If you work remotely on the web, you’re probably getting comfortable with multiple video chat tools. At Freedom of the Press Foundation, we’ve published a high-level comparison of some common video chat applications, and many others maintain detailed comparison spreadsheets to help you compare dozens of tools. We also wanted to dive deeper into what we know about a few individual tools. This “fact sheet” will detail some security, privacy, usability, and anti-abuse properties of Zoom. In particular, we’re focusing on properties that are critical to high-risk users, like journalists, and developed a series of questions to help examine these properties. In our fact sheets, we’ll be taking a closer look at several tools in common use at media organizations. We can’t possibly cover them all. In addition to Zoom, we’ll examine… Each of these platforms changes regularly, so check back to see our regular updates. And if you see anything wrong, let us know at freedom.press/contact. Threats to press freedom around the world are at an all-time high. Sign up to stay up to date and take action to protect journalists and whistleblowers everywhere. Thanks for signing up for our newsletter. You are not yet subscribed! Please check your email for a message asking you to confirm your subscription. Zoom’s issues with security, privacy, and abuse have been well-documented. Zoom's story is deeply entangled with the COVID-19 pandemic, when millions of users turned to the platform for reliable video calls. Zoom was initially designed to allow anyone to join video calls by default. Because it was so easy to join a call, it was quite easy for unwanted participants to join, sometimes causing havoc. Likewise, their documentation and interface also made misleading claims about the quality of their encryption. In light of widespread scrutiny from the security community, they have made significant improvements on the security, privacy, and abuse issues on their platform. Zoom now provides a number of controls to help users manage who is allowed into a video call. The company now provides a single prominent icon in the video’s toolbar to easily manage security settings, where users can lock the meeting, preventing new users from entering; enable or disable a “waiting room” where meeting hosts can approve who enters; remove participants. Likewise, hosts can restrict participants’ ability to share their screens, chat, rename themselves, or annotate the host’s shared content. They have since rolled out stronger encryption by default, and options for end-to-end encryption, though this must be enabled and all users must have the Zoom client installed. Because they are making so many adjustments, this article will likely change in the weeks to come. Stay tuned. Zoom allows two-factor authentication through standard authenticator apps, such as Google Authenticator or FreeOTP. For now, they do not appear to support standard FIDO2-compliant security keys for two-factor authentication. Zoom uses standard TLS to secure the traffic sent to and from Zoom’s servers. Zoom now supports end-to-end encryption, making significant improvements throughout 2020. In March 2020, The Intercept reported that, despite Zoom’s claims that they supported end-to-end encryption in their documentation, the company later admitted they did not. In a November 2020 complaint, the Federal Trade Commission describes this and other misleading security claims based on reporting from security researchers and the press. However, in October 2020 they later began to offer end-to-end encryption. Zoom also said their chats were encrypted with an AES-256 encryption key, but security researchers have found otherwise. An April 2020 analysis from Citizen Lab suggests their servers distributed a smaller AES-128 key to allow users to encrypt and decrypt the video stream. They also implemented their encryption with ECB mode, an encryption scheme that introduced serious weaknesses that could compromise the privacy of users’ video calls. They have since addressed this; in May 2020 they began to roll out standard AES-256 GCM to encrypt video calls. At the time, even if all participants were outside of China, the Zoom server could still distribute the keys to encrypt and decrypt video calls to servers in China, where the company has a large engineering presence. As Citizen Lab researchers pointed out, “A company primarily catering to North American clients that sometimes distributes encryption keys through servers in China is potentially concerning, given that Zoom may be legally obligated to disclose these keys to authorities in China.” The company has since introduced data routing, allowing paid users to choose regional data centers when using Zoom.