E2E will be an opt in choice for paying users who are willing to sacrifice some features for the benefits from additional security.
See this thread for more details: https://twitter.com/alexstamos/status/1268061790954385408
Edit to credit vjeux for the thread link
If you want to look at something now, the white paper for the E2E protocol design is public and open right now: https://github.com/zoom/zoom-e2e-whitepaper
On a more serious note, until there is a protocol and implementation available then we can't say anything for sure. Us Security folks aren't magicians.
If these tools use open standards and well documented protocols this will not be a problem.
I can verify without a phd in cryptoanalyis and reverse engineering my browser is running a secure connection to a website and certificate is signed by the source(for sites enabled with FS and HSTS ).
The short versiom of it is, your browser trusts CAs to say whether a certificate is valid. But CAs often trust other CAs who may not actually be that trustworthy. Those CAs then trust other CAs who definitely are not as trustworthy... Etc.
So that certificate/padlock picture in your browser may not be as trustworthy as you think. It's an active problem.
Yes I was a bit harsh. But I was trying to demonstrate a point - no one knows for sure until we can look at this stuff in detail. Until the researchers get to pull it apart then no one can verify anything. The little green tick on a zoom call is practically worthless until some external work is done.
The protocol is documented and open. I linked to it in my comment.
Google supported jabber in chat for a long time , slack supported IRC (both dropped the support ) but when they did you could any irc client in slack or use google chat using jabber with any client
If an open protocols for video are used like email (although not good example for encryption). It does not matter who your service provider is you can verify they are secure , or move to another one .
Today I have more than 10 video conferencing apps on my devices (zoom, Hangouts, meet, Webex , teams, GoToMeeting , chime , Skype, SfB, FaceTime , signal, telegram , ring central and Uber conference... ) because a customer , partner friend or family uses one of those . I have only one email and browser client though, it does not have to open source at all, ppl happily pay for closed source gmail or o365 without worrying will my mails deliver to you while still using official client or client of their choice
Also, have you thought about asking your clients/whatever to use one app to communicate with you? Even if you get half of them onboard, it sounds like it would save you a lot of mental bother.
Many of them cannot install any new native application on their desktop / phone without IT approvals or their vpn does not allow traffic to consumer apps like Hangouts . They also need to record for compliance , pre-Covid some apps like Webex are connected to their conference room bridges using dedicated lines and hardware etc
Family / friends do not use use biz tools , it not easier to convince Apple users who like FaceTime, messenger is popular in few countries , wechat in China , WhatsApp in other places .
It is easier install another app rather than trying to get your grandma to switch from one thing someone installed on her phone and she learnt to use.
It is degrees of trust . Trust is not absolute , neither is security . Depending on your threat models you have to secure yourself. More transparency improves security does not solve all the problems just makes it costlier for an attacker . If cost outweighs the benefit they will not attempt to do it.
Https does not magically make your communication 100% secure ,however the number of people who can issue a certificate from a comprised root CA or control one is considerably less than the number of people who can monitor your plain text traffic .
Any sufficiently advanced cryptography is indistinguishable from magic.
Which isn’t entirely untrue from a layperson’s perspective.
Edit: fixed a word. I’d accidentally written “is” rather than “isn’t”.
That's sort of what happened with the ECB mode stuff that kicked this whole thing off in the first palace. See section 4 from the below for more info.
https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto...
I think I read that Zoom do decrypt AES-GCM server side already. They have to so they can put the little green box around the person currently speaking. EDIT - this is incorrect for AES-GCM, it's not decrypted server side.
Edit - at least e2e is the angle I'm approaching it from as it's the new information.
> Meetings will still be encrypted and meeting content is still not going to be used for tracking users.
And the person responding to you asked "how will you show this?".
Could also be interpreted as how can we show only paid users can access it? Or that certain features will be disabled with E2E?
What I replied with covers both E2E and the current state equally tbh (the linked article did it before with ECB). There are always limitations to what is possible.
I could break into the Zoom servers to make sure everything is kosher. But that's illegal.
If WhatsApp started transmitting E2E keys back to their servers people would find that out client side through network packet inspection, not server side.
Security researchers are limited in the tools/methods they can use. We have to work with what we've got at our disposal.
Which is exactly why "trust us, we're not going to do anything with these keys" is a ridiculous state of affairs and shouldn't be tolerated. We can't show that they're actually doing what they say, and it'll be years after they implement mass surveillance on the behest of law enforcement before someone leaks something.
Should we work towards an ideal? Sure. Should we stress out that things aren't perfect? Probably not.
It's an iteresting technical idea though. Would be interesting to see if any existing systems have a "canary" element to them.
Why is this not a client thing?
Edit: Civility
> Matthew Green, a cryptographer and computer science professor at Johns Hopkins University, points out that group video conferencing is difficult to encrypt end to end. That’s because the service provider needs to detect who is talking to act like a switchboard, which allows it to only send a high-resolution videostream from the person who is talking at the moment, or who a user selects to the rest of the group, and to send low-resolution videostreams of other participants. This type of optimization is much easier if the service provider can see everything because it’s unencrypted.
https://theintercept.com/2020/03/31/zoom-meeting-encryption/
This was 2 months ago so their new white paper clarifies the current situation:
> For use cases such as meeting real-time content (video, voice, and content share), where data is transmitted over User Datagram Protocol (UDP), we use AES-256 GCM mode to encrypt these compressed data streams. Additionally, for video, voice, and content share encrypted with AES, once it’s encrypted, it remains encrypted as it passes through Zoom’s meeting servers until it reaches another Zoom Client or a Zoom Connector, which helps translate the data to another protocol.
(I realize codec is not the correct term.)