By Dan Moren
March 31, 2020 7:18 AM PT
Zoom’s misleading encryption claims are just the latest problem for the popular service
Note: This story has not been updated for several years.
Damning report from Micah Lee and Yael Grauer at The Intercept on Zoom’s misleading encryption claims:
Zoom, the video conferencing service whose use has spiked amid the Covid-19 pandemic, claims to implement end-to-end encryption, widely understood as the most private form of internet communication, protecting conversations from all outside parties. In fact, Zoom is using its own definition of the term, one that lets Zoom itself access unencrypted video and audio from meetings.
So, there’s a bit to unpack here. First, what Zoom is doing is using TLS (Transport Layer Security), the same protocol used to secure HTTPS web connections—i.e., the secure connection you make when, say, you shop at an online store and see that little padlock in your browser’s location bar.
However, end-to-end encryption—which Zoom claims to offer—is a different beast. What it means is that if I’m talking to you, our conversation is encrypted from my device all the way to your device, with no server or party in between able to decrypt it. (Your and my devices have to be able to decrypt our conversation, else we could not converse.) FaceTime and iMessage1 are both end-to-end encrypted, meaning even Apple can’t read our conversations, as are messaging apps like Signal and WhatsApp.
End-to-end encryption for multiparty video chats is hard, as cryptographer Matthew Green tells The Intercept, but it’s certainly not impossible. And, frankly, you don’t get a pass because something is hard. Zoom claiming to offer end-to-end encryption while not doing so is simply dishonest and irresponsible marketing.
And in case you think I’m being too harsh, here is—in my opinion—the money quote from The Intercept’s article:
“When we use the phrase ‘End to End’ in our other literature, it is in reference to the connection being encrypted from Zoom end point to Zoom end point,” the Zoom spokesperson wrote, apparently referring to Zoom servers as “end points” even though they sit between Zoom clients. “The content is not decrypted as it transfers across the Zoom cloud” through the networking between these machines.
You can’t just make words mean whatever you want. “End-to-end encryption” has a specific definition, and trying to massage it simply because it’s inconvenient is a real problem.
If you apply to a grad school and say “I had a 4.0 GPA”, but upon further investigation they discover that you had only a 3.0, and your answer is “Well, I got a 4.0 GPA this one semester, and my understanding of GPA is that you just pick the best score you got,” then the response is going to be “That’s not how it works.“
If a bank says they offer secure storage for your valuables, and then it turns out they transport them in an armored car but then dump them in an unlocked closet, you would understandably feel that they had not been honest with you.
What Zoom is offering is, at best, “end-to-middle-to-¯_(ツ)_/¯-to-middle-to-end” encryption.
In and of itself, this situation is raising a lot of questions, but what’s worse is that it’s part of a clear pattern with Zoom. Just this past week, the company’s iOS app was discovered to be sending information to Facebook without disclosing that in its privacy policy.2 Others have pointed out that Its macOS installer also seems to have some shady behavior. And, of course, last year the company was found to be installing a secret local web server to bypass an Apple security restriction.
The old Ian Fleming adage is “Once is happenstance. Twice is coincidence. The third time it’s enemy action.” I’m not saying that Zoom is deliberately acting maliciously here; rather, all of this points to a corner-cutting culture that evokes a quote from a different Ian: Zoom is so preoccupied with whatever or not it can do something, that it doesn’t stop to think if it should.
And that’s dangerous, especially as our current world predicament means Zoom’s popularity has skyrocketed. It’s become the de facto communication method for companies, educational institutions, and even just average folks who want to chat with their family and friends,3 none of whom may be fully aware what the implications of them joining a simple video call may be.
Look, I’m a Zoom user, and it’s proved to be a useful tool and a solid product. But that doesn’t excuse the way the company has repeatedly behaved. The good news is that with all this increased usage comes increased scrutiny, which will hopefully encourage Zoom to mend its ways. But doing so is either going to require investment to make Zoom live up to its marketing, or the company to dial back on its claims and admit that it’s not delivering on what it promises. Unfortunately, spending money and issuing apologies are two things companies hate to do.
- The loophole for iMessage comes not in the conversation itself, but in backing up your device—which contains a copy of your conversations—to Apple’s servers. ↩
- John Gruber has a great write-up of the implications of that over at Daring Fireball. ↩
- Not to mention podcasters! ↩
[Dan Moren is the East Coast Bureau Chief of Six Colors. You can find him on Mastodon at @dmoren@zeppelin.flights or reach him by email at dan@sixcolors.com. His latest novel, the supernatural detective story All Souls Lost, is out now.]
If you appreciate articles like this one, support us by becoming a Six Colors subscriber. Subscribers get access to an exclusive podcast, members-only stories, and a special community.