Day: April 4, 2020

Zoom improves security with automatic password protection and waiting rooms

Zoom improves security with automatic password protection and waiting rooms

After facing heavy criticism for the way it handles privacy and security, the video conferencing service Zoom is making a few very necessary updates. 

Beginning April 5, all meetings going forward will have automatically enabled password protection and waiting rooms. The password protection makes it so you need a password to enter a meeting even if you already have the meeting ID, although those who enter a meeting via a link will not need to enter the password. The waiting room allows the hosts to selectively admit people who are waiting to enter a meeting, so if they see a name they don’t recognize, they can choose not to let them have access. Read more…

More about Privacy, Zoom, Passwords, Tech, and Cybersecurity

Original Content podcast: ‘The Platform’ offers a gruesome metaphor for capitalism

“The Platform” is not a subtle movie.

That’s true of its approach to horror, with intense, bloody scenes that prompted plenty of screaming and pausing from your hosts at the Original Content podcast. It’s also true of its thematic material — right around the time one of the characters accuses another of being communist, you’ll slap yourself on the forehead and say, “Oh, it’s about capitalism.”

The new Netflix film takes place in a mysterious prison, with two prisoners on each level (they’re randomly rotated each month). Once each day, a platform laden with delicious food is lowered through the prison. If you’re on one of the top levels, you feast. If you’re further down, things are considerably more grim, and can become downright gruesome as the month wears on.

“The Platform” is a hard movie to sit through, and it has other faults, like an irritatingly mystical ending. But it’s certainly memorable, and even admirable in its dedication to fully exploring both the logistical and moral dimensions of its premise.

You can listen to our review in the player below, subscribe using Apple Podcasts or find us in your podcast player of choice. If you like the show, please let us know by leaving a review on Apple. You can also send us feedback directly. (Or suggest shows and movies for us to review!)

And if you’d like to skip ahead, here’s how the episode breaks down:
0:00 Intro
0:27 “The Platform” review
17:29 “The Platform” spoilers

Shocking unemployment graph and GameCube’s intro music fit together perfectly

Shocking unemployment graph and GameCube's intro music fit together perfectly

A graph tracking unemployment in the United States somehow works with the iconic GameCube intro music. And seems to highlight our current state of dread with a surreal flair.

Last week, 6.6 million Americans, a 3000 percent increase, filed for unemployment as the coronavirus pandemic continued to devastate the economy. On Thursday, evolutionary anthropologist Dorsa Amir tweeted an animated graph that shows the massive jump alongside data from 1965 to earlier in the year. She also posted it on a data appreciation subreddit

“We’re dealing with truly staggering numbers here,” Amir tweeted, emphasizing the jaw-dropping increase in unemployment so far.  Read more…

More about Gaming, Viral Videos, Coronavirus, Culture, and Web Culture

Zoom admits some calls were routed through China by mistake

Hours after security researchers at Citizen Lab reported that some Zoom calls were routed through China, the video conferencing platform has offered an apology and a partial explanation.

To recap, Zoom has faced a barrage of headlines this week over its security policies and privacy practices, as hundreds of millions forced to work from home during the coronavirus pandemic still need to communicate with each other.

The latest findings landed earlier today when Citizen Lab researchers said that some calls made in North America were routed through China — as were the encryption keys used to secure those calls. But as was noted this week, Zoom isn’t end-to-end encrypted at all, despite the company’s earlier claims, meaning that Zoom controls the encryption keys and can therefore access the contents of its customers’ calls. Zoom said in an earlier blog post that it has “implemented robust and validated internal controls to prevent unauthorized access to any content that users share during meetings.” The same can’t be said for Chinese authorities, however, which could demand Zoom turn over any encryption keys on its servers in China to facilitate decryption of the contents of encrypted calls.

Zoom now says that during its efforts to ramp up its server capacity to accommodate the massive influx of users over the past few weeks, it “mistakenly” allowed two of its Chinese data centers to accept calls as a backup in the event of network congestion.

From Zoom’s CEO Eric Yuan:

During normal operations, Zoom clients attempt to connect to a series of primary datacenters in or near a user’s region, and if those multiple connection attempts fail due to network congestion or other issues, clients will reach out to two secondary datacenters off of a list of several secondary datacenters as a potential backup bridge to the Zoom platform. In all instances, Zoom clients are provided with a list of datacenters appropriate to their region. This system is critical to Zoom’s trademark reliability, particularly during times of massive internet stress.”

In other words, North American calls are supposed to stay in North America, just as European calls are supposed to stay in Europe. This is what Zoom calls its data center “geofencing.” But when traffic spikes, the network shifts traffic to the nearest data center with the most available capacity.

China, however, is supposed to be an exception, largely due to privacy concerns among Western companies. But China’s own laws and regulations mandate that companies operating on the mainland must keep citizens’ data within its borders.

Zoom said in February that “rapidly added capacity” to its Chinese regions to handle demand was also put on an international whitelist of backup data centers, which meant non-Chinese users were in some cases connected to Chinese servers when data centers in other regions were unavailable.

Zoom said this happened in “extremely limited circumstances.” When reached, a Zoom spokesperson did not quantify the number of users affected.

Zoom said that it has now reversed that incorrect whitelisting. The company also said users on the company’s dedicated government plan were not affected by the accidental rerouting.

But some questions remain. The blog post only briefly addresses its encryption design. Citizen Lab criticized the company for “rolling its own” encryption — otherwise known as building its own encryption scheme. Experts have long rejected efforts by companies to build their own encryption, because it doesn’t undergo the same scrutiny and peer review as the decades-old encryption standards we all use today.

Zoom said in its defense that it can “do better” on its encryption scheme, which it says covers a “large range of use cases.” Zoom also said it was consulting with outside experts, but when asked, a spokesperson declined to name any.

Bill Marczak, one of the Citizen Lab researchers that authored today’s report, told TechCrunch he was “cautiously optimistic” about Zoom’s response.

“The bigger issue here is that Zoom has apparently written their own scheme for encrypting and securing calls,” he said, and that “there are Zoom servers in Beijing that have access to the meeting encryption keys.”

“If you’re a well-resourced entity, obtaining a copy of the internet traffic containing some particularly high-value encrypted Zoom call is perhaps not that hard,” said Marcak.

“The huge shift to platforms like Zoom during the COVID-19 pandemic makes platforms like Zoom attractive targets for many different types of intelligence agencies, not just China,” he said. “Fortunately, the company has (so far) hit all the right notes in responding to this new wave of scrutiny from security researchers, and have committed themselves to make improvements in their app.”

Zoom’s blog post gets points for transparency. But the company is still facing pressure from New York’s attorney general and from two class-action lawsuits. Just today, several lawmakers demanded to know what it’s doing to protect users’ privacy.

Will Zoom’s mea culpas be enough?