The cognitive dissonance here is amazing. How do you claim you are offering E2E as an upgrade on a product you have already claimed is E2E?
Sounds like they got a sudden spike in interest, realized that their customers were angry, admitted the error, bought keybase, and provided what their customers asked them for.
There's an ashtonishing lack of ethics in our industry. A marketing error here, a software bug there [1], a misleading opt-out here [2], a preinstalled malware there [3][4][5], a little violation of privacy of here [6][7], a little lack of respect there [8][9]... It's all happening all at once. We shouldn't be lapping it up.
[1] https://news.ycombinator.com/item?id=24514433
[2] https://news.ycombinator.com/item?id=22531087
[3] https://news.ycombinator.com/item?id=9072424
[4] https://news.ycombinator.com/item?id=17145204
[5] https://news.ycombinator.com/item?id=3298205
[6] https://news.ycombinator.com/item?id=19031055
[7] https://news.ycombinator.com/item?id=23929044
"Always make sure your malicious act can be adequately explained by stupidity if you get caught"
I don't actually care whether the board at Symantec were deliberately turning a blind eye to forbidden practices and then get caught or they were too incompetent to exercise effective oversight and had no idea there was a problem, we can't trust them in either case.
So, no. This perfectly above-board version is not what happened.
I missed that one, thanks for the heads up (found sources @ [1]). Between that and Keybase going into cryptcurrency, that means I uninstalled Keybase and quit using it.
E2E in the sense that security nerds bang their chests about isn't what customers want. Boards of directors of public companies, some attorneys, and some others need it. Almost nobody else does. It means that you don't have cloud recording, can't use POTS phones to connect to the meetings, etc. People with those needs have security controls beyond the software, so they probably need something like Webex, or should be using directly connected room systems. Someone who needs E2E for real reasons aren't doing it from home, for example, as you need to take other measures to protect that meeting content.
That's like saying only car mechanics care about kind of oil that goes into your car. Yeah I mean nerds care because nerds know the difference. This is not something where nerds caring about e2e is at odds with what everyone benefits from. Better security benefits everyone without taking away from the experience.
There's absolutely _nothing_ preventing recording while having end-to-end encryption. It just means the recording happens at one of the ends and can be uploaded. Hell, you could even go as far as storing the encrypted streams, and then decrypt on the device during playback. The keybase people especially have experience with messages that are encrypted so that only a handful of recipients can decrypt it.
The POTS line, I'm less sure about. But I'm still a little iffy about it, since everything is VoIP now. But that may not matter.
If you look at 100 Webex customers, who have access to a high quality E2E capability, you’ll find 3-5 (outside the military) who have ever used it.
You cannot do service-side POTS integration unless you integrate with an on premises PBX and restrict external calls.
I’ve been on teams designing high security collaboration environments. E2E is a need for specific use cases only — the user endpoint is usually a bigger risk. Nobody with that need is considering Zoom!
The others are rolling it out.
Zoom is being used for schools with kids younger than my 7 year old. And probably telehealth too. These should all be e2e encrypted.
Enterprises should be demanding e2e. Especially given the Chinese governments aggressive corporate espionage, I’m shocked that more companies aren’t nervous about having potentially sensitive meetings on Zoom. I know one of my clients expressly forbids their employees from joining Zoom meetings.