> the code is developed 100% in mainland China

I am under the same impression and have some circumstantial evidence supporting it as someone who's been inspecting the code of the Zoom client (just for fun): their Windows client uses a 3rd party library that is used virtually only in China whose documentation is available only in Mandarin.

On a tangential note, I got surprised to see no traces of attempts to make inspection harder on their client software. Even function names remain intact in some cases, which I assume would not happen if they had a malicious intent like embedding a backdoor.

> We need to promote our own opensource and free tools to our friends and family, we will get the last laugh.

Although I agree that there should be viable alternatives to available tools for online communication without the possibility of being eavesdropped, I can see why such things do not exist. It'd be too inconvenient for the law enforcement. And if you take things from the perspective of whether that thing makes the job of the law enforcement harder, you'd notice such things tend not to exist. As a principle, popular software should not have a means to prevent data going through the software from getting inspected by the law enforcement. Does Dropbox offer end-to-end encryption? Of course not. Is there a popular easy-to-use disk encryption software? There was TrueCrypt, which is gone for an obvious reason. Does Gmail implement end-to-end encryption for emails? Of course not...

> Even function names remain intact in some cases, which I assume would not happen if they had a malicious intent like embedding a backdoor.

For what it's worth, this is a bad assumption.

Someone hiding bad behavior from a reverse engineer wants it to be in friendlyMisnamedFunction, not in lkjwer23_aic. If you remove all the English semantics from the binary, a reverser is free to focus on the behavior; if you don't, you can lure them into a false sense of security.

Are any reverse engineers that stupid?

I'm under this impression because the UI is full of grammatical errors that aren't the types that native English speakers make. I would be surprised if there's anyone in the US working on the Windows app.

Is there evidence that WhatsApp is MITMable?

I assumed it's not because it claims to be E2E, when I checked the fingerprint of a contract it looked good and reports are that the taliban uses it for internal comms

https://www.nytimes.com/2019/10/26/world/asia/afghanistan-wh...

No there is no evidence that the encryption keys have been modified. If the fingerprints match, then messages are not being intercepted and cannot be with today's technology. However, the code is closed, perhaps it is only displaying a similar thumbprint, and hiding the real thumbprint from the user. As far as I know, the code to whatsapp is closed.

It's certainly closed source, but their E2E protocol is laid out in their white paper.

You can determine if a given version of the app is conforming to the protocol or not at some point in time.

After a short search I was able to find this attempt: https://www.delaat.net/rp/2018-2019/p25/report.pdf

Which was inconclusive.

The IPs are announced by oracle: https://bgp.he.net/ip/193.122.212.125

Reverse DNS for the IP is handled by oracle cloud.

Yea oracle trying desperately to stay relevant has severely undercut everyone else on bandwidth costs. It'll be silly for video apps not to use them. Though the effect on oracle long term will be interesting.

TBF, bandwidth costs on AWS and Azure are so ludicrously high that it wouldn't be difficult to undercut them on bandwidth.

That said, I wouldn't touch an Oracle product with a very long bargepole, even if bandwidth was free.

I see now, thanks for helping me pinpoint this.

Yet, your original comments will be read and cut out of context.

For precise communication, consider edit your original post.

> the code is developed 100% in mainland China.

Did the Keybase team move to China?

Has the Keybase team written any code for the Zoom client?