Daily Archives: June 18, 2020

Zoom will offer proper end-to-end encryption to free vid-chat accounts – not just paid-up bods – once you verify your phone number…

Posted on by

Zoom today said it will make end-to-end (E2E) encryption available to all of its users, regardless of whether they pay for it or not.

The videoconferencing overnight-sensation has walked back its initial plan to limit E2E cryptography to schools and paid-for accounts, after facing a storm of criticism for the restriction. It will, from next month, offer strong E2E encryption (E2EE) as a beta to any free account holder willing to hand over their contact number, as well as offering it to enterprise customers. We note that Google Meet and other rival services do not offer E2EE.

“Today, Zoom released an updated E2EE design on GitHub,” Zoom CEO Eric Yuan said. “We are also pleased to share that we have identified a path forward that balances the legitimate right of all users to privacy and the safety of users on our platform.

“This will enable us to offer E2EE as an advanced add-on feature for all of our users around the globe – free and paid – while maintaining the ability to prevent and fight abuse on our platform.”

It should be noted that Zoom already encrypts call in transit with AES-256-GCM cryptography, but that isn’t truly end-to-end: E2EE ensures only the meeting participants, and no one else, can encrypt and decrypt the video, voice, and other data flowing between them during a confab. Zoom points out that that this encryption won’t work on PTSN phone lines. This also excludes SIP/H.323 commercial conferencing gear.

Earlier this year, Yuan argued that Zoom couldn’t protect free calls with E2EE because to do so would thwart important law enforcement operations.

“Free users, for sure, we don’t want to give that because we also want to work together with FBI, with local law enforcement in case some people use Zoom for a bad purpose,” Yuan told analysts back in April.

In May, Zoom asked for help from digital rights groups who, apparently, told them to stop messing about and give people encrypted calls, law enforcement concerns be damned.

“Since releasing the draft design of Zoom’s end-to-end encryption (E2EE) on May 22, we have engaged with civil liberties organizations, our CISO council, child safety advocates, encryption experts, government representatives, our own users, and others to gather their feedback on this feature,” Yuan said today.

To satisfy the legal issues and requirements, Zoom is asking users to verify their phone numbers by entering a single-use code delivered via text message. “Many leading companies perform similar steps on account creation to reduce the mass creation of abusive accounts,” Yuan said. “We are confident that by implementing risk-based authentication, in combination with our current mix of tools — including our Report a User function — we can continue to prevent and fight abuse.”

Needless to say, Zoom has taken no shortage of heat for its handling of security issues since the coronavirus lockdown made the service a household name and brought the upstart under scrutiny.

In response, Zoom moved to bring in the likes of ex-Yahoo! and Facebook CSO Alex Stamos and Luta Security and its founder Katie Mousourris to get its protections up to snuff.

Source: Zoom will offer proper end-to-end encryption to free vid-chat accounts – not just paid-up bods – once you verify your phone number… • The Register

Steris, Medical Device Maker Threatens iFixit Over Ventilator Repair Project, publishing manuals

Posted on by

A popular website with a comprehensive database of repair manuals for ventilators and other medical devices has received a letter from a medical equipment company saying that its copyrights are being infringed.

Kyle Wiens, CEO of the repair website iFixit—which posts guides on how to repair anything from sewing machines to video game consoles—shared the letter on Twitter Thursday, sent to him by counsel for Steris Corporation, which makes sterilization and other medical equipment.

“It has come to my attention that you have been reproducing certain installation and maintenance manuals relating to our products, documentation which is protected by copyright law,” the letter said. The letter then went on to tell Wiens to remove all Steris copyrighted material from the iFixit website within 10 days of the letter.

As Motherboard reported in March, major manufacturers of medical devices have long made it difficult for their devices to be repaired through third party repair professionals. Manufacturers have often lobbied against right to repair legislation and many medical devices are controlled by artificial “software locks” that allow only those with authorization to make modifications.

As reported by VICE News last week, a repair technician contracted to repair ventilators for hospitals preparing for COVID-19 said he has struggled to get repair parts or manuals from manufacturers when he has made requests to them.

“I’m disappointed that Steris is resorting to legal threats to stop hospitals from having access to information about how to maintain critical sterilization equipment during a pandemic,” Wiens told Motherboard in an email.

Wiens said he got the idea to post service manuals for medical equipment on iFixit when he began seeing stories about ventilator shortages in Italy. When he saw how some people were using 3-D printers to create ventilator replacement valves, he said he was inspired to create the database of medical equipment guides as a way to help.

“No manufacturer should be stopping hospitals from repairing their equipment,” Wiens said. “The best way to ensure patient safety is to make sure that equipment is being maintained regularly using the manufacturer’s recommended procedures. The only way to do that is if hospitals have up to date manuals.”

With regards to the letter sent by Steris, Wiens said iFixit has not removed any material from its website.

“We explained to Steris that what we did is a lawful and protected fair use under the U.S. Copyright act,” Wiens said.

“iFixit is protected by Section 512 of the Digital Millennium Copyright Act, which allows online platforms to host content contributed by users provided they comply with the Act’s requirements, which iFixit does,” a letter to Steris from the Electronic Frontier Foundation on behalf of iFixit said.

Source: A Medical Device Maker Threatens iFixit Over Ventilator Repair Project – VICE