Zoom is a work-from-home privacy disaster waiting to happen

guest · Aug 30, 2020

Slack fixes 'critical' vulnerability that left desktop app users open to attack
August 30, 2020
https://mashable.com/article/slack-fixes-critical-remote-code-execution-vulnerabilitybug-bounty/?

Slack and its scores of desktop app users just dodged a major bullet.

The communications tool relied upon by journalists, tech workers, and D&D fans alike disclosed on Friday a "critical" vulnerability — now fixed — that would have let hackers run wild on users' computers. Slack's internal security team didn't even find the bug; rather, it was a third-party security researched who reported it, through the bug bounty platform HackerOne in January.
Notably, the exploit allowed for something known as "remote code execution," which is just as bad as it sounds.

Before Slack fixed it, an attacker using the exploit could have done some pretty wild stuff, such as gaining "access to private files, private keys, passwords, secrets, internal network access etc.," and "access to private conversations, files etc. within Slack."
Click to expand...

What's more, according to the disclosure, maliciously inclined hackers could have made their attack "wormable." In other words, if one person in your team got infected, their account would automatically re-share that dangerous payload to all their colleagues.
For the security researcher, whose HackerOne handle is oskars, this resulted in a bug bounty payment of $1,750.
Click to expand...

guest · Sep 11, 2020

Zoom adds two-factor authentication (2FA) support to all accounts
September 10, 2020
https://www.bleepingcomputer.com/ne...r-authentication-2fa-support-to-all-accounts/

Zoom has announced that starting today it has added two-factor authentication (2FA) support to all user accounts to make it simpler to secure them against security breaches and identity theft.

With 2FA, Zoom users will have an extra layer added to the authentication process, blocking attackers from take control of their account by guessing their password or using compromised credentials.

"With Zoom’s 2FA, users have the option to use authentication apps that support Time-Based One-Time Password (TOTP) protocol (such as Google Authenticator, Microsoft Authenticator, and FreeOTP), or have Zoom send a code via SMS or phone call, as the second factor of the account authentication process," Zoom explained in an announcement published today.
Click to expand...

guest · Oct 14, 2020

Zoom to start first phase of E2E encryption rollout next week
October 14, 2020
https://techcrunch.com/2020/10/14/zoom-to-start-first-phase-of-e2e-encryption-rollout-next-week/

Zoom will begin rolling out end-to-end encryption to users of its videoconferencing platform from next week, it said today.

The platform, whose fortunes have been supercharged by the pandemic-driven boom in remote working and socializing this year, has been working on rebooting its battered reputation in the areas of security and privacy since April — after it was called out on misleading marketing claims of having E2E encryption (when it did not). E2E is now finally on its way though.

“Zoom users — free and paid — around the world can host up to 200 participants in an E2EE meeting on Zoom, providing increased privacy and security for your Zoom sessions.”
Click to expand...

Zoom acquired Keybase in May, saying then that it was aiming to develop “the most broadly used enterprise end-to-end encryption offering”.
However, initially, CEO Eric Yuan said this level of encryption would be reserved for fee-paying users only. But after facing a storm of criticism the company enacted a swift U-turn — saying in June that all users would be provided with the highest level of security, regardless of whether they are paying to use its service or not.
Click to expand...

The AES 256-bit GCM encryption that’s being used is the same as Zoom currently uses but here combined with public key cryptography — which means the keys are generated locally, by the meeting host, before being distributed to participants, rather than Zoom’s cloud performing the key generating role.

“Zoom’s servers become oblivious relays and never see the encryption keys required to decrypt the meeting contents,” it explains of the E2EE implementation.
Click to expand...

Zoom: Zoom Rolling Out End-to-End Encryption Offering

Do free Zoom users have access to end-to-end encryption?
Yes. Free and paid Zoom accounts joining from Zoom’s desktop client or mobile app, or from a Zoom Room, can host or join an E2EE meeting.
How do I verify that my meeting is using end-to-end-encryption?
Participants can look for a green shield logo in the upper left corner of their meeting screen with a padlock in the middle to indicate their meeting is using E2EE. It looks similar to our GCM encryption symbol, but the checkmark is replaced with a lock. [...]
Click to expand...

guest · Oct 27, 2020

Zoom’s end-to-end encryption has arrived
Available now for Mac, PC, iOS, and Android
October 27, 2020
https://www.theverge.com/2020/10/27...tion-e2ee-security-privacy-video-conferencing

Zoom’s end-to-end encryption (E2EE) has arrived, letting both free and paid users secure their meetings so that only participants, not Zoom or anyone else, can access their content. Zoom says E2EE is supported across its Mac, PC, iOS, and Android apps, as well as Zoom Rooms, but not its web client or third-party clients that use the Zoom SDK.

Zoom has previously offered encryption for its calls, but the data was only encrypted between each meeting participant and Zoom’s servers, rather than being end-to-end encrypted between participants.
Although E2EE meetings are more secure, they don’t work with a few of Zoom’s features. These include its cloud recording, live transcription, polling, meeting reactions, and join before host features.
Click to expand...

End-to-end encryption is available for both free and paid users, but Zoom says free accounts will need to verify their phone number using SMS and also need a valid billing option associated with their account.

This initial launch is just the first of four phases Zoom is planning for its end-to-end encryption offering. The next phase, which is scheduled to include better identity management and support for single sign-on, is currently planned to launch next year.
Click to expand...

guest · Nov 9, 2020

mood said: ↑

U.S. FTC indicates it is looking at Zoom privacy woes
May 11, 2020
https://www.reuters.com/article/us-...is-looking-at-zoom-privacy-woes-idUSKBN22N2MJ
Click to expand...

FTC Requires Zoom to Enhance its Security Practices as Part of Settlement
November 9, 2020
https://www.ftc.gov/news-events/pre...nhance-its-security-practices-part-settlement

The Federal Trade Commission today announced a settlement with Zoom Video Communications, Inc. that will require the company to implement a robust information security program to settle allegations that the video conferencing provider engaged in a series of deceptive and unfair practices that undermined the security of its users.

Zoom has agreed to a requirement to establish and implement a comprehensive security program, a prohibition on privacy and security misrepresentations, and other detailed and specific relief to protect its user base, which has skyrocketed from 10 million in December 2019 to 300 million in April 2020 during the COVID-19 pandemic.
Click to expand...

In its complaint, the FTC alleged that, since at least 2016, Zoom misled users by touting that it offered “end-to-end, 256-bit encryption” to secure users’ communications, when in fact it provided a lower level of security. End-to-end encryption is a method of securing communications so that only the sender and recipient(s)—and no other person, not even the platform provider—can read the content.

In reality, the FTC alleges, Zoom maintained the cryptographic keys that could allow Zoom to access the content of its customers’ meetings, and secured its Zoom Meetings, in part, with a lower level of encryption than promised.
Click to expand...

guest · Nov 11, 2020

The FTC Zoom Case: Does the FTC Need a New Approach?
November 11, 2020
https://www.linkedin.com/pulse/ftc-zoom-case-does-need-new-approach-daniel-solove/

In a weird sense, for tech companies, being enforced against by the FTC for a privacy or security violation has become an initiation ritual to being recognized in the pantheon of the tech company big leagues.

As is the typical process, the FTC announced a complaint and consent order against Zoom for a violation of Section 5 of the FTC Act. More specifically, the FTC charged Zoom with unfair and deceptive data security practices related to encryption and efforts to bypass browser security safeguards.
The Zoom case is notable for several reasons. It signals that Zoom has arrived and is in the club. It’s hard to escape Zoom these pandemic-riddled days; their platform has become the go-to for videoconferencing, and Zoom is becoming a verb.

The FTC rarely brings cases unless it has a slam dunk.
Click to expand...

Beyond the case involving the new tech “prodigy” Zoom that everyone is buzzing about, this case involves some new developments about FTC jurisprudence as well as a blistering critique of the FTC by Commissioners Rebecca Kelly Slaughter and Rohit Chopra.
In the Zoom case, their critique has developed into a broader charge that the FTC needs to take a bolder new approach in its enforcement. Are they right?

We’ll explore these issues in this post. First, we’ll discuss some of the notable parts of the complaint and consent decree. Then we’ll turn to the dissents. [...]
Click to expand...

guest · Dec 16, 2020

EPIC, Coalition Urge FTC to Address Privacy in Zoom Settlement
December 14, 2020
https://epic.org/2020/12/epic-coalition-urge-ftc-to-add.html

EPIC, the Center for Digital Democracy, the Campaign for a Commercial-Free Childhood, the Parent Coalition for Student Privacy, and Consumer Federation of America today sent comments to the FTC urging the agency to address privacy in its proposed Consent Order with Zoom.

The groups recommended that the FTC modify the Order to require Zoom to (1) implement a comprehensive privacy program; (2) obtain regular independent privacy assessments and make those assessments available to the public; (3) provide meaningful redress for victims of Zoom’s unfair and deceptive trade practices; and (4) ensure the adequate protection and limits on the collection of children’s data.
Click to expand...

guest · Dec 19, 2020

Zoom employee secretly censored users on behalf of China, alleges DOJ
December 18, 2020
https://mashable.com/article/doj-accuses-zoom-employee-china-censorship/

In a lengthy criminal complaint, the DOJ details how the employee, Xinjiang Jin, worked to spy on and censor Zoom users across the globe. Notably, the complaint doesn't mention the popular videoconferencing company by name, however, it is clear from the document that Zoom is the company in question.

As an accompanying DOJ press release makes clear, Jin is accused of reporting straight to People's Republic of China intelligence services. His plot allegedly revolved around Zoom meetings planned for the summer of 2020. The intention of the meetings was to commemorate the June 4, 1989, Tiananmen Square massacre.
Click to expand...

At least some of the meetings were shut down by Zoom, and in a statement to the Guardian the company simply claimed it was following the law.

"We regret that a few recent meetings with participants both inside and outside of China were negatively impacted and important conversations were disrupted," the company said at the time.
When reached for comment about Friday's allegations, a Zoom spokesperson replied the company is "reviewing the filing" and would get back to us.

After the publication of this article, Zoom sent a statement — and linked to a newly published blog post — which confirmed many of the DOJ's allegations.
Click to expand...

guest · Aug 1, 2021

Zoom settles US class action privacy lawsuit for $86m
August 1, 2021
https://www.bbc.co.uk/news/business-58050391

The lawsuit alleged that Zoom had invaded the privacy of millions of users by sharing personal data with Facebook, Google and LinkedIn.
It also accused Zoom of misstating that it offers end-to-end encryption and for failing to prevent hackers from "zoombombing" sessions.

The firm denied any wrongdoing, but has agreed to boost its security practices.
Click to expand...

The preliminary settlement, which also includes a provision that Zoom will give its staff specialised training in data handling and privacy, is still subject to approval by US District Judge Lucy Koh in San Jose, California.

"We are proud of the advancements we have made to our platform, and look forward to continuing to innovate with privacy and security at the forefront."

The class-action lawsuit, filed in March 2020 in the US District Court in the Northern District of California, is just one of several legal complaints facing the US-based video-conferencing platform.
The lawsuit was filed on behalf of Zoom Meetings paid subscribers nationwide, as well as free users.
Click to expand...

On top of this, plaintiffs of the lawsuit accused the platform of misrepresenting its encryption protocol - transport encryption - as end-to-end encryption.
Click to expand...

snerd · Aug 1, 2021

These fines for criminal conduct are ridiculous! Pocket change for these $megagazillionaire BigTech overlords!

guest · Aug 17, 2021

Stop using Zoom, Hamburg’s DPA warns state government
August 17, 2021
https://techcrunch.com/2021/08/17/stop-using-zoom-hamburgs-dpa-warns-state-government/

Hamburg’s state government has been formally warned against using Zoom over data protection concerns.

The German state’s data protection agency (DPA) took the step of issuing a public warning yesterday, writing in a press release that the Senate Chancellory’s use of the popular videoconferencing tool violates the European Union’s General Data Protection Regulation (GDPR) since user data is transferred to the US for processing.
Click to expand...

German agencies are among the most proactive in this respect.

In the Hamburg case, the DPA says it took the step of issuing the Senate Chancellory with a public warning after the body did not provide an adequate response to concerns raised earlier.
The agency asserts that use of Zoom by the public body does not comply with the GDPR’s requirement for a valid legal basis for processing personal data, writing:

“The documents submitted by the Senate Chancellery on the use of Zoom show that [GDPR] standards are not being adhered to.”
Click to expand...

Update: A spokesman for the Hamburg DPA told us: “Currently, there are no plans for further formal steps. We expect the addressed administration to assess our legal reasoning and draw the necessary consequences. Of course, we are always open to further talks, looking for possible ways forward. That is what a formal warning is for in the first place: to make a controller aware of problems he will eventually run into if he stays course.”
Click to expand...

guest · Aug 23, 2021

Zoom Facing Global Outage; Online Classes, Video Meetings Affected
August 23, 2021
https://www.india.com/technology/zo...line-classes-video-meetings-affected-4907159/

The video teleconferencing software program is suffering a widespread outage currently, according to a report by India Today. The outage has affected video calls, webinars, and online learning in many parts of the world. But the worst-hit market is Australia, where the Zoom outage threw a wrench into the works by causing troubles for schools and colleges that heavily rely on the video teleconferencing platform.

As per Downdetector, the website that keeps track of outages on the internet, the reports about the platform’s unresponsiveness peaked at about 1200 at around 5 o’clock in the morning, according to Indian time. Zoom was quick to fix the outage for most people in Australia, according to the news.com.au website. There were around 150 reports about the outage by the time of publishing this article, meaning the company’s fix began to work.

“We are aware of a subset of customers experiencing errors while joining a live meeting. We are currently investigating and will provide updates as we have them. Apologies for any inconvenience,” said Zoom on Twitter after it released a preliminary fix for whatever caused the outage
Click to expand...

guest · Sep 22, 2021

Zoom's $14.7 billion deal for Five9 under US national security review
September 22, 2021
https://www.zdnet.com/article/zooms-14-7-billion-deal-for-five9-under-us-national-security-review/

Zoom's proposed $14.7 billion deal to acquire Five9 is now under investigation by a government committee for potential national security risks.

In a letter sent to the Federal Communications Commission (FCC) last month, the Department of Justice (DOJ) requested for FCC's review of the Zoom-Five9 deal to be halted until a telecommunications security committee could assess for potential national security risks.

"USDOJ believes that such risk may be raised by the foreign participation (including the foreign relationships and ownership) associated with the application, and a review by the committee is necessary to assess and make an appropriate recommendation as to how the Commission should adjudicate this application," DOJ foreign investment review acting chief David Plotinsky wrote in the letter.
The letter to FCC was first reported by the Wall Street Journal earlier on Tuesday.
Click to expand...

guest · Oct 1, 2021

And that’s that, as the Zoom deal to buy Five9 is called off
October 1, 2021
https://techcrunch.com/2021/09/30/and-thats-that-as-the-zoom-deal-to-buy-five9-is-called-off/

Zoom, the video conferencing company that became everyone’s primary means of communication around work during the pandemic, will no longer be acquiring Five9, a maker of cloud-based customer-service software.

It certainly didn’t help matters when Zoom last week disclosed that a U.S. Justice Department-led panel has been investigating the tie-up over concerns that it might create national security risks given Zoom’s ties to China.
Still, the figurative nail the coffin might have been a recommendation two weeks ago by the proxy advisory firm Institutional Shareholder Service that Five9 shareholders vote against the acquisition over concerns about Zoom’s slowing growth.
Click to expand...

Titled “What’s next,” Yuan writes of Five9 that it “presented an attractive means to bring to our customers an integrated contact center offering. That said,” he adds, “it was in no way foundational to the success of our platform nor was it the only way for us to offer our customers a compelling contact center solution.”
Click to expand...

Rasheed187 · Oct 3, 2021

mood said: ↑

And that’s that, as the Zoom deal to buy Five9 is called off
October 1, 2021
https://techcrunch.com/2021/09/30/and-thats-that-as-the-zoom-deal-to-buy-five9-is-called-off/
Click to expand...

I really wonder how this is going to affect Zoom's stock price. Certain people say it's positive because this takeover costed too much money, others say this is a huge blow to Zoom's plans to expand into other software areas.

I bought the stock at $300 dollar so I'm a bit worried that it will slide further. On the other hand, last quarter they had $1 billion of revenue for the first time, and remote working isn't going away anymore, so I believe investors are over-reacting, but what else is new on Wall Street.

guest · Nov 2, 2021

Zoom starts showing ads to free users in limited test
For now, users in certain countries on the Basic plan will only see ads after a call.
November 2, 2021
https://www.engadget.com/zoom-ads-basic-plan-free-users-144015591.html

Zoom users on the free Basic plan may start seeing ads starting today. At the outset, ads will only appear on the browser page after a call ends, and you'll only see them following meetings hosted by other Basic users. The test is limited to certain countries too.

The company has updated its privacy policy to reflect the change.
Zoom says it won't use content (in other words, video, audio, messages and files) from meetings, webinars or messaging "for any marketing, promotions, or third-party advertising purposes." The company's advertising partners might use cookies to track your activity on Zoom's website. You can block them from doing so via Zoom's cookie management tool.
Click to expand...

Zoom expects the ad program "will enable us to support investment and continue providing free Basic users with access to our robust platform," chief marketing officer Janine Pelosi wrote in a blog post.
Click to expand...

Rasheed187 · Nov 8, 2021

mood said: ↑

Zoom starts showing ads to free users in limited test
For now, users in certain countries on the Basic plan will only see ads after a call.
November 2, 2021
https://www.engadget.com/zoom-ads-basic-plan-free-users-144015591.html
Click to expand...

I'm not sure if this is a good move, but it might generate some more revenue. And Pfizer's new anti-COVID pill dealt a huge blow to Zoom's stockprice.

guest · Dec 6, 2021

Zoom might pay you $25 as part of a class-action settlement
A lot of people may be eligible to receive some kind of payment
December 2, 2021

Zoom has reached a settlement (PDF) in a class-action lawsuit over alleged privacy and security issues, and if you used the videoconferencing app before July, then you could be eligible to receive money as a result. The company has agreed to pay $85 million while continuing to deny the allegations and any liability.

There are two groups eligible to file a claim. If you paid for a Zoom Meetings App subscription between March 30th, 2016, and July 30th, 2021, you can file a claim for $25 or 15 percent of what you paid for that subscription (excluding optional add-ons). You’re entitled to whichever is greater.
Click to expand...

The second bucket is much broader. If you aren’t eligible for the first group but you “registered, used, opened, or downloaded the Zoom Meeting App” between March 30th, 2016, and July 30th, 2021, you can file a claim for $15.

However, if you have only used Zoom with an “Enterprise-Level Account” or a government account, you’re excluded from the settlement.
Claims must be submitted by March 5th, 2022. You can file a claim online here or by mailing a completed claim form.
Click to expand...

Rasheed187 · Dec 4, 2021

mood said: ↑

And that’s that, as the Zoom deal to buy Five9 is called off
October 1, 2021
https://techcrunch.com/2021/09/30/and-thats-that-as-the-zoom-deal-to-buy-five9-is-called-off/
Click to expand...

LOL, here is a small update, but as expected, Zoom's stock price did indeed fall from $300 dollar to $180 dollar for no good reason, which proves that the stock market is based on almost nothing. So now I have a loss of about 5000 euro. Wall Street isn't for the faint hearted, that's for sure. But hey, you win some, you lose some, right?

Rasheed187 · Dec 8, 2021

I found this article on Motley Fool, hopefully someone (Microsoft, Salesforce or Facebook) will acquire Zoom in 2022, now that it's a bargain. I would offer Zoom to them for $270 per share, take it or leave it! This would at least partially bail me out.

https://www.fool.com/investing/2021/09/03/3-companies-who-should-buy-zoom/

guest · Jul 21, 2022

Zoom brings end-to-end encryption to its cloud phone service
E2EE protection is coming to meeting breakout rooms as well.
July 21, 2022

Zoom is bolstering its privacy and security protections by expanding end-to-end encryption (E2EE) to more of its services. First up is Zoom Phone, its cloud phone system. Users of that service will be able to switch on E2EE during one-on-one calls. When it's on, E2EE will ensure calls are secure with cryptographic keys that only the calling and receiving devices can access. You'll be able to verify the E2EE status by sharing a security code with the other person.

At the moment, it's only possible to enable E2EE on Zoom Phone for calls between users on the same company Zoom account. They'll need to be on the Zoom Phone desktop or mobile app and switch off automatic call recording. Account owners or admins will need to enable E2EE via a web portal before their users can activate it on calls.
Click to expand...

Zoom: End-to-End Encryption Expands to Zoom Phone and Breakout Rooms

Sending and sharing data is a sensitive matter, one that requires tailored innovation for adequate protection. That’s why we’ve released key features — such as data routing control, in-product privacy notifications, end-to-end encryption (E2EE), and more — to give you more insight and control over your information.

And now, we’re excited to expand our end-to-end encryption feature to both Zoom Phone and Breakout Rooms (coming soon) — two more ways you can use Zoom to achieve seamless and secure communication.
Click to expand...

Log in or Sign up

Zoom is a work-from-home privacy disaster waiting to happen

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

snerd Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Rasheed187 Registered Member

guest Guest

Rasheed187 Registered Member

guest Guest

Rasheed187 Registered Member

Rasheed187 Registered Member

guest Guest

Log in or Sign up

Zoom is a work-from-home privacy disaster waiting to happen

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

snerd Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Rasheed187 Registered Member

guest Guest

Rasheed187 Registered Member

guest Guest

Rasheed187 Registered Member

Rasheed187 Registered Member

guest Guest

Useful Searches