Zoom Blog

In response to all of the well-deserved criticism, Zoom just made two updates to their blog post[1] to announce that they will be completely removing the webserver for all macOS users in a new release tonight, and also adding an option prompt going forward:

JULY 9 PATCH: The patch planned for tonight (July 9) at or before 12:00 AM PT will do the following: 1. Remove the local web server entirely, once the Zoom client has been updated – We are stopping the use of a local web server on Mac devices. Once the patch is deployed, Mac users will be prompted in the Zoom user interface (UI) to update their client. Once the update is complete, the local web server will be completely removed on that device. 2. Allow users to manually uninstall Zoom – We’re adding a new option to the Zoom menu bar that will allow users to manually and completely uninstall the Zoom client, including the local web server. Once the patch is deployed, a new menu option will appear that says, “Uninstall Zoom.” By clicking that button, Zoom will be completely removed from the user’s device along with the user’s saved settings.

PLANNED JULY RELEASE: Additionally, we have a planned release this weekend (July 12) that will address another security concern: video on by default. With this release: 1. First-time users who select the “Always turn off my video” box will automatically have their video preference saved. The selection will automatically be applied to the user’s Zoom client settings and their video…

So, the company that got bribed by a shitcoin promoter to backdoor the keybase app so it can abuse your secret keybase identity keys to place permanent, non-removable shitcoin ads on your profile[1] (and then immediately denied that it was a backdoor and also lied about implementing the ability for users to remove the ads keybase got paid to place[2]) is now joining up with the company that has shipped sketchy backdoored client software[3], consistently lied about having end to end encryption (and even doubled down on their lies when confronted about it!)[4] and delivers their encryption keys from generation servers in China[5].

I'm sure the result of this will be lots of good and secure trustworthy software that I'll be eager to install on my computer. It's totally legitimate and accurate that people are reporting today that this acquisition will bring real end to end encryption to Zoom as if buying a company causes software to spontaneously manifest out of the ether with zero delay. Don't worry, everyone: Zoom is secure now because they wrote a check!

What is it with cryptographic charlatans these days?

[1]: https://sneak.berlin/20190929/keybase-backdoor/

[2]: https://news.ycombinator.com/item?id=21109530

[3]: https://www.zdnet.com/article/zoom-defends-use-of-local-web-server-on-macs-after-security-report/

[4]: https://blog.zoom.us/wordpress/2020/04/01/facts-around-zoom-encryption-for-meetings-webinars/

[5]:…

Zoom’s response to this[1] is a wonderful example of how not to respond to security issues. It includes the classic tropes:

* Our users don’t care about security.

> Our video-first platform is a key benefit to our users around the world, and our customers have told us that they choose Zoom for our frictionless video communications experience.

* We have no way of knowing if this has been exploited in the wild, so it’s probably fine

> Also of note, we have no indication that this has ever happened.

* Other products have the same vulnerability

> We are not alone among video conferencing providers in implementing this solution.

* We decided not to fix it

> Ultimately, Zoom decided not to change the application functionality

And also a lovely one I haven’t seen before:

* We tried to buy the researcher’s silence, but he refused

> Upon his initial communication to Zoom, the researcher asked whether Zoom provides bounties for security vulnerability submissions. Zoom invited the researcher to join our private paid bug bounty program, which he declined because of non-disclosure terms. It is common industry practice to require non-disclosure for private bug bounty programs.

1. https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/

Ah, they updated the previous blog post (https://blog.zoom.us/zooms-term-service-ai/):

Editor’s note: This blog post was edited on August 11, 2023, to include the most up-to-date information on our terms of service. Following feedback received regarding Zoom’s recently updated terms of service Zoom has updated our terms of service and the below blog post to make it clear that Zoom does not use any of your audio, video, chat, screen sharing, attachments, or other communications like customer content (such as poll results, whiteboard, and reactions) to train Zoom’s or third-party artificial intelligence models.

It’s important to us at Zoom to empower our customers with innovative and secure communication solutions. We’ve updated our terms of service (in section 10) to further confirm that Zoom does not use any of your audio, video, chat, screen-sharing, attachments, or other communications like customer content (such as poll results, whiteboard, and reactions) to train Zoom’s or third-party artificial intelligence models. In addition, we have updated our in-product notices to reflect this.

Disclaimer: Have worked with many smart folks who now work at Zoom.

I agree that Zoom has had numerous security and privacy failings. I think it is important to color the characterization of their security teams with a timeline however.

Looking at that gist - the majority of the content predates the conclusion of the "90 day security plan" [1]. The team, and product no doubt, has changed immensely in the past year. That doesn't wallpaper over the history here, but there is completely different security leadership (e.g the current CISO didn't start until late June 2020 [2]) and staffing in place at this point that means your statements on their team likely aren't reflective of Zoom today.

[1] https://blog.zoom.us/ceo-report-90-days-done-whats-next-for-zoom/
[2] https://blog.zoom.us/zoom-hires-jason-lee-as-chief-information-security-officer/

> bad encounters with Zoom, previous cases where Zoom has dismissed or downplayed an exploit, etc.

Have they?

Their disclosure policy [1] sounds reasonable and their public response [2] to the recent accusations has been text book, if you ask me. They even hired top industry experts (Alex Stamos, Matthew Green, etc.) and acquired keybase to strengthen their security.

To me it looks like Zoom got lots of attention at once, and thus had lots of security issues at once, that would not be out of the ordinary if they had been more spread out. However, them lying to their customers about E2EE is hard to forgive.

[1] https://hackerone.com/zoom

[2] https://blog.zoom.us/a-message-to-our-users/