Zoom is a work-from-home privacy disaster waiting to happen

hawki · Apr 8, 2020

"Google Bans Zoom Software From Employee Computers, Citing Security Vulnerabilities..."

https://www.buzzfeednews.com/article/pranavdixit/google-bans-zoom

hawki · Apr 8, 2020

"Zoom Says Platform Is as Safe as Peers, Boosts Privacy Tools...

Video meeting firm taps ex-Facebook security chief as adviser...

Zoom Chief Executive Officer Eric Yuan pledged that his company will meet the highest security standards...

Zoom Video Communications Inc. is launching a feature called Security that sets all privacy settings to their highest level, including putting passwords on meetings and employing waiting rooms that force meeting hosts to filter conference attendees...

The San Jose, California-based company is planning to roll out upgraded encryption for its video calls and meeting rooms for large webinars..."

https://www.bloomberg.com/news/arti...rganic&utm_content=business&utm_medium=social

Infected · Apr 8, 2020

We were going to use this last weekend, for our family get-together. But after reading this, we just used Skype.

Azure Phoenix · Apr 8, 2020

For every single company, do not meet security standards. Try to go beyond those standards.

paulderdash · Apr 9, 2020

Anyone used Jitsi? Open source.

korben · Apr 9, 2020

I have.
Terrible sound quality, at least in my case.

guest · Apr 9, 2020

Who has banned Zoom? Google, NASA, and more
April 9, 2020
https://www.techrepublic.com/article/who-has-banned-zoom-google-nasa-and-more/

Zoom's security woes have led to a number of organizations, companies, and schools banning or restricting its use, with some recommending alternatives such as Microsoft Teams

These security flaws have prompted some organizations, companies, governments, government agencies, and schools to ban Zoom or restrict its use. The following list will be updated if more organizations ban or restrict the use of Zoom. [...]
Click to expand...

guest · Apr 10, 2020

Zoom is now 'the Facebook of video apps'
Yet another startup that takes our privacy. Seriously
April 10, 2020
https://www.engadget.com/zoom-is-now-the-facebook-of-video-apps-190024369.html

Given our uncertain and nightmarish times, I’m going to cut right to it.
Because right now, at the terrifying end of one era and the beginning of another whose shape has yet to be known, this is really not the time [...] to bluff and blunder hundreds of millions of instantly vulnerable adults and kids about security and privacy.

Acting like Facebook — taking what you want and pretending to care when caught — is already beyond unconscionable, even more so now that we’re all fighting for our lives.
Which is why it’s especially cynical for many of us that Google banned employees from using Zoom’s shady desktop app on the same day that Zoom hired Facebook’s former security bobblehead as a consultant on its hazy privacy and security triage campaign.
Click to expand...

Everyone working remotely:
ZOOM monitors the activity on your computer and collects data on the programs running and captures which window you have focus on.
If you manage the calls, you can monitor what programs users on the call are running as well. It's [***] up.
— Wolfgang ʬ (@Ouren) March 21, 2020
Click to expand...

It’s probably cynical to think that while a trapped user base is good for the stock portfolio, a similarly desperate and non-tech-savvy set of captives is an atmosphere conducive to sidelining privacy and security concerns.

Which is what Zoom had years of — documented security holes, malware-like behavior, unmasking users on LinkedIn, shady data dealings, and privacy complaints — long before its newfound popularity.
This isn’t to say “people should have known.” This is to say instead, Zoom should have been better digital citizens than that.

Eric Yuan told TIME that basically, he can’t wait for the pandemic to be over so they can go back to focusing on their enterprise customers. Er, as in, going back to the way it was before?
When they were unmasking people’s employees, deceiving their enterprise customers about encryption, exposing businesses to vulns, and who knows what else?
Yeah. So.
Click to expand...

guest · Apr 13, 2020

Zoom is giving paid users more control over where their calls are routed, after it got slammed for 'mistakenly' using data centers in China
April 14, 2020
https://www.businessinsider.in/poli...ata-centers-in-china/articleshow/75131042.cms

Zoom recently admitted that some users "mistakenly" had their calls routed through data centers in China, even if they were outside the country, sparking privacy and security concerns.

Starting April 18, paid Zoom users will be able to have control over which data centers are used to route their calls, while free users outside of China will never have their calls routed through the country, the company said in a blog post on Monday.
When the issue became known a little over a week ago, Zoom CEO Eric Yuan said the problem stemmed from how it quickly added server capacity to support its huge influx of new users.

With the update, users will know which region their meeting data is routed through. Free users won't be able to choose to switch locations; they will by default be assigned to the region they're based in. Paid users can opt in or out of regions, except their default region. Zoom's data centers are grouped by these regions: the United States, Canada, Europe, India, Australia, China, Latin America, and Japan/Hong Kong.
Click to expand...

Zoom: Coming April 18: Control Your Zoom Data Routing

This feature gives our customers more control over their data and their interaction with our global network when using Zoom’s industry-leading video communication services.

As a reminder, meeting servers in China have always been geofenced with the goal of ensuring that meeting data of users outside of China, stays outside of China. On April 3, we removed all of our HTTPS tunneling servers in China to prevent any inadvertent connection through China.
Click to expand...

guest · Apr 16, 2020

India says Zoom 'not a safe platform' for video conferencing
April 16, 2020
https://www.reuters.com/article/us-...platform-for-video-conferencing-idUSKCN21Y1LL

India said on Thursday videoconferencing software Zoom is “not a safe platform”, joining other countries that have expressed concern about the security of an application that has become hugely popular worldwide during the coronavirus lockdown.

Taiwan and Germany have already curbed the use of Zoom, while Google banned the desktop version from corporate laptops this month.
“Zoom is a not a safe platform,” the Cyber Coordination Centre (CyCord) of India’s ministry of home affairs said in a 16-page advisory.

Even some Indian government officials have held discussions with industry executives to discuss coronvirus relief measures via Zoom. One media report (here) this week said the Indian government was advising its ministers not to use third-party software for sensitive meetings.
Click to expand...

Rasheed187 · May 3, 2020

BTW, here is a review of 15 video-conferencing apps, done by Mozilla:

https://foundation.mozilla.org/en/privacynotincluded/categories/video-call-apps/

The Hammer · May 3, 2020

Perhaps Oracle can help solve some of Zoom's issues.

guest · May 5, 2020

mood said: ↑

Zoom admits some calls were routed through China by mistake
April 4, 2020
https://techcrunch.com/2020/04/03/zoom-calls-routed-china/

Citizen Lab: A Quick Look at the Confidentiality of Zoom Meetings
Zoom: Response to Research From University of Toronto’s Citizen Lab
Click to expand...

Zoom responds to allegations surrounding its China connection
May 5, 2020
https://mspoweruser.com/zoom-allegations-china-connection/

Last month, security researchers at Citizen Lab published a report claiming Zoom had routed some calls through China. Zoom later confirmed that the company routed calls by mistake. After the incident, Zoom has now started offering an option for customers to select their preferred data centers. Despite the clarifications provided by Zoom, the company is still being accused of having Chinese connections. Today, Zoom CEO offered the following explanation regarding its connection with China.
Click to expand...

The Telegraph: Zoom’s China problem may prove to be its Achilles heel

When US government agencies were warned last week that Zoom was vulnerable to being hacked by “foreign spies”, staff were quick to delete the app. The warning came from a Department of Homeland Security intelligence analysis which claimed the video-calling app’s Chinese workforce could work at the behest of the ruling Communist Party.
The claim was denied by a Zoom spokesman, who said it was “heavily misinformed, includes blatant inaccuracies about Zoom’s operations, and the authors themselves admit only ‘moderate confidence’ in their own reporting”.

Most damaging was the revelation from Citizen Lab, a research group, that Zoom users’ data had been routed through Chinese servers in April, even when participants were outside the country. [...]
Click to expand...

Zoom: Navigating a New Chapter for Zoom

Many people have asked me what the experience of running Zoom has been like recently. I would like to share, from my perspective, what has happened at Zoom these past few weeks
[...]
Recently, questions have also been raised about Zoom and China. At first, this seemed to stem from a temporary misconfiguration in our global data center routing that we fixed. But outside of that isolated incident, in the past few weeks, we have seen disheartening rumors and misinformation cropping up. I would like to set the record straight here.
Click to expand...

guest · May 6, 2020

mood said: ↑

American schools are banning Zoom and switching to Microsoft Teams
April 5, 2020
https://betanews.com/2020/04/05/us-schools-ban-zoom/
Click to expand...

NYC allows Zoom (once again) for remote learning
May 6, 2020
https://ny.chalkbeat.org/2020/5/6/21249689/nyc-schools-education-zoom-ban-reversed

After forbidding schools from using the teleconferencing platform Zoom for remote instruction, New York City is reversing course, officials said Wednesday.

The company has agreed to create a customized version of the platform specifically for the city’s education department and made a series of other tweaks to satisfy broader concerns about privacy and security.

“The security of our students and staff is paramount, and we’ve worked with Zoom to create a tailored platform that provides the safety and functionality schools need to engage in remote learning,” schools Chancellor Richard Carranza said in a statement.
Some schools continued using Zoom despite the education department’s ban, hoping officials would eventually allow it again. Other schools abruptly stopped using the platform, disrupting remote instruction.

Zoom’s contract with the education department with Zoom is for one year; officials did not immediately reveal its cost.
Click to expand...

The education department’s legal and technology divisions initially made the decision to ban Zoom based on guidance from the city’s unit on cyber security, officials said. The FBI and several elected officials called for investigations into the platform. Other school districts, including Newark’s, also banned the platform for remote learning.

Department officials previously said they may ultimately approve Zoom in the future.
Carranza had not given a specific timeline for schools to stop using Zoom and acknowledged the transition could not happen immediately. “We want people to gradually transition to another format,” he said last month.
Click to expand...

guest · May 7, 2020

Zoom acquires encryption startup Keybase
Keybase is known for its end-to-end encrypted messaging and cloud storage system
May 7, 2020
https://www.zdnet.com/article/zoom-acquires-encryption-startup-keybase/

Video communications company Zoom is buying Keybase, makers of an end-to-end encrypted messaging and cloud storage system. The acquisition is the first purchase in Zoom's history.
With Keybase, Zoom users will have the ability to add end-to-end encryption to video calls -- a significant development on Zoom's 90-day security push.

Zoom came under fire earlier this year for saying that its platform used end-to-end encryption when in fact it did not. Zoom's marketing practices suggested that the company used the AES-256 encryption standard to keep video calls secure, but instead, a substandard AES-128 key in ECB mode was actually in use.

In a blog post Thursday, Zoom CEO Eric Yuan said the Keybase acquisition will allow Zoom to offer an end-to-end encrypted meeting mode to all paid accounts.
Click to expand...

Looking ahead, Zoom said it will publish a draft cryptographic design on May 22 and then solicit feedback from crypto experts and customers before settling on a final design and pushing it out to Zoom users. Zoom has also promised that it will not build a mechanism to decrypt live meetings for lawful interception, nor will it build any cryptographic backdoors that would allow the company to secretly insert people into meetings.
Click to expand...

Zoom: Zoom Acquires Keybase and Announces Goal of Developing the Most Broadly Used Enterprise End-to-End Encryption Offering

TechCrunch: Zoom acquires Keybase to get end-to-end encryption expertise

[...] Under the terms of the deal, the Keybase will become a subsidiary of Zoom and co-founder and Max Krohn will lead the Zoom security engineering team, reporting directly to Yuan to help build the security product. The other almost two dozen employees will become Zoom employees. The vast majority are security engineers.

It’s not clear what will happen to Keybase’s products, but the company did say Zoom is working with Keybase to figure that out.
Keybase was founded in 2014 and has raised almost $11 million according to Crunchbase data.
Click to expand...

dogbite · May 9, 2020

NSA survey on video conferencing services, source Schneier's blog:

https://www.schneier.com/blog/archives/2020/04/secure_internet.html

Link to NSA (PDF):

https://media.defense.gov/2020/Apr/24/2002288653/-1/-1/0/CSI-SELECTING-AND-USING-COLLABORATION-SERVICES-SECURELY-SHORT-FINAL.PDF

Minimalist · May 10, 2020

Zoom responds after hacker streams child abuse video into children’s fitness class

Zoom has continued to get targeted by hackers around the world. In the latest incident, a hacker streamed child abuse video in a call meant for children. Here’s what Zoom has to say about the incident.
Click to expand...

https://www.hindustantimes.com/tech...tness-class/story-C4nvOJajqYTL0pSRbDPBjO.html

guest · May 11, 2020

U.S. FTC indicates it is looking at Zoom privacy woes
May 11, 2020
https://www.reuters.com/article/us-...is-looking-at-zoom-privacy-woes-idUSKBN22N2MJ

Federal Trade Commission Chairman Joseph Simons indicated on Monday that the agency was looking at privacy complaints regarding Zoom Video Communications Inc.

In a teleconference with lawmakers, Simons made reference to concerns that Representative Jerry McNerney of California had about Zoom. McNerney and others had written a letter to Zoom expressing concerns about information collected about registered and non-registered users and recordings made by Zoom subscribers which may be stored in the cloud.
While not addressing the question of Zoom directly, Simons said the agency takes its complaints seriously.

“We are very happy to take complaints from any source,” he said. “If you’re reading about it (an issue) in the press, in the media, then you can be assured that we’re looking at it already or we will because of the media attention. If it’s out there in the media, we’re on it.”
An FTC probe would not necessarily find wrongdoing.
Click to expand...

But it has had growing pains. The company faced a backlash for failing to disclose that its service was not fully end-to-end encrypted and said it planned to develop tools that will give more controls to meeting hosts and allow users to securely join a meeting and submit them to external review.
Click to expand...

guest · May 12, 2020

House of Commons set to dump Zoom as it considers British alternative
May 11, 2020
https://www.telegraph.co.uk/technol...-set-dump-zoom-considers-british-alternative/

The House of Commons is braced to dump Zoom and switch to a different video-conferencing system designed by a British company.

It is also looking for a new system that displays as many members as possible at once. Technology built by Watford-based Starleaf is being trialled.
Currently, the Zoom display jumps around when someone speaks and has caused issues for members.
Starleaf chief technology officer Will MacDonald said that testing has already begun.

“I think our security is way ahead,” said Starleaf chief executive Mark Richer.
Click to expand...

Minimalist · May 12, 2020

WhatsApp Challenges Zoom With 50 Person Video Calling

Serious video conferencing move by Facebook. Desktop users of WhatsApp will soon be able to add up 50 people on a video call
Click to expand...

https://www.silicon.co.uk/mobility/...nges-zoom-with-50-person-video-calling-343633

Minimalist · May 17, 2020

Zoom global outage preventing meetings, video, and audio

Zoom has a global outage that is preventing users from joining meetings or see video and hear audio once they have joined. There is currently no indication as to when the issue will be resolved.

If you were hoping to join your Sunday school class, attend virtual Church, or access your virtual exercise class, you might have to do something else today as people are having issues connecting to all of these types of meetings.
Click to expand...

https://www.bleepingcomputer.com/ne...l-outage-preventing-meetings-video-and-audio/

guest · May 19, 2020

Zoom suspends free service to individuals in China
May 19, 2020
https://asia.nikkei.com/Business/Technology/Zoom-suspends-free-service-to-individuals-in-China

California-based videoconferencing company Zoom Video Communications has suspended individual users from signing up in China, the Nikkei Asian Review has learned.

As of May 1, individual free users can no longer host meetings on Zoom but will still be able to join them. Only paid enterprise accounts and individuals who had upgraded to paid accounts prior to the cutoff date will be able to host meetings.
Going forward, the company will allow only enterprises with proof of business registration and corporate banking accounts to purchase its service, according to details posted on a Chinese Zoom website managed by China reseller Donghan Telecom. "Individual purchases will not be accepted," it says.
Click to expand...

guest · May 21, 2020

Zoom to Provide Detailed Info on Upcoming End-to-End Encryption Feature
May 21, 2020
https://www.securityweek.com/zoom-provide-detailed-info-upcoming-end-end-encryption-feature

After it was pointed out that Zoom is not offering true end-to-end encryption and the encryption that is available isn’t the best, the company has promised to work on providing better encryption.

Zoom plans on rolling out AES 256-bit GCM encryption on May 30, but the company also plans on implementing true end-to-end encryption in the near future, for which it recently acquired secure messaging and file-sharing service Keybase. The new end-to-end encrypted meeting mode will be available to all paid accounts, Zoom said.
Zoom announced this week that a detailed draft of its cryptographic design for end-to-end encryption will be made public on Friday. The draft will not include any code, but the company hopes to get some feedback before the feature is developed.

“We will be hosting discussions with cryptographic experts, customers, advocacy groups, and others to solicit feedback to evaluate for the final design,” Zoom said on Wednesday.
Click to expand...

guest · May 22, 2020

Zoom Publishes Draft Design of End-to-End Encryption Offering
May 22, 2020
https://blog.zoom.us/wordpress/2020...aft-design-of-end-to-end-encryption-offering/

Today Zoom published a draft cryptographic design for an end-to-end-encrypted video communications offering.

Security and privacy are the twin pillars of Zoom’s 90-day plan. When I joined Zoom with the rest of the Keybase team on May 7, we announced our intention to build the most secure video meeting offering that can reach current Zoom scalability.
In our commitment to remaining transparent and open as we build this end-to-end encryption offering, we have published our cryptographic design for peer review on GitHub. We will host discussions with cryptographic experts, nonprofits, advocacy groups, customers, and others to share more details and solicit feedback for the final design.
Click to expand...

guest · May 24, 2020

mood said: ↑

India says Zoom 'not a safe platform' for video conferencing
April 16, 2020
https://www.reuters.com/article/us-...platform-for-video-conferencing-idUSKCN21Y1LL
Click to expand...

SC seeks Centre's response on Zoom ban for privacy breach, security issues
May 23, 2020
https://www.business-standard.com/a...g-privacy-security-issues-120052300143_1.html

The Supreme Court has sought a response from the Centre on a plea seeking a ban on popular video-conferencing software application Zoom, until formulation of an appropriate legislation.

The petitioner, Harsh Chugh, argued that the software application was not safe and did not have end-to-end encryption, and as a consequence, it was violating the Information Technology Act, 2000, and Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009, news agency IANS reported.
Click to expand...

The plea submitted that the software application was a threat to individuals' privacy and cited that the CEO of Zoom Video Communications had already "apologised publicly and accepted the app to be faulty in terms of providing a secure environment digitally which is against the norms of cyber security".
The plea contends that it is important to put in place a standard regulation to safeguard the rights of the citizens.
Click to expand...

Log in or Sign up

Zoom is a work-from-home privacy disaster waiting to happen

hawki Registered Member

hawki Registered Member

Infected Registered Member

Azure Phoenix Registered Member

paulderdash Registered Member

korben Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Rasheed187 Registered Member

The Hammer Registered Member

guest Guest

guest Guest

guest Guest

dogbite Registered Member

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Zoom is a work-from-home privacy disaster waiting to happen

hawki Registered Member

hawki Registered Member

Infected Registered Member

Azure Phoenix Registered Member

paulderdash Registered Member

korben Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Rasheed187 Registered Member

The Hammer Registered Member

guest Guest

guest Guest

guest Guest

dogbite Registered Member

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches