouldn't capture my Bluetooth headset's audio properly somehow.

Again, thanks for the great work. Just thought I'd let you know :)

I was working on fixing up that when COVID-19 hit. Now we're trying to stamp out more obscure audio+video bugs (like bluetooth, which can be unreliable). We're in process of hiring a few more people so we can hopefully put someone on caring more for the non-logged in mobile app experience.

You do get a join button once you've logged in. But I must confess it is not a good experience by default. It used to be on the top of the priority list, but then scaling and any video/audio issues jumped to the top.

There is currently a bug with audio, where it'll crash in Safari, -- and we have had some issues reconnects that was more our fault (though Firefox and Chrome is much more forgiving). We have a workaround for the first, and will be doing a fix for the second once we're reasonably sure it won't regress other browsers.

Is it any of those issues you talk about? Or is it something else? (I'm not personally familiar with the Safari issues, btw, since I'm a Linux user, but I keep an eye on Firefox and Chromium-based browsers)

I will play with it today and send bug report. Might help you guys out, I really like it otherwise

Are there settings you adjusted?

Are you just doing one-on-one meetings (that works fine for me too) or group calls of 3+ (which is what I need to do everyday where it immediately becomes unusable)?

I'm also using a linux distro based off ubuntu/debian.

I am using Jitsi in//on the browser [for me, Firefox].

I don't know if I have a preference as I have only "just started using" the past few months via being given a link I click on whilst I am on my laptop... so unfortunately I cannot speak about Jitsi via Desktop Version at this time.

> Are there settings you adjusted?

Besides simple sound volume off of my OS//headphones, I use whatever the default settings are.

> 1-1 meetings or 3+ group calls?

Group calls, each time would be roughly 5-12 people.

For other info just for giggles:

The laptop I do this on is connected wirelessly to my home wireless network, about 6 feet away from my wireless router; my wireless router may have multiple people using it at a given time since I share. I'm in US-California-Silicon_Valley on Comcast.

Full disclosure: I am doing an internship at Amazon, but my experience predates me working there.

We have also used GoToMeeting with a good amount of success. Anything but Teams, haha.

My D&D group switched from Zoom to Skype and the performance/quality is noticeably better. There's 5 of us and it's great. Free, no time limits, etc.

I have to say the video quality is much better and the DM being able to screen share while we can still see each other is great. Also the "Brady Bunch" view is great, being able to see everyone at once is awesome.

I'm not very happy with all of the news trickling out about Zoom but I really do like their product.

That's my position, too. I teach at a large public university in Japan, where the school year begins in April. At the beginning of March, we were expecting to start classes in person as normal a month later. By around March 20, we had decided to teach most of our classes online; a week later, "most" had become "all." Teachers and students had little to no prior experience with online education, and their level of general digital literacy varied widely. From the plethora of tools available, we had to choose software that everyone could use and that would be reliable and scalable.

Despite concerns about security issues, Zoom was chosen as our videoconferencing platform. That seems to have turned out to be a good choice, as it is stable, can handle large groups, and offers features (breakout rooms, video and audio recording, attendance reports, etc.) that are useful for university classes. That fact that it hasn't (yet) been blocked in China was also a factor in choosing it, as we have students stuck overseas who need to take part in classes. Anecdotal reports from colleagues who teach at other universities in Japan suggest that the non-Zoom platforms have not performed as well.

Now that teachers and students are used to online classes, I hope we can also try other tools in the future. But considering how well Zoom performed during our hectic ramp-up to online teaching, I give it my grudging support for the time being.

[1] https://peercalls.com/ [2] https://tedpiotrowski.svbtle.com/moonlite

Does only Chrome work? Seems to defeat the point of FOSS...

It may be resolved now: the bugzilla entry mentions a patch: https://bugzilla.mozilla.org/show_bug.cgi?id=1606823

Until then, Jitsi is "good enough", even if it's still pretty rough in certain parts.

https://bigbluebutton.org/

Uhh that's a strong stand for something you don't know...especially the 'never' part of it.

Have you tried Jitsi?

It's really great as a face-to-face solution though, where Zoom and many others are actually kind of overkill.

I would love to know about any Zoom competitors, free or paid, with comparable quality.

W.r.t. the general meme about WebRTC, this is old (2018) and explicitly does not claim to be anything other than suggestive: https://jitsi.org/blog/a-simple-congestion-test-for-zoom/

That's the fix I needed, cheers! For some reason it doesn't impact the Google Meet quality for me but now Jitsi looks great.

BigBlueButton is also interesting, but it's more like a Schooling-tool...but also without a client (aka just need a browser)

There's Jitsi Meet, Jitsi Desktop, there's a browser extension, a server-which-isn't-just-a-server etc. It's a bit confusing.

Just to answer this—technically yes, but they use dark patterns to dissuade people from learning about it.

One could say the same of Zoom...

There's Zoom Meetings Client, Zoom Rooms, a desktop app, mobile app, Outlook Plug-in, Browser extension, etc.

Do you love the company, its leadership, its product, or its pricing?

you didn't ask me, but imo they haven't existed long enough to garnish love for their company and leadership.

They had a product and a price point at a time with huge & abnormal sudden demand. I think this alone was enough to make them successful in the short term.

But that's an integral part of the product. There is a lot of reason for suspicion floating around the company and the product itself, and the long string of security screwups and misdirection confirms every bit of that.

What's the point of having even good functionality if it comes attached to such concerns? Most products have a good side but choosing one is always about picking what's the worst problem that you can live with rather than the best feature.

Subtle yet severe privacy invasions do not matter to the glaring majority of people because they cannot associate it with direct consequences.

If I have been using Zoom and the Chinese government now has 200 hours of my facial and speech data, at first it doesn't impact me. I don't see the impact, I don't feel it aside from some people yelling on HN.

The consequences are either subtle and easily dismissed (e.g. ad tech/marketing when Instagram secretly listens to the phone mic and suddenly you see products that were part of the conversation) or severe and too far out to relate it to a Zoom call 23 months ago (e.g. border control when entering China for tourism).

If you're not an activist then chances are you do not care about online privacy.

We are constantly bombarded with new concerns and this particular topic requires expert opinion to truly know which software you can trust. Then there is the problem of choosing which expert to trust. And you still have to have time left simply to live your life. It's just not an easy thing to let yourself be concerned with this.

In my personal experience, I've yet to meet a person that turned out not to care once I've taken the time to discuss this with them one on one.

Besides that, why defend a company or a corporation in the first place? It's a damn shame that people are more enervated by corporate strife than by the suffering of our fellow beings.

Which is a shame given issues like the OP and all of the security/privacy problems they have had recently.

And before you say "but Zoom is free", obviously it's not. From the carefully orchestrated lie about "end to end encryption", to the routing of calls through China, and to the topic of this article. At every step they catered to companies more willing to look just at the price and never ask a single question.

Having said that, the US government installed a linux kernel module (approved by Marissa Mayer) that sniffs traffic on Yahoo Mail servers, so don't send anything you don't want recorded.

The thing that Zoom really has going for it is that it's free and heavily marketed. This made it popular with a lot of people. But it's exactly the people who are least prepared to make an informed decision (and yes, I count a lot on "company men" here). The reasons are sprinkled all over every Zoom article.

You're willing to hand-waive all of the many, many proven, and intentionally hidden major issues with Zoom but you suddenly become worried that Skype works as advertised, poorly as that may be? Would you apply the same principle to your food and taking the one that lies on the label about dangerous ingredients? Or do principles change with accounts?

I had so much fun pointing the camera towards the open door and zooming in so far that we could all lip-read a conversation happening across the office. Or, due to a lack of forethought, creating the official CrotchCam(tm) by letting the camera auto-focus and then zooming in to the unfortunate victim's midriff.

The first time I read that Zoom is the shell (in the USA) while the majority of work is being done in China, I thought the exact same thing. That China has everyone's face 3D scanned by now (multiple photos from multiple angles), everyone's voiceprint, everyone's IP, transcripts of what was said and by who...

Now they are trying to rebuild their shattered rep, while still handing anything and everything to their patrons.

Always assume your calls on the public internet are being surveilled by all parties, no matter which service you're using.

But beside that... if they were surveilling them... why would they close them? Why would you shut down your intelligence source?

Because your hardware may be compromised.

Because their software may be compromised.

Because their hardware may be compromised.

Because the cryptographic algorithm you're using may be compromised.

Because your 'trusted party' may be compromised.

Because there may be a camera in your room.

Because there may be a camera in their room.

Lots of threat vectors, lots of reasons to assume surveillance.

Those are certainly possible ways in which the surveillance could still be happening, because nothing is certain. But the argument is necessarily probabilistic (in the Bayesian sense) and not binary. So yes, I have to take this into account to determine my final risk, but there is no point in necessarily assuming I am being surveilled because then I might never do anything at all.

When you place faith in a dictator, like the CCP, this is always the result:

https://en.wikipedia.org/wiki/Useful_idiot

It makes perfect sense to boycott Zoom based on their security issues, but does the presumption of innocence mean nothing anymore? It shouldn't be difficult to prove that Zoom is actively trying to block Chinese activists.

China banned Zoom during the trade war. Are you going to treat that as evidence that Zoom isn't colluding with the CCP? Why is Zoom not embracing end-to-end encryption to free users evidence that they are beholden to China, but Zoom committing to end-to-end encryption for paid users not evidence of the contrary? This type of circumstantial cherry picking is how conspiracy theories sprout.

I can’t think of any major platforms that got banned and reinstated with zero changes. I’m treating that as evidence that they are colluding.

https://technode.com/2020/05/15/zoom-suspends-chinese-indivi...

In a court of law, yes. In the court of public opinion, it has never been that way.

I don't blame people for being suspicious of Zoom. Why wait until the harm has already been done to move to something else?

Zoom knows it has a credibility problem. If Zoom really cared, it would do something to distance itself from China and the Chinese government. But it doesn't.

Edit: I checked. They've got you fooled.

Just recently YouTube "accidentally" deleted the account of a pro-democracy channel in Hong Kong with more than 600k subscribers [1]. Incidentally, this has never happened to pro-Chinese channels.

[1] (only sources in Chinese are available) - https://inews.hket.com/article/2664703/%E3%80%90YouTube%E5%B...

I get the vibe with anything China related. Like it takes an over abundance of facts not to be attacked. Zoom fiasco is interesting though. I don’t do anything I don’t mind be monitored on there so sort of careless for now

Why does this event move the needle one way or another? The group had a paid account so Zoom knows who they are, and this was a publicized event. All the Chinese government needed to know was an event they don't like was happening, with the services of a company they can exercise soft power over.

But is that any better than being 100 % sure that the US gov is doing it?

I mean, what is the point of "the Chinese may be listening this is horrible!" when we know for a fact that the US are listening and most probably multiple european countries.

Nowadays, you must assume that whatever you do online is recorded by multiple states and may be used against you one day.

Also, I see that I'm being downvoted and I would be really interested to know why I'm wrong. I mean it, I love the level of discussion here and I really like constructive criticsm.

Would it be technically feasible to record everything?

The burden of proof lies on you to prove they are.

Oh and nice job implying that Chinese dissidents have the duty of "proving" to the world that the Chinese government surveils them. Snowden is not a dissident, he is a whistleblower. Also, in general, telling people who suffer that they ought to educate the rest of us about the particular details of their suffering is not cool.

Chinese dissidents didn't make the claim that the Chinese government is surveilling Zoom, you are. They're not your rhetorical shield.

> I only said that it is safer to assume surveillance.

This thread was started by:

> Is there any reason not to assume that the Chinese government is surveilling Zoom calls en masse?

You seem to be taking all of this very personally for some reason.

That's handy because you're the one who brought them up only to imply that they aren't as worthy of our sympathy as Snowden.

This thread was started by...

...someone with the good sense to ignore your verbal incontinence. Eventually I'll learn the lesson; downvote and move on.

There's a difference between bringing up the fact that somebody exists and putting words in their mouths to help your point.

> ...someone with the good sense to ignore your verbal incontinence. Eventually I'll learn the lesson; downvote and move on.

You're getting unreasonably mad right now. Please calm down.

> its product development has been based in China, and that some Zoom calls were accidentally routed through Chinese servers.

Curious, did you background check every employee/contractor to make sure they are Chinese race free?

Did you do every byte of your network traffic audit to make sure they are not Chinese IP routable? How often do you update your firewall rules?

Because if you don't do either of these, if you run a successful company, someone will write an article to complain you have employed a Chinese developer and routed traffic to China.

Likewise, there’s a big difference between employing a Chinese national in the US and having a large part of you engineering organization operate from within China.

Shockingly, Microsoft, Google, Facebook, IBM, Redhat, Cisco all have engineering team in mainland China. Do a job list search please.

> decrypting that packet on a server located in China

In your infrastructure setup, for hostnames in a cluster, how do you separate China servers and non-China servers? Do you put a subdomain or something? And how do you link user's nationality to which server they are supposed to connect to?

What if there's a US hosted meeting, a mainland Chinese user joins the meeting? Is it an ethical thing to happen?

Should the packet decrypting happen in a US server? China server? or server located in a third neutral country instead?

What if a US citizen joins a mainland Chinese hosted meeting? Is it wrong for Zoom to decrypt packets in China?

Yes, these are exactly the sorts of things one does. The PRC is so distinct in terms of legal norms that servers hosted there need to be treated differently. If PRC would adhere to the legal norms of most of the rest of the world, and stop trying to start a cold war with the U.S, this would not be necessary.

> And how do you link user's nationality to which server they are supposed to connect to?

It's not so much about nationality, but about jurisdiction. For calls where no participants' connections originate from a PRC IP block, don't use the PRC infrastructure. For calls where at least one connection originates from the PRC, terminate the call wherever meets the legal requirements (that PRC participant may have special obligations to their government) and is technically convenient. It's not really that hard.

> What if a US citizen joins a mainland Chinese hosted meeting? Is it wrong for Zoom to decrypt packets in China?

Again, it is not a matter of citizenship, but of jurisdiction. If the call is hosted in PRC, that's not even a question; if PLA asks, you must decrypt the packets on the host, or at least provide keys.

In each case, you bring up nationality or citizenship, but when it comes to these scenarios, these are not relevant. Chinese nationals legally present in U.S. jurisdiction have most of the same rights as U.S. citizens, and all of the same legal obligations. In terms of obligations, the same is true in PRC: if you are present in PRC, you are obligated to follow the PRC's law, whether or not you are a national.

> but about jurisdiction. For calls where no participants' connections originate from a PRC IP block, don't use the PRC infrastructure.

That's basically where the Chinese got the idea of building the Great Firewall started. Some IP addresses are from evil capitalist USA and need to be filtered.

That's immoral, illegal, and silly; effectively nobody is doing this, and if most people found out about that, they would try to put a stop to it. The PRC is a state, that state does not have a monopoly on representing any race.

This is not a Chinese people problem, it's a CCP problem. Chinese people in the ROC don't do this sort of thing. 這不是華人的問題，這是中共的問題啊。中華民國的華人不這樣做。

> Do you audit every every byte of your network traffic to make sure it is not Chinese IP routable? How often do you update your firewall rules?

Yes, I operate servers and routers that simply do not route to or from PRC IP blocks. It's often the right thing to do, given that “reputable” server operators like Baidu seem to be the source of a huge proportion of the impersonation and spam, and often zero legitimate connections. When I get DMARC reports, more than half of the reports are PRC IPs impersonating my mail host, hopefully for reflection rather than full-on impersonation.

effectively every US media is name calling companies/universities who have a slightest business with China or Chinese people.

Business with PRC and business with Chinese people are separate matters. I don't know of any North American university that doesn't have "the slightest business" with Chinese people; and "effectively every U.S. media" is not "name calling" them all.

What I have seen, is a select few journalists reporting on the proven PRC-funded academic espionage schemes, where the PRC is illegally bribing academics to privately provide advance copies of U.S. government funded research. The coverage of this has been sparse, and there are whole major outlets who simply have not mentioned it.

This is incorrect. They don't offer end-to-end encryption, but it is encrypted between each client and the Zoom servers, and they have promised there's no way for a Zoom employee to spy on a conversation without visibly joining the meeting. https://twitter.com/alexstamos/status/1268061790954385408

I think it's absurd that when talking about private messages the bar for privacy would be so low as to say that client-server encryption would be a "feature"-

> they have promised there's no way for a Zoom employee to spy on a conversation without visibly joining the meeting

That's false unless no one at zoom has logins to any of the servers that route the calls or deploy code to them. Let's be clear and specific about the terms. "no way for" and "not allowed under guidelines" have very different technical meanings.

Government level surveillance is not the same as an employee listening in on a whim. It's an organized endeavor, which comes with a process, so it may as well be ok from compliance point of view.

It's all about end-to-end encryption, so it's correct. If they decrypt it anywhere on the way then three letter agencies can always listen to what you say with a proper letter.

> and they have promised

Are you serious?

Neither does the second part about promising not to spy on a conversation; surrendering conversation metadata would be almost as bad from a privacy perspective.

It _is_ E2E encrypted. And from what I understand the "promise" is a technological promise, not a process promise; you can check the exact terms of the promise in the paper.

> Zoom CEO Eric Yuan said in early June that the company has chosen not to encrypt free calls in order to cooperate with law enforcement.

The entire debate is about the not-yet-implemented E2E encryption (that's where Zoom "does not encrypt free calls"). And the Alex Stamos thread explains very well both why that is a sensible choice, and how they will implement E2E encryption& what are the limitations.

If we're discussing about current implementation, it doesn't make sense to be outraged that "Zoom doesn't offer encryption for free calls" - if we talk about E2E encryption, it doesn't offer it for anyone; and if we talk just about HTTPS, it offers it to everyone. So in fact we must've been discussing the future implementation not the current one - right?