U.S. FTC indicates it is looking at Zoom privacy woes | Hacker News Reader

U.S. FTC indicates it is looking at Zoom privacy woes

reuters.com

80 pointspseudolus26 comments

If you still have to use Zoom, at least uninstall the desktop Zoom and take advantage of some private browsing instead:

"With this change, you can now join Zoom calls on Firefox without the need for any additional downloads." https://www.mozilla.org/en-US/firefox/76.0/releasenotes/

"Zoom Redirector transparently redirects any meeting links to use Zoom's browser based web client." https://addons.mozilla.org/en-US/firefox/addon/zoom-redirect...

This write up from the University of Toronto's Citizen Lab is the best that I have seen regarding Zoom's issues https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto...

It would be nice to see an update, because Zoom has rolled out a lot of changes that were a direct response to many criticisms.

It's still under the CCP's purview and they still aren't using E2EE. Therefore you should only use this product if you're fine with shipping your company's IP to China for them to copy, given their systematic efforts to infringe on the IP of Western companies via top-down efforts.

It turns out that Zoom actually does encrypt "end point to end point" as they have stated. The initial Signal article was in error and the Reuters article is being misleading by omission by failing to mention that.

I think an encryption privacy consumer protection law would force a company to say how much work they would have to do to get access to the E2EEed data. As it is now, the expression "end to end encryption" is practically meaningless. The Zoom case is an excellent example.

All of the noise about Zoom sounds like a witch-hunt.

But hopefully, Zoom can improve their security and privacy features, to make their product even better.

I think people forget just how terrible video conferencing was, before Zoom came around, and got installed in corporate meeting rooms worldwide.

Let me remind you again: It was terrible!

Zoom actually brought a breath of fresh air to the landscape. The video was relatively snappy, and the audio was usually always spot on.

It made you feel almost as if you were living in Star Trek land, with ubiquitous video calls everywhere.

And all the hubbub about Facebook, Google, and Microsoft offering free videoconferencing on their chat tools, just means that this wasn’t their core competency. They had other things to work on. Bigger fish to fry. Whereas Zoom, just focused on one thing, and one thing only, videoconferencing.

Is a shiny polished product worth risking your companies valuable IP, given Zoom has lied about using end-to-end encryption and has routed American communications through China in the past?

This is straight out of the CCP's playbook, and Zoom is far from being outside of the CCP's influence.

The CEO is an American citizen.

He is probably more loyal and patriotic to the country than you are. And I’m sure he creates and provides more jobs to Americans than you do.

If you have evidence that he is doing something illegal, then present it. Otherwise, you are just fear mongering.

And realize that coordinating with a foreign government is a criminal offense. I highly doubt he is interested in such activity.

Just so that he can snoop on your scrum meeting or fake agile process? That’s just nonsense.

Zuck and Brin and Bezos and Gates, has more details about your personal life than you can imagine. And none of that data is encrypted. It’s all just sitting there on their servers just waiting to be harvested. When was the last time you complained about these companies?

But hey, it’s a free country. If you don’t want to use it, then don’t use it. No one is forcing you. You can even demand a boycott if your own company uses the product.

And to be honest, I don’t even use it outside of business. Treat it as a public medium, where all communications may be monitored. I’m more concerned about my employer monitoring me, than I am about some foreign boogeyman on the other side of the planet, listening to my boring scrum meetings.

Why do we need the FTC involved in this?

It's (one of) their job(s) to investigate consumer complaints. Doesn't mean anything will come of it.

about time. I actively avoid Zoom and whenever any of my non-tech friends suggest "zooming" I just send them a google meet link.

And that is better?

It doesn't require installing any software, which is biggest source of issues with Zoom. It also makes realistic claims about its security: https://support.google.com/a/answer/7582940?hl=en

You don’t have to install any software to use Zoom.

To be fair, Zoom does their best to conceal this. On MacOS at least, you have to download their installer twice, ignoring it each time, before it lets you connect using the web client.

Awful dark patterns like this should be illegal.

I wish I knew that before I installed it. Does the MacOS uninstall actually remove all traces of Zoom at this point?

Last time I used it, I had to log in to be able to join in my browser, and then couldn't see more then one feed at a time.

Kind of limiting, especially compared to jitsi for example.

Last time I had a Zoom meeting these were the steps to a browser join link:

1. Go to zoom.com 2. Click "Join a meeting" 3. Enter meeting id and click Join 4. Ignore the automatic app download 5. Go back 6. Click "Join a meeting" again 7. Enter meeting id and click Join again 8. Ignore the app download again 9. Click at "If nothing prompts, click here" 10. Click "Join from your browser" 11. Agree to terms of service 12. Enter password and name, click Join

Needless to say, I prefer Jitsi or even Google Meet.

Who is watching you chat with your friends?

Industrial espionage is far more likely to be a target, and I wouldn't be surprised if alternative platforms are just as compromised.

100% safe alternative: Install Zoom on your Windows Sandbox

https://techcommunity.microsoft.com/t5/windows-kernel-intern...

That does not solve the issues that Zoom has/had with encryption nor with leaking info. In addition there have been all kinds of sandbox escapes in the past. Finally I would not trust some random non-free program by Microsoft none the less to be secure, especially not against state attackers.

Windows Sandbox is only available on Windows 10 Pro and Enterprise, which precludes this solution from use for a lot of users.

If you think a sandbox is safe try putting one in your living room.

So it'll still steal your intellectual property and ship it to China but at least they can't run exploits?

I don't get it. The video communications IS the valuable information, and they've already shown they'll route American communicates straight to China and lie about E2EE to advance their goals.

You could always just send them a link to a meeting on https://meet.jit.si -- Jitsi Meet is open-source, and doesn't require a Google Account. It's also pretty high-quality, which is nice. And if you want to be extra security-conscious, you can just run your own instance.

Reply on news.ycombinator.com