What price privacy? Zoom is facing a fresh security storm after CEO Eric Yuan confirmed that a plan to reboot its battered security cred by (actually) implementing end-to-end encryption does not in fact extend to providing this level of security to non-paying users.
This Zoom ‘premium on privacy’ is necessary so it can provide law enforcement with access to call content, per Bloomberg, which reported on security-related remarks made by Yuan during an earnings call yesterday, when the company reported big gains thanks to the coronavirus pandemic accelerating uptake of remote working tools.
“Free users for sure we don’t want to give [e2e encryption] because we also want to work together with FBI, with local law enforcement in case some people use Zoom for a bad purpose,” Yuan said on the call.
Security experts took swiftly to Twitter to condemn Zoom’s ‘pay us or no e2e’ policy.
EFF associate research director, Gennie Gebhart, also critically discussed Zoom’s decision to withhold e2e encryption for free users in a Twitter thread late last month, following a feedback call with the company — criticizing it for spinning what she characterized as pure upsell as a safety consideration.
It’s a nuance-free cop-out to blanket-argue that ‘bad things happen on free accounts’, she suggested.
Fast forward to today and a tweet about the report of Yuan’s comments written by Bloomberg technology reporter, Nico Grant, triggered an intervention by none other than Alex Stamos — the former Facebook and Yahoo! security executive who signed up by as a consultant on Zoom’s security strategy back in April days after the company had been served with a class action lawsuit from shareholders for overstating security claims.
Stamos — who was CSO at Yahoo! during a period when the NSA was using a backdoor to scan user email and also headed up security at Facebook at a time when Russia implemented a massive disinformation campaign targeting the 2016 US presidential election — weighed in via Twitter to claim there’s a “difficult balancing act between different kinds of harms” which he said justifies Zoom’s decision to deny e2e encryption for all users.
Curiously, Stamos was also CSO at Facebook when the tech giant completed the roll out of e2e encryption on WhatsApp — providing this level of security to the then billion+ users of its free-to-use mobile messaging and video chat app.
Which might suggest Stamos’ conception of online “harms” has evolved considerably since 2016 — after all, he’s since landed at Stanford as an adjunct professor (where he researches “safe tech”). Although, in the same year (2016), he defended his employer’s decision not to make e2e encryption the default on Facebook Messenger. So Stamos’ unifying thread appears to be being paid to defend corporate decision-making while applying a gloss of ‘security expertise’.
His latest Twit(n)ter-vention runs to type, with the security consultant now defending Zoom’s management’s decision not to extend e2e encryption to free users of the product.
But his tweeted defence of AES encryption as a valid alternative to e2e encryption has attracted some pointed criticism from the crypto community — as an attack on established standards.
Nadim Kobeissi, a Paris-based applied cryptography researcher — who told us that his protocol modelling and analysis software was used by the Zoom team during development of its proposed e2e encrypted system for (paid product) meetings — called out Stamos for “insisting that AES encryption, which can be bypassed by Zoom Inc. at will, qualifies as real encryption”.
That’s “what’s truly misleading here”, Kobeissi tweeted.
In a phone call with TechCrunch, Kobeissi fleshed out his critique, saying he’s concerned, more broadly, that a current and (he said) much needed “Internet zeitgeist” focus on online safety is being hijacked by certain vested interests to push their own agenda in a way that could roll back major online security gains — such as the expansion of e2e encryption to free messaging apps like WhatsApp and Signal — and lead to a general deterioration of security ideals and standards.
Kobeissi pointed out that AES encryption — which Stamos defended — does not prevent server intercepts and snooping on calls. Nor does it offer a way for Zoom users to detect such an attack, with the crypto expert emphasizing it’s “fundamentally different from snooping-resistant encryption”.
Hence he characterized Stamos’ defence of AES as “misleading and manipulative” — saying it blurs a clearly established dividing line between e2e encryption and non-e2e.
“There are two problems [with the Zoom situation]: 1) There’s no e2e encryption for free users; and 2) there’s intentional deception,” Kobeissi told TechCrunch.
He also questioned why Stamos has not publicly pushed for Zoom to find ways to safely implement e2e encryption for free users — pointing, by way of example, to the franking ‘abuse report’ mechanism that Facebook recently applied to e2e encrypted “Secret Conversations” on Messenger.
“Why not improve on Facebook Messenger franking,” he suggested, calling for Zoom to use its acquisition of Keybase’s security team to invest and do research that would raise security standards for all users.
Such a mechanism could “absolutely” be applied to video and voice calls, he argued.
“I think [Stamos] has a deleterious effect on the kind of truth that ends up being communicated about these services,” Kobeissi added in further critical remarks about the former Facebook CSO — who he said comes across as akin to a “fixer” who gets called in “to render a company as acceptable as possible to the security community while letting it do what it wants”.
We’ve reached out to Zoom and Stamos for comment.