From Zoom leak privacy event, see whether Facetime, Skype and other video application encryption scheme is really safe?

One of the tech companies in the spotlight during the coronavirus epidemic was Zoom, which recently reported leaking personal information about at least thousands of users, including email addresses and photos, to strangers via video calls. The leak was caused by Zoom's "company directory" setting, which automatically adds others to a user's contact list if they register with an email address that shares the same domain name. Many Zoom users say they used personal email addresses for registration, but that Zoom mistakenly treated them as corporate email domains, allowing thousands of individual email registrants to mix and share personal information with each other.

Zoom was later accused of failing to encrypt the video calls end-to-end, further undermining users' privacy.

What is end-to-end encryption?

End-to-end encryption scrambles video, audio, and text content that can only be accessed by the sender and intended recipient, and that the service provider has no way to decrypt. The way to encrypt the chat content is to let only the participating users know the key to decrypt the message, and let the service provider deliver the encrypted message directly from the sender to the receiver. However, pulse understands that most messaging tools on the market today don't guarantee end-to-end encryption, partly for law enforcement reasons, but also because it can be very disruptive to the user experience. For example, this approach makes it difficult to synchronize messages and integrate third-party applications on various devices.

For video and audio conferencing, end-to-end encryption presents even more challenges. To do this, each participant's audio and video streams need to be individually encrypted with their own unique key and sent to the other participants. This leads to problems such as extended packet sizes and encryption/decryption delays that cause image delays and degrade the quality of the connection. In October, Jameson Lopp, an engineer and longtime bitcoin supporter, Shared a spreadsheet on Twitter that evaluated about 70 messaging applications based on security, functionality, availability and other criteria. Some of these are video conferencing apps that we use extensively today, including Zoom, Google Hangouts Meet, Slack, Facetime, and imassgae.

& have spent

Based on Jameson Lopp's report, pulse will examine some of the most popular videoconferencing tools on the market, and let's take a look at how there may be no perfect alternative to privacy and security.

& have spent

Zoom

First, let's review the Zoom problem.

& have spent

Videoconferencing applications were once touted as offering better user experience and video quality than competitors. However, this convenience may be based on sacrificing security. As The Intercept reported, despite Zoom's claim that it "USES end-to-end encryption" to secure meetings, it actually refers to The fact that The endpoints are The user and Zoom's servers, not The user to user ends.

& have spent

In other words, Zoom's so-called encryption is actually a message sent by the user that will be encrypted during Zoom's media stream during the transition, but will be decrypted once it passes through Zoom's firewall. Zoom then reencrypts these media streams and sends them to the designated recipient. That is, the user's information is sent to the Zoom server, which is subsequently decrypted, and then reencrypted by Zoom to the recipient.

& have spent

This practice, known as transmission encryption, is widely used by messaging and videoconferencing tools on the market. One of Zoom's famous features is the ability to record video and send it to other conference participants. However, this famous feature was also the source of much of the criticism a while back: it exposed users to potential security risks associated with Zoom's servers and compromised user privacy, since Zoom could view all meetings.

& have spent

Google Hangouts Meet

& have spent

Here's another popular video conferencing service, Google Hangouts Meet, which doesn't seem to advertise its use of end-to-end encryption as Zoom does. The G Suite website simply states that all video and audio streams in the Google Hangouts Meet are encrypted, but does not say what encryption scheme they use. But the site points out in its q&a that when there are only two users, a peer-to-peer connection can be established. This connection allows users to send media streams directly to each other, avoiding routing media streams to the Google server.

& have spent

However, Google Hangouts Meet was later criticized for not having clear encryption Settings, after twitter acknowledged to Vice in 2015 that the Hangouts Meet didn't use end-to-end encryption. Since then, the company does not appear to have implemented end-to-end encryption, though little information has been made public.

& have spent

Skype

& have spent

Skype, the video conferencing service long owned by Microsoft, does have some end-to-end encryption. In 2018, Skype introduced a private calling feature that allows users to hold audio calls and transfer files by deploying the Signal protocol, which is also the way Signal and WhatsApp use to protect information.

& have spent

According to Skype's white paper on this feature, participants in private audio calls must first initiate a private session. During the session, a randomly generated encryption key is Shared, allowing the sender to encrypt and the receiver to decrypt the audio stream. However, the service is not suitable for videoconferencing, and Skype videoconferencing still USES advanced encryption standard (AES), an encryption specification established by the U.S. government in 2001.

& have spent

FaceTime

& have spent

Finally, FaceTime and iMessage, currently available only to apple users, are one of the few communication applications that USES end-to-end encryption. It was this feature that led apple into a series of legal battles in 2016, when it refused to give the FBI access to the iPhone, pulse has learned. Many of you will remember this event.

& have spent

But while FaceTime USES end-to-end encryption, it's not perfect. In January 2019, apple had to suspend all group chats to fix a bug that allowed users to eavesdrop on people's voices before they answered the phone.

& have spent

And while messages sent through iMessage are also encrypted end-to-end, apple can still access them once they are uploaded to iCloud for backup and synchronization. According to a recent report from Reuters, apple is also considering end-to-end encryption of all backup data on iCloud. But pulse learned that under pressure from the fbi, it finally abandoned the plan two years ago. That is, as long as the user once the information uploaded or synchronized to the cloud, then the previous encrypted information is not completely secure.

& have spent

Having said that, we must admit that end-to-end encryption does not guarantee complete security and privacy. So far, the scheme still has various vulnerabilities, such as the cloud backup problem mentioned earlier, and the metadata that messaging applications can collect to reveal users' personal information.

conclusion

For those who work from home, security issues surrounding videoconferencing services remain a top priority. While Zoom is now under the microscope and everyone is aware of the privacy and security issues that Zoom can bring, it's still a one-of-a kind situation for most people, and Zoom's competitors' security plans face the same security issues. How to solve it effectively? Or whether we need complete privacy, is still the current society has been unable to stop the topic.

This article is translated and sorted by BlockBeats. If you want to reprint this article, please attach the hyperlink:https://www.theblockbeats.com/news/14991

The original address: https://www.theblockcrypto.com/daily/60691

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia