Hacker News Reader

Comment by roenxi | Hacker News Reader

Pretty scandalous stuff. But to be fair it seems pretty likely that any or all of the major players (Apple, Google, MS, Facebook, AWS, etc) to be maintaining some sort of back-door access to the channels they control for spying purposes.

I suppose the risk with Zoom is leaks due to incompetence rather than leaks due to government intervention.

View on HN

Apple claims that FaceTime is end-to-end encrypted (and makes some pretty strong statements about not having access to the content of communications). Facebook similarly claims that WhatsApp is end-to-end encrypted. Whilst I have little love for either company, do you have any evidence that these claims are lies?

I thought the lesson is clear.

All e2e claims with closed source software must be dismissed by default. The burden of proof is on the seller.

I mean, I agree with you, and I guess the "surely Apple is not blatantly lying about being unable to read the content of your communication" argument has eroded a bit after Zoom's behaviour. But the penalties (both in terms of reputation and in terms of monetary fines) for this kind of misbehaviour are already large, and are likely to increase over time, and it seems an unnecessarily extreme risk for these companies to take.

But yes, impossible-to-verify claims are not worth very much at all.

I don't... did you even read TFA? All the order says is that they can't lie about it again. They don't have to pay anything, they don't have to actually fulfill their prior claims, and the other parts of the agreement they likely already comply with, and if not it'll be quite cheap (relatively) to do so.

> I don't... did you even read TFA?

Yes, I did. Thanks for asking.

> They don't have to pay anything

Yes, but they endured reputational damage, and companies hypothetically lying about it now could reasonably expect to have to pay something in future enforcements, which is what I was trying to get at in my previous comment. Reading it now, it was really sloppily worded by lumping together those things, but I'll leave it as it was so that the rest of this thread makes sense.

> they don't have to actually fulfill their prior claims

Given that they don't claim it any more, I'm not sure that they could be forced to start doing it -- put another way, not having E2E encryption is not a crime as long as you don't claim to have it.

How much actual reputational damage could they have possibly endured? I haven't noticed any fewer people using Zoom.

It's a consent order. They're willingly agreeing to it in order to avoid other costs (like fines and a lengthy trial). There's no "forced to" involved.

> I haven't noticed any fewer people using Zoom.

I think this probably varies a lot between social groups; I know of many people (including non-technical) who were motivated to explore alternatives after reading news articles about Zoom's behaviour. A bunch of non-technical friends subsequently started to use meet.jit.si for meeting up, playing board games, etc, for example.

Zoom's revenue is in corporate accounts, just like Slack - my 10k ppl company uses branded enterprise accounts on both systems, we even have VOIP via them with DIDs. Companies of size do not pivot quickly on telecom and messaging system changes, it takes a lot more than a single issue or two for our money to not be in their pockets.

As for fines, companies already do sophisticated risk analysis so that the average outcome would be far more than the average potential cost. I know oil companies do highly sophisticated risk and reward calculations with violations.

As for 3reputational damage, that’s a long term effect. A few events won’t have a lasting impact. If it turns out that Apple Key Chain is not e2e, or worse iOS exfiltrates key material from apps, that would be major news, but soon people will forget (if they ever cared in the first place) and keep buying iPhones unless the misbehavior is a recurrent problem. A company like Apple will make it extremely difficult to discover such misconduct.

What penalties? The NSA boasted (internally) about how much they were spying on Skype, and I'm not aware of Microsoft having been penalized in any way for lying about it, probably even the opposite?

Skype's been in decline for a long time, so it's hard to say if any of that decline is attributable to loss of trust.

We're talking about legal penalties here.

No, we're talking about legal and reputation penalties.

I wrote:

> the penalties (both in terms of reputation and in terms of monetary fines) for this kind of misbehaviour

You wrote:

> What penalties?

Oops, my bad, HN isn't really good at this, not showing parent comments in the list of our comments...

Whatsup is "end to end encrypted", but I had seen an article here on HN about how Whatsup would snatch your data before it begun transit, if needed - for "security reasons" - after performing a local analysis on the messages. I don't know if this has been implemented as of yet, but you can see the intent for circumventing actual encryption - they can do it, and since e2e has become a bother, they certainly will.

With WhatsApp it's even simpler; they just constantly nag you to "back up" your chats to the cloud.

I've got https://news.ycombinator.com/item?id=25058783 . There is substantial evidence that the American spying agencies are willing to use anything with a reputation for neutrality as a vehicle for spying.

"Apple has a market incentive not to lie!" is an argument I find compelling, but the NSA has a bigger incentive to make Apple lie, and more power than Apple. If Apple & friends were ever offering a truly secure communication channel it is unlikely that was/will be allowed to continue.

Incompetence? That Zoom team has been working on video communication for many many years over in China.

And several years before that at Cisco.

https://www.acquired.fm/episodes/the-zoom-ipo-with-santi-sub...

Reply on news.ycombinator.com