Zoom could be a victim of the internet mob justice, where every inevitable misstep is blown out of proportion. Perhaps the mob is helped along by some competing interests. Or Zoom could be yet another tech company with dubious ethics (like U: or F). I doubt they are outright a PLA branch, that would be far too obvious.
This isn't just idle musings - I love how Zoom allows me to share screen/whiteboard, and see people's faces at the same time. It works really well for remote dev collaboration, in some ways better than physical presence. And yet the question of safety remains.
Should I go and research WebEx?
I think Zoom is on track to fix these problems quickly and cement their spot as the best solution for videoconferencing.
Technically speaking, zoom has shown off great and remarkably stable/scalable features.
But that is orthogonal to whether they are putting people at risk (e.g. not-so-secret therapy sessions) or lying about their feature set (clearly claiming to have end to end encryption).
There were 2 RCE that would have allowed anybody to easily take over any computer using zoom. The first one last year was wormable, triggered by simply visiting a website with no interaction (like a javascript ad).
Other video conference tools don't have these because they didn't try to provide the same features or work around the OS.
Except for Skype, that still has one samba relay attack left like zoom, that went mostly unnoticed. From my research they had the exact same issue but blocked the RCE part in 2018 CVE-2018-8311 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8311
Yeah, I think datamining to steal and sell your LinkedIn account counts as dubious ethics. Or claiming to have E2E but actually they don't.
There is a good share of incompetence as well, like the CSP issues.
https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto...
As I read it they accidentally routed some data to China based servers for a month (Feb 2020) due to a config mess up during their crazy fast scaling period. This is since fixed.
Needless to say, I have decided not to endorse their videoconferencing solution.
It'd be hard to get a useful amount of trade secrets or know-how. You'll see partial schematics and design docs, but without much context. At the executive level, you could at least scale the analysis to have actual people monitoring the calls. You could get broad strategy (e.g. launch a mid-range 5G phone in 2021 Q1) and enough financial information to make some well-informed trades.
Amusing that many of the changes lowered accessibility significantly (e.g. my grandmother wasn't able to join the meeting anymore after passwords became default). I still don't get it. Skype was way worse in my opinion and nobody ever cared about it.
But I agree, the way it was handled was harrowing.
My college (~2200 students + a couple hundred faculty/staff) pays $18k/yr for Zoom Enterprise. Good value, I'd say.
It's another primary reason why so many "enterprise" companies purchase Redhat over running CentOS.
there's mob mentality right now, but zoom got a TON of customers, and now is gonna have proof of end-to-end encryption in a couple of months.
boom.
zoom wins.
honestly just don't talk on zoom about something highly secretive such as ... idk... something a government is interested in as that isn't currently secure, other than that, don't sweat it.
This is a valid tradeoff for most things, but the real problem here is that Zoom claimed (and continues to claim) "end-to-end encryption", while not providing it. That is a lie, and people naturally wonder what else you are lying about.
Doesn't sound as easy now.
Has anyone else had this happen to them?
Luckily, the software we are required use works pretty well on iOS, Android, OSX and Windows.
[1]: https://www.businessinsider.com/new-york-city-schools-bannin...
There are valid criticism to be discussed about China's actions and how much Zoom should be trusted given its close relation.
There's been many criticism of the US government here and I never see anything flagged or removed, I would consider that nationalistic and provocative under the same guidelines. I just don't see why the China discussions are removed.
https://news.ycombinator.com/newsguidelines.html
If you're worried about this kind of thing, follow the site guidelines and email hn@ycombinator.com so we can look into it. (We always do.) In this case, though, the simplest explanation seems adequate: the community is divided. When there's a popular divisive topic, people who feel strongly for side A always feel like the amount of support for opposing side B is 'eerie', because it's hard to imagine how it could possibly be in good faith. Of course B feels the same way about A.
Edit: oh dear. It seems like you've been using HN mostly for nationalistic battle lately. We ban accounts that do that, so please stop. It's emphatically not what this site is for, regardless of which nations are at issue.
In any case, anyone at the 'C' level almost by definition knows little or nothing about actual computer security.
> Students under the age of 18 should not go to www.zoom.us to create an account because (i) they should only be joining Zoom meeting sessions as participants (not separate account holders) through the School Subscriber’s account and (ii) minors are not permitted to create an account per Zoom’s Terms of Service. The School Subscriber’s account administrator (e.g., teachers) should securely and confidentially provide meeting information and meeting passwords to the student users to ensure the school can maintain supervision and control over its student users’ meeting experiences. If students have already signed up for individual accounts, Zoom can assist schools in fixing this.
The school should contact their account rep about this. I bet they can fix it quickly.
Yes, and that's why comments about it should be thoughtful and substantive—not drive-by flamebait leading to useless flamewars about NATO and Winnie the Pooh.
> There's been many criticism of the US government here and I never see anything flagged or removed
That happens often. If you never see it, that's because of a cognitive bias: we notice and weight more strongly—that is, we see—what we dislike. https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que.... People on the opposite side of this question have exactly the opposite complaint.
(For that matter, there is certainly a lot of data that would be useful a year later. Some data could be valuable even many years later. Taking SpaceX as an example, it should be obvious that old data could be valuable.)
There's lots and lots of insecure software that Bloomberg doesn't write about. People click on articles about software they use.
I agree that increased scrutiny does not make the problem ok, but does reveal the problems more quickly.
But the only reason those points matter in the "Should I use Zoom?" question is if you're assuming all other products have the same flaws and just haven't been looked at. To which, I'm pretty confident they don't all share these problems, particularly but not limited to the "blatantly lied about the basic security features".
I am not confident of this.
I would assume that anything that isn't actively being sold into the large enterprise market has Zoom-level problems, or worse.
If I were a writer/editor working under this policy, making a big stink about a teleconferencing company enjoying huge growth in the current covid 19 climate would be a no brainer.
Especially when work from home is now at the center of our conversation, and journalistic outlets shift their attention to newly-popular services like Zoom and Houseparty.
Regarding your last example, I'm also continually confused at the claim that Zoom has been lying about end-to-end encryption. I don't see any place where they ever claimed to encrypt anything end-to-end except for chats, and only after enabling the feature:
https://support.zoom.us/hc/en-us/articles/207599823-End-To-E...
https://support.zoom.us/hc/en-us/articles/201362723-Encrypti...
When I'm in a Zoom meeting, it says that my connection is encrypted (the green E lock thing). It does not say "end-to-end." So I always assumed that just meant that the transport layer is encrypted.