In connection with the massive transition to remote work, the application for video conferencing Zoom soared in popularity. But this is not ideal from a security point of view. Although Zoom offers end-to-end encryption for text chats, and video conferencing encryption can be activated on the host side, if you believe the developers of the proprietary program.

But the type of encryption cannot be verified, because the code is closed, and from the point of view of privacy, the Zoom application raises questions from some experts. For example, a host might activate a strange function “Attention tracking” (attention tracking). It tracks that the participant is not distracted from the meeting for more than 30 seconds (the application window should be open and active).

Of course, users found a way out of the situation. For example, you can launch the active Zoom window on a smartphone or tablet, and at this time work quietly on a computer or laptop, or vice versa.

So put Zoom on your iPhone / iPad and use your computer to look at Twitter, or vice versa. Simple

– Tim Green (@timdgreen) March 12, 2020

The official is suspicious privacy policy Zoom, in which the company warns about collecting a large amount of personal data on users:

name;
physical adress;
mailing address;
phone numbers;
place of work and position;
Facebook profile information
computer or smartphone specifications;
IP address
“Information that you download, provide or create while using the service.”

Moreover, the document says almost nothing why this information is collected and how it is used. The company cannot even directly answer the question “Do you sell this information?”

Electronic Privacy Information Center (EPIC) last year warnedthat “Zoom is intentionally designed to bypass browser security settings and remotely turn on a user’s webcam without his knowledge or consent”

In July 2019, security experts were surprised to learn that after installing and uninstalling the Zoom client on localhost active web server remains, which can independently reinstall Zoom without user intervention.

Of course, the company tried to quickly fix this bug (which was actually a feature) and apologize to the public, but Zoom’s attitude to privacy has not changed.

In March 2020, it turned out that the Zoom application for iOS sends data to Facebook even if you don’t have a Facebook account. An analysis of network activity showed that the application connects to the Facebook Graph API, sends there information about the application’s opening, data on the user’s device (model, time zone, city, telecom operator) and a unique advertising id, which is generated on the device for profiling and tracking the user in order to target ads.

Facebook doesn’t say anything about sending data to Facebook. The company’s management assures that this happened by accident: “Zoom takes the privacy of its users very seriously,” it said official statement. “We initially implemented the Facebook login feature to provide our users with another convenient way to access our platform.” However, we recently learned that the Facebook SDK collects unnecessary data from devices. In the coming days, the Facebook SDK will be removed. For the changes to take effect, they will need to upgrade to the latest version of the application, and we recommend that they do so. We sincerely apologize for this oversight and remain firmly committed to protecting the data of our users. ”

At the same time, Consumer Reports magazine is printing tips on how to protect yourself from intrusive surveillance by Zoom, and experts require the company change official privacy policy.

Jitsi meet

Fortunately, Zoom is not the only option for video conferencing. There is also Facetime (only for Mac and iOS), WhatsApp (owned by Facebook), Wire (no free version), Google Meet (no end-to-end encryption, requires a Google account), Skype Meet, Cisco Webex, StarLeaf, Nextcloud Talk and others.

Finally, there is a free, fully functional and open source program Jitsi meet. To use it, you do not need to register an account, and the program itself works in a browser.

Some functions:

Up to 75 participants (up to 35 while maintaining high quality communications)
Public and private chats
Blurring the background behind the person (function in beta so far)
Integration with Slack, Google Calendar, and Office 365

Users can share their desktop or give presentations. If you want to give public lectures, you can broadcast the video conference on YouTube. Conversely, you can watch YouTube videos all together in a Jitsi chat. Documents can be co-edited in EtherpadThere is also a connection for those who want to get through the phone.

Conference participants have the opportunity to virtually raise their hand using their own button – to signal that you want to get the word next. There is a built-in chat for text messaging, as well as a recording function for the current discussion.

Technically advanced users can raise their own server Jitsu videobridge, which processes in real time thousands of video streams via WebRTC. This option may be suitable for companies that do not want to give traffic outside and can organize video conferences themselves.

useful links

Jitsi Meet Public Servers
Linux Jitsi Installation Guide
Install Jitsi Meet on the Raspberry Pi 3
Jitsi Community Forums
Jitsi repository on github

Note. The Jitsi web client is currently having minor problems working with Firefox because this browser doesn’t support simulcast very well (simultaneous broadcasting to several nodes). As a result, if a user joins the conference on Firefox, all the others have a sharp increase in CPU load and battery consumption. Mozilla promises to rectify the situation in the near future.