Am I crazy here or did Ajit Pal make an excuse that the FCC couldn't make mandatory laws and regulations when they were asked to mandate broadband speeds and Net Neutrality? Or is it now that they want to modify CDA 230 suddenly it's okay?

June 2010:
The U.S. Court of Appeals ruled that the FCC has no powers to regulate any Internet provider's network, or the management of its practices: "[the FCC] 'has failed to tie its assertion' of regulatory authority to an actual law enacted by Congress", and in June 2010, it overturned (in the same case) the FCC's Order ....

Because when Zoom gets a subpoena, they want to be able to turn over your information to Law Enforcement. It's as simple as that.

And I guarantee you that the E2EE has an escrowed key that Zoom has access to.

I would not trust their encryption. For starters, your client does not control the key. Zoom controls the key. In true E2EE, the moderator would generate the key at the start of the meeting, and the key would not be held by zoom.

From their whitepaper:
https://github.com/zoom/zoom-e2e-whitepaper/blob/master/zoom_e2e.pdf

"When a Zoom client gains entry to a Zoom meeting, it gets a 256-bit per-meeting
key created by Zoom’s servers, which retain the key to distribute it to participants as they
join. In the version of Zoom’s meeting encryption protocol released on May 30, 2020, this
per-meeting key is used to derive a per-stream key by combining the per-meeting key with
a non-secret stream ID using an HMAC function. Each stream key is used to encrypt
audio/video (UDP) packets using AES in GCM mode, with each client emitting one or
more uniquely-identified streams. "

So, this is a bit useless.

They even admit it.

"This current design provides confidentiality and authenticity for all Zoom data streams,
but it does not provide “true” end-to-end (E2E) encryption as understood by security
experts due to the lack of end-to-end key management."

Additionally: "Free/Basic users seeking access to E2EE will participate in a one-time process that will prompt the user for additional pieces of information, such as verifying a phone number via a text message. "

This isn't for anti-abuse. It's to have something to give to LEO (Law Enforcement.)

There's so many weasel words in that press release it blows the mind.

"This will enable us to offer E2EE (end-to-end encryption) as an advanced add-on feature for all of our users around the globe "

And why is it not on by default? Why?

Unless it was really poorly configured (completely possible), you're not supposed to be able to extract "master" keys from an HSM.

The article, sadly indicates: " It was compromised “after being stored in clear text on one laptop (at a minimum) and remains compromised to the present day,” the report said."

The previous comment was right, stupid knows no bounds.

This is exactly the sort of attack that Hardware Security Modules are designed to stop.

You'd have to steal the box -and- have multiple users sign off on any cryptographic operations before they would be allowed to encrypt with this key. Additionally, you wouldn't be able to extract the Key at all.

Automated abuse of the DMCA system and as you've said, shotgunning the system, is why this isn't working.

You keep crying wolf enough times and the providers will delay and ignore you.

Also, making the system work faster or "proactively" would be an affront to due process offered by DMCA counter notices. They can't have it both ways.

Doesn't this proposal centralize vs de-centralize the Internet?

I give this a resounding 'hell no'. Operators everywhere should refuse to route this traffic.

This should be handled as U2F and FIDO was handled. There shouldn't be a new company for this.

Adoption of this should be standards based and should be a cooperative effort across the industry.
(Also this sure feels like reinventing FIDO/FIDO2 for profit.)

Also, once your certificate is stolen, unless it's strongly encrypted (which, what's that? You need a password and PIN for) you're hosed. I'd really rather have a Yubikey.

I nearly misread that as "he was there for the opening hour of the plant." Showing up when the place opens and opening the plant are two different things ;)

Nope.

Computers will follow programmed Chinese walls. Traders will behave unethically / illegally whenever it suits them.

Caesars palace does not have such locks. Additionally they made you sign a document saying they could come in the room at any time without notice.

People saying this was done without consent didnâ(TM)t read what they signed at check in.

I donâ(TM)t agree with it but there was notice.

Are any of those any good? I have the whole manual setup right now and the results are stunning, but curious if any of the automatic ones are actually good espresso machines.

Nightmare scenario for traders, benefit for everyone else. The AI likely would have Chinese walls built into them to prevent collusion and insider trading. I for one look forward to my innately honest (and auditable/examinable) AI masters