Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Data Protection

Zoom Will Offer End-to-End Encryption to Free Users

Zoom announced on Wednesday that it has decided to offer end-to-end encryption to free users after all, as long as they verify their account by providing an additional piece of information, such as a phone number.

Zoom announced on Wednesday that it has decided to offer end-to-end encryption to free users after all, as long as they verify their account by providing an additional piece of information, such as a phone number.

Zoom said earlier this month that only paying customers and schools would benefit from its upcoming end-to-end encryption feature, arguing that free users are more likely to commit abuse and the company wants to be able to assist law enforcement investigations.

Following the announcement, Mozilla, the Electronic Frontier Foundation (EFF) and many others called on Zoom to reverse its decision and offer end-to-end encryption to everyone. Mozilla and EFF noted that Zoom would be denying privacy protections to users who may need them the most, such as activists, and urged the company to find better alternatives to prevent potential misuse of its platform.Zoom will offer end-to-end encryption to all users

Zoom said on Wednesday that based on the feedback it received it has found a way to offer end-to-end encryption to all users as an advanced add-on feature — end-to-end encryption will be opt-in as it’s incompatible with some meeting features — while still being able to prevent and fight abuse.

“To make this possible, Free/Basic users seeking access to E2EE will participate in a one-time process that will prompt the user for additional pieces of information, such as verifying a phone number via a text message,” Zoom CEO Eric Yuan announced in a blog post. “Many leading companies perform similar steps on account creation to reduce the mass creation of abusive accounts. We are confident that by implementing risk-based authentication, in combination with our current mix of tools — including our Report a User function — we can continue to prevent and fight abuse.”

Mozilla and EFF applauded the decision and urged other companies like Slack, Microsoft and Cisco to follow suit.

Zoom recently published a draft of its end-to-end encryption design and it has asked users, government representatives, encryption experts, child safety advocates, civil liberties organizations and its CISO council for feedback. The design of the new feature has been updated based on this feedback and the company plans on rolling out an early beta in July.

Related: Trojanized Zoom Apps Target Remote Workers

Related: Zoom Agrees to Step Up Security After New York Probe

Related: Zoom Credentials Database Available on Dark Web

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.

Register

Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.

Register

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Management & Strategy

SecurityWeek examines how a layoff-induced influx of experienced professionals into the job seeker market is affecting or might affect, the skills gap and recruitment...

Data Protection

The CRYSTALS-Kyber public-key encryption and key encapsulation mechanism recommended by NIST for post-quantum cryptography has been broken using AI combined with side channel attacks.

Data Protection

The cryptopocalypse is the point at which quantum computing becomes powerful enough to use Shor’s algorithm to crack PKI encryption.

Funding/M&A

Twenty-one cybersecurity-related M&A deals were announced in December 2022.

Management & Strategy

Industry professionals comment on the recent disruption of the Hive ransomware operation and its hacking by law enforcement.

Identity & Access

Zero trust is not a replacement for identity and access management (IAM), but is the extension of IAM principles from people to everyone and...

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...