{"id":6829,"date":"2018-05-14T06:39:54","date_gmt":"2018-05-14T13:39:54","guid":{"rendered":"https:\/\/cldc.org\/?post_type=organizing_resources&p=6829"},"modified":"2022-04-20T11:14:52","modified_gmt":"2022-04-20T18:14:52","slug":"conf-calls","status":"publish","type":"post","link":"https:\/\/cldc.org\/hi\/conf-calls\/","title":{"rendered":"Choose Wire for conference calls"},"content":{"rendered":"

Here’s what we look for in trustworthy technology<\/a>: end-to-end encryption, open source code, and cross-platform support.\u00a0 Here we dive into the importance of end-to-end encryption and why we recommend groups use<\/a> the open-source<\/a>, end-to-end encrypted<\/a>, and cross-platform<\/a> app Wire<\/a> instead of the proprietary and probably-not really end-to-end encrypted Zoom whenever possible for conference calls (especially when privacy matters).\u00a0 Signal<\/a> is also really good too, but doesn’t do conference calling.<\/p>\n

We still rely on Zoom for conference calls, but we now consider them to be more or less public meetings rather than a secure channel.\u00a0 Why?<\/p>\n

Let’s start by clarifying the phrase “End-To-End Encryption”\u2014this is a technical term meaning a message is scrambled so that it can only be read by the endpoints of a conversation.\u00a0 But here’s where confusion comes in\u2014what are the endpoints?\u00a0 Are they just you and your friends?\u00a0 Or is the server an endpoint too? It depends on the application.\u00a0 As an example, HTTPS<\/a> (which secures communications between you and the servers hosting the webpages you visit) is encrypted so that only you and the server can decrypt the content of the webpages.\u00a0 Signal<\/a>, a secure instant messaging app tied to your smart phone, encrypts messages so that only you and your friend that you are messaging can read your messages.\u00a0 In both cases, only the people or entities that you could imagine needing<\/strong> to know the information are able to decrypt encrypted information.\u00a0 This is the heart of end-to-end encryption.\u00a0 Please check out our post on Direct Encryption<\/a> for more details on end-to-end encryption.<\/p>\n

We are concerned that the fancy webconferencing app Zoom<\/a> could be exploiting this confusion to exaggerate the security of their platform<\/a>.\u00a0 The best case scenario is that Zoom does what ProtonMail does<\/a>: manage the keys needed for encryption for you.\u00a0 The reality is probably worse, since the few technical details Zoom provides<\/a> do not describe enough technical components to actually achieve end-to-end encryption.\u00a0 Their own web portal’s menu indicates that they are not providing end-to-end encryption, but in-transit encryption, that is, encrypting messages between the participants in a conversation and Zoom’s servers:\"\"<\/p>\n

That is, is appears Zoom considers their own servers an “end”.\u00a0 This language is repeated in their security white paper.\u00a0 And because the source-code for Zoom is not public, there is no way to verify any of their claims.\u00a0 Even if we give Zoom the benefit of the doubt, and have faith that they are providing end-to-end encryption, the existence of such a toggle in a web menu gives the web server\u2014that is, Zoom\u2014the ability to flip this switch without your knowing.\u00a0 We’re not saying we know for a fact that Zoom would fail to play nice and violate your privacy.\u00a0 But we are saying that your privacy relies entirely on Zoom to play nice.\u00a0 Most importantly: ask yourselves what Zoom would do if asked to meet national security or law enforcement requirements<\/a>?<\/strong><\/p>\n

The world of digital security changes rapidly.\u00a0 We started using Zoom last year to do remote trainings and conference calls when it looked like there was no reliable, secure option for group calls.\u00a0 Zoom works really well in terms of call quality and participant management features, but the reality is that there are better security-focused options now, and we want to direct people toward using these\u2014Signal<\/a> and Wire<\/a> are our top choices\u2014whenever possible.<\/p>\n

Zoom isn’t the worst in terms of security (not as bad as cellphones or some random free conference call service), and Wire can’t do large conference calls, so there are still some use cases for it.\u00a0 Instead of giving up on security, it can help to think of the various options as tiers of encryption:<\/p>\n

Tier 1 (top shelf, best possible security)<\/strong> uses truly end-to-end, Direct Encryption<\/a>.<\/strong>\u00a0 Private conversations can only be eavesdropped on by breaking into one of the participants’ devices.\u00a0 Wire and Signal meet this standard, and are also open source, so their security claims can be thoroughly verified.\u00a0 If Zoom does this for 1-on-1 calls, as they claim, they could switch it off anytime–it’s a setting that zoom customers\/administrators can change via the administrator panel at zoom.us\u2014so a zoom employee could do the same thing.\u00a0 This is a pretty terrible implementation of end-to-end encryption, so we don’t count it as Direct Encryption, where\u00a0 *only* you and your friends control encryption keys.<\/p>\n

Tier 2 (less than ideal but still hard for some adversaries to break)<\/strong> is the sort of “in transit” encryption Zoom uses for group calls where comms are encrypted from participants’ devices to Zoom’s server, mixed, encrypted again then sent out to all participants’ devices.\u00a0 Breaking this would likely require Zoom’s active co-operation, most likely obtained via a warrant or National Security Letter.<\/p>\n

Tier 3 (not at all good, open to multiple adversaries including private security)<\/strong> is plain old cell phone encryption\u2014governments can relatively easily ask cell phone companies for access to their networks (and to break encryption done by the cell phone company)\u2014worse yet, cell site simulators (“Stingrays”) can force phone network security down from 4G to 3G, weakening encryption enough for anyone with access to a Stingray to break (local cops, very probably corporate security).<\/p>\n

This is why CLDC is recommending Wire–it’s open source, does end-to-end encrypted 1-on-1 video, and allows up to 10-people in end-to-end voice conference calls. Get it here<\/a>.<\/p>\n

We’re happy to help you and your org get set up with Wire and other trustworthy tech<\/a>, and in the meantime there’s also a nice beginners guide to Wire<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"

Here’s what we look for in trustworthy technology: end-to-end encryption, open source code, and cross-platform support. <\/p>","protected":false},"author":1,"featured_media":7449,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[25],"tags":[558,226,238,179,225,265,552,557],"class_list":["post-6829","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-articles","tag-digital","tag-digital-security-tools","tag-encryption","tag-security","tag-signal","tag-trusted-tech","tag-wire","tag-zoom"],"acf":[],"_links":{"self":[{"href":"https:\/\/cldc.org\/hi\/wp-json\/wp\/v2\/posts\/6829","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cldc.org\/hi\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cldc.org\/hi\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cldc.org\/hi\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cldc.org\/hi\/wp-json\/wp\/v2\/comments?post=6829"}],"version-history":[{"count":0,"href":"https:\/\/cldc.org\/hi\/wp-json\/wp\/v2\/posts\/6829\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cldc.org\/hi\/wp-json\/wp\/v2\/media\/7449"}],"wp:attachment":[{"href":"https:\/\/cldc.org\/hi\/wp-json\/wp\/v2\/media?parent=6829"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cldc.org\/hi\/wp-json\/wp\/v2\/categories?post=6829"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cldc.org\/hi\/wp-json\/wp\/v2\/tags?post=6829"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}