Don't forget about the time a Zoom software engineer conspired with China's intelligence service to identify and harass dissidents residing in the US. The engineer is currently wanted by the FBI: https://www.justice.gov/opa/pr/china-based-executive-us-tele...

Exactly.

For all my harsh criticism of both Microsoft and Google I wish them well: I want them to tidy up and become trustworthy.

Because the alternative where China becomes world leading is actually worse.

For all their warts Americans and American companies have done much good and gotten way more criticism for their faults compared to others.

That doesn't however mean that they should get off the hook easily, only that we should work to put them in an position were we can actually trust each other.

I don't see how you got from my post to that conclusion. Did I forget a word or write something extremely unclear?

No, you didn't. pokepim either misread, jumped to conclusions, or just saw a chance to grind an axe that they were just itching to grind.

I remember when they stories came out they were released in a suspiciously coordinated way. Once one died off another was released to build up momentum again and keep the idea humming in the public consciousness.

I figured that it was done by a big party that had a trusted relationship with tech journalists because they bigged up vulnerabilities that were relatively minor to journalists who didnt seem to be aware of it.

It's possible it wasnt Microsoft but the pattern of stories indicated Zoom was a public relations target of someone who freaked out after seeing how fast they were growing and MS certainly took full advantage.

The pattern of stories indicated that it was a thing that got attention, so people went digging for whatever they could find and push. You don't need a conspiracy for something to get way more attention than others.

I am not trying to say Microsoft did anything unlawful. However, I am suspicious that these events in 2020 were coordinated.

I remember we knew about Zoom vulnerabilities in 2018 as well but I rarely used video conferencing and definitely not for "daily stand ups" however, I wouldn't discount Microsoft tried its best to "educate" reporters.

http://paulgraham.com/submarine.html

Megacorps feeding stories to journalists is not a “conspiracy theory.” It isn’t even a secret!

Would they drip-feed what they found though? Sounds like you need some form of coordination for that at least.

The "drip-feed" of people finding things not all at the same time, and basing their search on previous findings?

No conspiracy required, just change "party" to "parties" and "someone" to plural "people".

Zoom went from interesting tool to de facto worldwide standard in about two months. I'm pretty sure that in the offices of Microsoft, webex, goto meeting etc there was a collective WTF from leadership and people were instructed to find weaknesses. It doesn't follow that there was collusion or an evil conspiracy.

I was thinking of posting the "end-to-end encryption that wasn't" but it was already mentioned in the article.

Security flaws in a product are part of the life cycle, unavoidable and might be accepted as long as proper and timely response is taken. That's due diligence. But lying about security? That's not even negligence.

"Zoom had and continues to have a significant developer presence in China."

So whats worse: a backdoor for China, or a giant hole for anyone interested?

I guess the latter gives us esual opportunity...

A link preview vulnerability in Teams vs a backdoor for China. I choose the vulnerability!

At work we were briefed in detail by spy from CSIS to avoid Zoom. I trust the Canadian spy before a trust I company with CCP ties.

The only thing I can add from that briefing is avoid Zoom, Huawei and product from Facebook, use Telegram if you can and Teams or Google current messaging solution if you can't.

Why Telegram specifically? Wouldn't Signal be considered a more private/secure messenger?

As a daily user of Signal, it still has a long way to go before it can be considered a user-friendly cross-platform solution.

> use Telegram

also from CSIS briefing?

I guess I misremebered it migth have been signal or matrix ... I am sure about the informal recommendation of things to avoid but I'm not so sure anymore about the informally recommanded list of things to use ...

One of them can be fixed with a software update.

A vulnerability tends to get fixed quickly. A government backdoor not so much.

And vulnerabilities occur in all mainstream software.

> when they routed American calls through the mainland

what about zoom-calls in other countries?

Don't forget the directory traversal vulnerability too!

What’s remarkable, to me, is how publicized these issues in Zoom became vs other software. Google also seems to have pointed their vulnerability researchers at it. I remember thinking at the time they were getting a lot more scrutiny than most software in that realm, which has the same types of issues. Maybe it just entered the public Zeitgeist and it’s all a coincidence, but as a long time infosec consultant that does vulnerability research I found it curious at least.

My take on it at the time was that while technically more knowledgable people were all happily having video calls in-browser for free, less tech savvy people were, by the millions, excitedly installing a pretty ropey app with root privileges and a whole bunch of vulnerabilities. It felt like a very necessary step when the normies thought they were entering the matrix.