Hacker News Reader

Correct me if I'm wrong, but calling this E2E encryption is a marketing stunt. If I model Zoom as a malicious entity (or them being compromised by a third party), confidentiality is still compromised. This is different to what we normally understand under E2E, where I only have to trust the people I communicate with.

View on HN

Very true. If Zoom handles the encryption and decryption on their servers, rather than fully on the client's machine, then they can still "listen in". The only way I would trust their E2E is if they can't see or hear what's happening too. It's wild to me that companies I've worked for that have insane privacy and on-prem server requirements, will use Zoom no questions asked.

This is covered in the whitepaper: https://github.com/zoom/zoom-e2e-whitepaper

Reply on news.ycombinator.com