back to article Remember when Zoom was rumbled for lousy crypto? Six months later it says end-to-end is ready

The world’s plague-time video meeting tool of choice, Zoom, says it’s figured out how to do end-to-end encryption sufficiently well to offer users a tech preview. News of the trial comes after April 2020 awkwardness that followed the revelation that Zoom was fibbing about its service using end-to-end encryption. As we …

  1. ComputerSays_noAbsolutelyNo Silver badge

    The best software features ...

    are those you manage your users to gaslight into believing that they are there.

    "End-to-end encryption?" "Yeah, definitely!" followed by nearly in-audible small-print caveat.

  2. Dan 55 Silver badge

    This is end to end encryption

    Except when it's not.

    I'm sure it will be held up as an example of how to crack the problem by the usual organsations.

    1. Charlie Clark Silver badge

      Re: This is end to end encryption

      It might be worth noting that Signal has finally released it's zero-knowledge, manageable group functionality. Doesn't include video chat, but it's still a milestone for a peer-reviewed important feature. The related blog posts go into the relevant technical detail.

      And Telegram has started trailing group video chats. Telegram doesn't promise E2EE in group functions but so far it's done a pretty good job of thwarting mass surveillance of its communications as use in Belorussia shows: that the communications are visible is less of a problem than that they can't be suppressed.

  3. Robert Grant

    This is theatre

    The commonly accepted definition of end-to-end encryption requires even the host of a service to be unable to access the content of a communication

    Commonly accepted perhaps, but anyone with a brain will know that if non-logged-in users can be added to a call then there must be key distribution going on, and therefore the provider can still tap in.

    1. Roland6 Silver badge

      Re: This is theatre

      Key distribution is an Achilles heel of security.

      My expectation is that much depends on how the key is distributed: If the Zoom client includes it in the invite email sent from your email client and thus doesn't actually pass through the Zoom server hub then it is as secure as most commonly used security mechanisms.

      Be interested to know how tools such as Teamviewer manage this aspect of security (ie. avoiding the possibility of being able to eavesdrop on remote desktop connections) in their product.

      1. Eclectic Man Silver badge

        Re: This is theatre

        Maybe key distribution be done using Diffie-Helman key agreement protocol.

  4. Mike 137 Silver badge

    Food for thought?

    Nobody seems to have noticed that Privacy Shield has been formally invalidated, so any discussion from the EU of personal information over Zoom could now be in breach of the GDPR unless it can be conclusively demonstrated that Zoom in the US cannot access the information. Hence the importance of real end to end encryption that actually works.

    1. DS999 Silver badge

      Re: Food for thought?

      Does the GDPR require that it be 'proven' that it can't be accessed? I thought it just specified penalties for accessing/retaining information.

      Because if your interpretation is correct then every web site in the world is in violation despite the click through, because they are obviously CAPABLE of collecting your personal information (like IP address, which can be geolocated to where you are with varying degrees of accuracy) and there is obviously nothing that can be done to make a web site incapable of seeing your IP address.

  5. Pascal Monett Silver badge

    Good on the method, but bad implementation

    The encryption should be automatic and transparent. There is no reason to require user opt-in in this case, nor is there any reason not to activate it all the time automatically.

    But at least this is progress.

    1. fuzzie

      Re: Good on the method, but bad implementation

      Not to go to bat for them, but I suspect this is more a case of gently onboarding the early adopters and ensuring everything actually works and scales. As opposed to the more big bang approach of just changing the defaults... which more of than not, results in a Big Bang and operational nightmare.

    2. John Robson Silver badge

      Re: Good on the method, but bad implementation

      This is called testing...

      I imagine they will make it default, but you don't roll out that kind of a change without testing, and companies seem to think that AGILE means "let the users test for you".

      1. Jimmy2Cows Silver badge

        Re: AGILE means "let the users test for you"

        I agree most companies have a shitty understanding of what "Agile" really is, and use it as an excuse to cut QA and therefore costs, but, for things like this, at some point you can't test at sufficent real-world scale, other than releasing an opt-in tech preview and seeing if/where it breaks.

        Even that doesn't scale up to the true load, but it's likely more than can be achieved with in-house testing.

        1. Claptrap314 Silver badge

          Re: AGILE means "let the users test for you"

          That really depends on how competent you in-house testing is.

          Still, it makes sense to make something like this opt-in in version x.y.z if the intent is to make it default in x.y+1. It's important not to break everyone, and if you implicitly admit that you might have made a mistake by making it easy to avoid a bug, that's generally a good thing. What I don't see here is a statement that this is going to become default.

        2. John Robson Silver badge

          Re: AGILE means "let the users test for you"

          "at some point you can't test at sufficent real-world scale"

          Absolutely agree... I just doubt that many places go through the steps in advance of this - why bother, your users will willingly do it for you, and if it is optional they can still work by turning it off...

    3. A random security guy

      Re: Good on the method, but bad implementation

      Video transcoding of encrypted streams for optimal bandwidth/quality may be an issue.

  6. A random security guy

    Curious: End to end Video transcoding/scaling with crypto

    Extremely curious: One of the issues we used to face in secure broadcast video streaming (1->N) with DRM was bandwidth/latency optimization given that the viewer could be asking for a high-resolution or low resolution video based on the screen size or the viewing device. A mobile device could receive encrypted video from a server by just fetching from a URL (using Apple's HLS as an example) with the right bitrate. The video server would have the movie already encoded and encrypted with different bitrates ready to go.

    When it comes to N x N senders/receivers, the bandwidth requirements can be pretty high especially if participants can arbitrarily switch between full frame and small frames for any of the other participants.

    The server can't do transcoding of any video stream astray are opaque. The server can't relay the entire N number of full video streams to the participants. This can get to be an issue with 300 participants. So they may be downgrading the video quality or they may be using a smart mix of signaling and uploading a reduced resolution and full resolution video ...

    WhatsApp does CLAIM to do end-to-end video encryption. I did video conferencing with 3 people and it SAID that it was end to end encrypted.

    We will know more as the details are disclosed.

  7. A random security guy

    Nothing prevents Zoom from becoming one of the 'clients'

    For performance and quality purposes, obviously.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like