Zoom Blog

The original posting about “no opt-out” was either incorrect, or prior to the current terms of service, per the following from the Zoom site: ( https://blog.zoom.us/zooms-term-service-ai/ ) ” It’s important to us at Zoom to empower our customers with innovative and secure communication solutions. We’ve updated our terms of service (in section 10.4) to further confirm that we will not use audio, video, or chat customer content to train our artificial intelligence models without your consent. ” (unless that is a “distinction without a difference” — meaning, how does one opt-out )

Following up on this point, we’ve updated our terms of service (in section 10.4) to further confirm that we will not use audio, video, or chat customer content to train our artificial intelligence models without your consent. You can see that now clearly stated in our blog: https://blog.zoom.us/zooms-term-service-ai/

Does DOJ have jurisdiction over China's national police, since they are not actually located in the US? It seems like any judgment would be hard to enforce, at best. Regardless, it's interesting to see what led to Zoom [1,2] shutting down Tiananmen Square/June Fourth remembrance Zoom conferences and providing user information to government officials, and to a harassment campaign on Twitter (though presumably the latter is still blocked in China?) [1] https://blog.zoom.us/our-perspective-on-the-doj-complaint/ [2] https://blog.zoom.us/improving-our-policies-as-we-continue-to-enable-g…

I love Keybase, but I would never recommend it today. Zoom acqui-hired the team in 2020: https://blog.zoom.us/zoom-acquires-keybase-and-announces-goal-of-devel…

My friend who joined Zoom via the acquisition said it’s abandoned, all future work is on Zoom, no plans to do anything other than bare minimum maintenance on the keybase systems. No surprise here. Bit of a shame though. Edit: following up on this since i think it was slightly misleading -- this has always been Zoom's public opinion since they announced the acquisition. Their goal was always to integrate the Keybase technology into Zoom. See their blogpost for more https://blog.zoom.us/zoom-acquires-keybase-and-announces-goal-of-devel…

the offical blog post is at: https://blog.zoom.us/wordpress/2020/06/11/improving-our-policies-as-we… Was it wrong to suspend accounts outside of mainland china? Ultimately yes, but as they stress these were accounts that were holding meetings with mostly mainland chinese participants in it. Any company operating globally needs to follow all the local laws where they operate in. Zoom's decision to develop technology to ban participants from specific countries joining meetings seems to be a good solution to this problem.

Ah, they updated the previous blog post (https://blog.zoom.us/zooms-term-service-ai/): Editor’s note: This blog post was edited on August 11, 2023, to include the most up-to-date information on our terms of service. Following feedback received regarding Zoom’s recently updated terms of service Zoom has updated our terms of service and the below blog post to make it clear that Zoom does not use any of your audio, video, chat, screen sharing, attachments, or other communications like customer content (such as poll results, whiteboard, and reactions) to train Zoom’s or third-party artificial intelligence models. It’s important to us at Zoom to empower our customers with innovative and secure communication solutions. We’ve updated our terms of service (in section 10) to further confirm that Zoom does not use any of your audio, video, chat, screen-sharing, attachments, or other communications like customer content (such as poll results, whiteboard, and reactions) to train Zoom’s or third-party artificial intelligence models. In addition, we have updated our in-product notices to reflect this.

So, the company that got bribed by a shitcoin promoter to backdoor the keybase app so it can abuse your secret keybase identity keys to place permanent, non-removable shitcoin ads on your profile[1] (and then immediately denied that it was a backdoor and also lied about implementing the ability for users to remove the ads keybase got paid to place[2]) is now joining up with the company that has shipped sketchy backdoored client software[3], consistently lied about having end to end encryption (and even doubled down on their lies when confronted about it!)[4] and delivers their encryption keys from generation servers in China[5]. I'm sure the result of this will be lots of good and secure trustworthy software that I'll be eager to install on my computer. It's totally legitimate and accurate that people are reporting today that this acquisition will bring real end to end encryption to Zoom as if buying a company causes software to spontaneously manifest out of the ether with zero delay. Don't worry, everyone: Zoom is secure now because they wrote a check! What is it with cryptographic charlatans these days? [1]: https://sneak.berlin/20190929/keybase-backdoor/ [2]: https://news.ycombinator.com/item?id=21109530 [3]: https://www.zdnet.com/article/zoom-defends-use-of-local-web-server-on-… [4]: https://blog.zoom.us/wordpress/2020/04/01/facts-around-zoom-encryption… [5]:…

Zoom’s response to this[1] is a wonderful example of how not to respond to security issues. It includes the classic tropes: * Our users don’t care about security. > Our video-first platform is a key benefit to our users around the world, and our customers have told us that they choose Zoom for our frictionless video communications experience. * We have no way of knowing if this has been exploited in the wild, so it’s probably fine > Also of note, we have no indication that this has ever happened. * Other products have the same vulnerability > We are not alone among video conferencing providers in implementing this solution. * We decided not to fix it > Ultimately, Zoom decided not to change the application functionality And also a lovely one I haven’t seen before: * We tried to buy the researcher’s silence, but he refused > Upon his initial communication to Zoom, the researcher asked whether Zoom provides bounties for security vulnerability submissions. Zoom invited the researcher to join our private paid bug bounty program, which he declined because of non-disclosure terms. It is common industry practice to require non-disclosure for private bug bounty programs. 1. https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern…

In response to all of the well-deserved criticism, Zoom just made two updates to their blog post[1] to announce that they will be completely removing the webserver for all macOS users in a new release tonight, and also adding an option prompt going forward: JULY 9 PATCH: The patch planned for tonight (July 9) at or before 12:00 AM PT will do the following: 1. Remove the local web server entirely, once the Zoom client has been updated – We are stopping the use of a local web server on Mac devices. Once the patch is deployed, Mac users will be prompted in the Zoom user interface (UI) to update their client. Once the update is complete, the local web server will be completely removed on that device. 2. Allow users to manually uninstall Zoom – We’re adding a new option to the Zoom menu bar that will allow users to manually and completely uninstall the Zoom client, including the local web server. Once the patch is deployed, a new menu option will appear that says, “Uninstall Zoom.” By clicking that button, Zoom will be completely removed from the user’s device along with the user’s saved settings. PLANNED JULY RELEASE: Additionally, we have a planned release this weekend (July 12) that will address another security concern: video on by default. With this release: 1. First-time users who select the “Always turn off my video” box will automatically have their video preference saved. The selection will automatically be applied to the user’s Zoom client settings and their video…

We appreciate this feedback - we have reiterated our position that we do not use video, audio or chat content to train our generative AI models. Please see our blog post on this topic here. https://blog.zoom.us/zooms-term-service-ai/

Zoom's general response includes 10.1 and 10.4 https://blog.zoom.us/zooms-term-service-ai/ See COO response too other HN thread https://news.ycombinator.com/item?id=37029700

Looks like they have a separate offering, Zoom for Healthcare that presumably has different terms and conditions. https://blog.zoom.us/answering-questions-about-zoom-healthcare/

Keybase: https://en.wikipedia.org/wiki/Keybase Acquired by Zoom for their team's skills: https://blog.zoom.us/zoom-acquires-keybase-and-announces-goal-of-devel… (2020)

you can lock meetings that has started this is not a UX issue, it is people who give no fuck about security of privacy otherwise your government would have voted anti data-spying laws, they haven't therefore they don't care, therefore they didn't think of locking their meeting after it started i can spell the agenda that's cooking https://blog.zoom.us/keep-uninvited-guests-out-of-your-zoom-meeting/ https://support.zoom.us/hc/en-us/articles/201362603-Host-and-Co-Host-C…

Still there, "Don’t forget to share this post": https://blog.zoom.us/a-message-from-eric-yuan-ceo-of-zoom/

Keybase was acquired by Zoom in 2020 so that its team could work on Zoom's e2e issues. Since that time development of Keybase has slowed and those of us who use it are afraid Zoom is going to let it die. https://blog.zoom.us/zoom-acquires-keybase-and-announces-goal-of-devel…

Disclaimer: Have worked with many smart folks who now work at Zoom. I agree that Zoom has had numerous security and privacy failings. I think it is important to color the characterization of their security teams with a timeline however. Looking at that gist - the majority of the content predates the conclusion of the "90 day security plan" [1]. The team, and product no doubt, has changed immensely in the past year. That doesn't wallpaper over the history here, but there is completely different security leadership (e.g the current CISO didn't start until late June 2020 [2]) and staffing in place at this point that means your statements on their team likely aren't reflective of Zoom today. [1] https://blog.zoom.us/ceo-report-90-days-done-whats-next-for-zoom/ [2] https://blog.zoom.us/zoom-hires-jason-lee-as-chief-information-securit…

CEO is an American citizen[0], Zoom is headquartered in San Jose[1] and listed on NASDAQ.[2] [0] https://blog.zoom.us/navigating-a-new-chapter-for-zoom/ [1] https://en.wikipedia.org/wiki/Zoom_Video_Communications [2] https://www.nasdaq.com/market-activity/stocks/zm

Here's Zoom's own public statement on the matter: https://blog.zoom.us/our-perspective-on-the-doj-complaint/ The statement also says that Zoom itself is under separate US federal investigations for its dealings with Chinese and other foreign governments, as well as its security and privacy practices more generally.

> Zoom is not even end to end encrypted https://blog.zoom.us/zoom-rolling-out-end-to-end-encryption-offering/

Keybase recently sold itself to Zoom in what looks like an acqui-hire: https://blog.zoom.us/zoom-acquires-keybase-and-announces-goal-of-devel… The blog post only talks about integrating Keybase's team - no mention of their product.

> bad encounters with Zoom, previous cases where Zoom has dismissed or downplayed an exploit, etc. Have they? Their disclosure policy [1] sounds reasonable and their public response [2] to the recent accusations has been text book, if you ask me. They even hired top industry experts (Alex Stamos, Matthew Green, etc.) and acquired keybase to strengthen their security. To me it looks like Zoom got lots of attention at once, and thus had lots of security issues at once, that would not be out of the ordinary if they had been more spread out. However, them lying to their customers about E2EE is hard to forgive. [1] https://hackerone.com/zoom [2] https://blog.zoom.us/a-message-to-our-users/

Zoom already basically did this, but they removed it: https://support.zoom.us/hc/en-us/articles/115000538083-Attendee-attent… Archive: https://web.archive.org/web/20200401215500/https://support.zoom.us/hc/… Very old blog post on it: https://blog.zoom.us/zoom-tips-for-educators-attendee-attention-tracki…

That's factually untrue, it's not "known". To the contrary, you can pick the region for your servers, which presumably for 99% of people is precisely to avoid China: https://blog.zoom.us/wordpress/2020/04/13/coming-april-18-control-your…

Zoom claimed they had to remove Chinese participants from the US-hosted meeting but didn't have the functionality to do that so (wrongly) banned the US hosts. They said it was wrong to do, reinstated those accounts, and are building the functionality to enforce those Chinese laws without ever impacting users outside China. That's from their blog. https://blog.zoom.us/wordpress/2020/06/11/improving-our-policies-as-we…

Zoom blogged about it... https://blog.zoom.us/wordpress/2020/06/11/improving-our-policies-as-we…

This is the company with the "we recognize that there is a discrepancy between the commonly accepted definition of end-to-end encryption and how we were using it" statement... https://blog.zoom.us/wordpress/2020/04/01/facts-around-zoom-encryption…

We changed the URL from https://blog.zoom.us/wordpress/2020/05/07/zoom-acquires-keybase-and-an… to the Keybase equivalent since more people were commenting on that one anyway.