档案库 · 开发与企业工具 · 市场决策 · 2020
Zoom 2020 年的加密赌注：宣传"端到端"，实际只有 TLS
Zoom 在 2020 年封锁期间蓬勃发展，同时将会议宣传为端到端加密；The Intercept 揭露其仅为 TLS 加密，Zoom 承认了这一点。
Zoom
做的是什么生意
Zoom is the cloud videoconferencing service whose usage spiked as Covid-19 lockdowns sent millions of people to work from home in March 2020; it sells hosted video meetings (plus an on-premises Meeting Connector for larger business customers) and marketed reliability, ease of use and enterprise-grade security.
起因
The story opens at the moment Zoom's bet was paying off: with millions of people newly working from home in March 2020, Zoom's usage spiked, business boomed, and attention swung to its privacy practices - including a policy, later updated, that seemed to allow mining of shared meeting files for ad targeting. Zoom's answer to the scrutiny rested on a security claim: its website, its security white paper, and the desktop app's green padlock ('Zoom is using an end to end encrypted connection') told customers that meetings were end-to-end encrypted.
经过
Asked whether that was true, a Zoom spokesperson conceded: 'Currently, it is not possible to enable E2E encryption for Zoom video meetings.' Meetings were protected by TLS transport encryption - the same technology securing HTTPS - meaning Zoom's own cloud could decrypt and access the video and audio, unlike a Signal-style system where the provider never holds the keys. Only in-meeting text chat was genuinely end-to-end encrypted. Johns Hopkins cryptographer Matthew Green called the framing 'slightly dishonest': group E2E is hard because Zoom's switchboard architecture needs to see who is speaking to route high-resolution streams, although Apple's FaceTime showed it was doable. Former FTC chief technologist Ashkan Soltani said the claims could support a deceptive-trade-practice case - the FTC settled similar SSL deception charges against Fandango and Credit Karma in 2014 - and Access Now's 2020-03-18 open letter pressed Zoom for a transparency report it did not publish.
结果
The admission turned a marketing dispute into a documented gap: The Intercept published the story on 2020-03-31 and it reached the Hacker News front page the same day (1,230 points, 339 comments) at the peak of Zoom's adoption boom. Zoom replied that it takes privacy seriously, blocks employees from directly accessing meeting content, and does not mine or sell user data - but the core concession stood: its video meetings were not end-to-end encrypted as marketed.
背景
Zoom 是云视频会议服务商，在 2020 年 3 月新冠疫情封锁导致数百万人居家办公时，它成为了默认的会议工具。它的赌注是，一个为可靠性和易用性而打造的会议服务，即使没有真正的端到端加密也能赢得这场热潮：只要网站、安全白皮书和应用继续告诉客户会议是"端到端加密"的，传输级 TLS 就足够了。
The Intercept 核查了这些说法：会议在每个客户端和 Zoom 云端之间是加密的，但 Zoom 自身可以解密音频和视频——这是传输加密，不是端到端。一位发言人承认：\"目前，Zoom 视频会议无法启用端到端加密。\" 密码学家 Matthew Green 称这种表述\"有些不诚实\"：需要查看说话者的总机架构使群组端到端加密变得困难，尽管苹果的 FaceTime 证明这是可行的。只有会议中的文本聊天是真正的端到端加密，而且尽管 Access Now 提出了要求，Zoom 并未发布透明度报告。
这篇报道于 2020 年 3 月 31 日发表，同一天登上了 Hacker News 头条——1230 分和 339 条评论——正值 Zoom 疫情热潮的顶峰。Zoom 回应称员工无法直接访问会议内容，也不挖掘或出售用户数据，但核心让步依然存在：视频会议并未像宣传的那样采用端到端加密，这使得 Zoom 面临前 FTC 首席技术专家提出的欺骗性行为质疑，而当时它已成为家喻户晓的名字。
这件事要成立，得有什么
- 可靠性和易用性赢得了热潮，因此安全性变成了一个安心复选框：Zoom 宣传了其架构无法实现的功能，并相信买家不会去核查这一说法。
- 对于必须观察说话者以路由高清视频流的总机设计来说，群组端到端加密确实代价高昂，这使得\"说 E2E，用 TLS\"成为诱人的捷径。
- 热潮招致了核查：数百万新用户和具备密码学专业知识的记者意味着，这一说法会在曝光度最高的时候受到检验。
- Zoom 自己把证据交给了批评者——其发言人承认 E2E 加密\"不可能\"，这使得营销纠纷变成了有据可查、可引用的事实。
可借鉴之处
架构上需要在中间解密的产品，不能把"端到端加密"当作营销卖点：这个短语有固定的技术含义，而审查恰恰会在热潮达到顶峰时到来。
后续进展
截至 2026 年 9 月 6 日，Zoom 仍然是一家上市公司，也仍是远程会议的默认工具，因此 2020 年的事件并未终结这家公司——但它成为了视频会议领域\"安全洗白\"的典型案例：云端持有密钥的服务不能自称端到端加密。Zoom 的撤回声明由其自己的发言人说出，在 2020 年余下的时间里被反复引用，该公司致力于重建信任，后来为会议提供了真正的端到端加密。每当人们讨论加密声明和透明度报告时，这段插曲仍然会被提起。
资料来源
- Zoom meetings aren't end-to-end encrypted, despite marketing
- Zoom meetings aren't end-to-end encrypted, despite marketing
发现哪里写错了？告诉我们。
轮到你了
你刚读完一家。说说你在做什么，看看谁在赌同一件事。
免费账号 · 3 次免费提问 · 不用绑卡