> They don't offer end-to-end encryption, but it is encrypted between each client and the Zoom servers,

I think it's absurd that when talking about private messages the bar for privacy would be so low as to say that client-server encryption would be a "feature"-

> they have promised there's no way for a Zoom employee to spy on a conversation without visibly joining the meeting

That's false unless no one at zoom has logins to any of the servers that route the calls or deploy code to them. Let's be clear and specific about the terms. "no way for" and "not allowed under guidelines" have very different technical meanings.

A promise is a promise. The "no way to spy" is likely just compliance. A lot of companies have compliance guarantees in place, like SOC2, which is about processes and documentation/audit trail. So the thing blocking you from reading customer data is another person in the organization having to confirm it's a legitimate action.

Government level surveillance is not the same as an employee listening in on a whim. It's an organized endeavor, which comes with a process, so it may as well be ok from compliance point of view.

> This is incorrect. They don't offer end-to-end encryption

It's all about end-to-end encryption, so it's correct. If they decrypt it anywhere on the way then three letter agencies can always listen to what you say with a proper letter.

> and they have promised

Are you serious?

IMO that's not "incorrect" so much as it is "ambiguous about the type of encryption being referred to. Even the most spy-happy, malicious service could offer HTTPS encryption, so hearing "they do encrypt some stuff" doesn't address concerns about Zoom willfully monitoring customers

Neither does the second part about promising not to spy on a conversation; surrendering conversation metadata would be almost as bad from a privacy perspective.

Either it is E2E encrypted, or it is unencrypted on zoom servers and the only claim that they can reasonably make is that they haven't provided their employees with the tools to observe a call invisibly.

That’s not quite exhaustive. It could be encrypted the whole time, but with Zoom holding the encryption keys. Slight difference, perhaps important.

This is addressed in the Alex Stamos twitter thread.

It _is_ E2E encrypted. And from what I understand the "promise" is a technological promise, not a process promise; you can check the exact terms of the promise in the paper.

The paper’s ideas are not yet implemented. Right now, it’s encrypted to whatever keys Zoom likes, including the PRC’s. Same system as Apple’s or Google’s

OK, but if we were to take this stance it than literally the whole thread is pointless debate, right? It started with this:

> Zoom CEO Eric Yuan said in early June that the company has chosen not to encrypt free calls in order to cooperate with law enforcement.

The entire debate is about the not-yet-implemented E2E encryption (that's where Zoom "does not encrypt free calls"). And the Alex Stamos thread explains very well both why that is a sensible choice, and how they will implement E2E encryption& what are the limitations.

If we're discussing about current implementation, it doesn't make sense to be outraged that "Zoom doesn't offer encryption for free calls" - if we talk about E2E encryption, it doesn't offer it for anyone; and if we talk just about HTTPS, it offers it to everyone. So in fact we must've been discussing the future implementation not the current one - right?

Encrypted = private to most people. There’s no reason to muddy the waters with the fact that Zoom encrypts some data temporarily at some time with keys that they control, because that isn’t what anyone cares about.

So that statement is correct, you just confirmed it yourself.