Zoom rolled their own encryption scheme, transmit keys through servers in China (citizenlab.ca)

Article summary

Zoom has been found to have significant weaknesses in its encryption scheme, including the use of a custom encryption protocol and the transmission of meeting encryption keys through servers in China. The company's documentation claims to use AES-256 encryption, but in reality, it uses AES-128 in ECB mode, which is not recommended due to its preservation of patterns in the plaintext. This has raised concerns about the security and privacy of Zoom meetings, particularly given the company's ties to China. The use of Chinese servers to distribute encryption keys has also sparked worries about potential pressure from Chinese authorities.

Main themes

• Zoom security issues
• Encryption protocols
• China's involvement
• User trust and privacy
• GDPR compliance
• Data interception risks
• Convenience vs security tradeoffs

What commenters say

• Zoom's security issues are a major concern and the company deserves criticism for its lack of transparency and poor encryption practices.
• The company can fix its security issues, but regaining user trust will be a challenge.
• Some users are not concerned about Zoom's security issues, as they do not see them as a significant risk for their specific use cases.
• The use of Zoom's services may erode privacy rights, even if it is not immediately apparent, and could have long-term consequences.
• Companies that lie about their security practices, such as Zoom's claim of end-to-end encryption, cannot be trusted to protect user data.
• GDPR compliance is not a guarantee of security or privacy, and companies may claim compliance without actually following the regulations.
• The risk of data interception by authoritarian regimes, such as China, is a significant concern for users of services like Zoom.
• The importance of security and privacy varies depending on the context and use case, and some users may prioritize other factors such as convenience and reliability.