Zoom agrees to implement more security for video calls under FTC settlement - CNET

Zoom has agreed to ramp up its security.

Angela Lang/CNET

For the most up-to-date news and information about the coronavirus pandemic, visit the WHO website.

Zoom has agreed to implement better security for its video calling platform under a settlement with the US Federal Trade Commission. The company "deceived users" by claiming to had end-to-end 256-bit encryption, the FTC alleged in its complaint.

"In reality, the FTC alleges, Zoom maintained the cryptographic keys that could allow Zoom to access the content of its customers' meetings, and secured its Zoom Meetings, in part, with a lower level of encryption than promised," the FTC said.

For more like this

Subscribe to the CNET Now newsletter for our editors' picks of the most important stories of the day.

It also allegedly stored some recorded meetings unencrypted on its servers for up to 60 days.

Zoom's security issues came to light when working from home became the norm under coronavirus lockdowns and restrictions. According to the FTC, its user base increased from 10 million in December last year to 300 million in April. But with "zoombombings" becoming more frequent, the video meeting company came under pressure to secure users' connections.

"During the pandemic, practically everyone -- families, schools, social groups, businesses -- is using videoconferencing to communicate, making the security of these platforms more critical than ever," Andrew Smith, FTC's director of Consumer Protection, said in a statement. "This action will help to make sure that Zoom meetings and data about Zoom users are protected."

As a result of its issues, Zoom bought a security company in May and rolled out end-to-end encryption for calls last month.  

Read more: How to use Zoom like a pro: 15 video chat tips and tricks to try now

The FTC's complaint also alleged Zoom "secretly installed software" called ZoomOpener, which allowed computers to launch the app without permission from the user. This in turn "increased users' risk of remote video surveillance by strangers," it's alleged.

Zoom didn't admit or deny the allegations in the settlement, but agreed to implement a new mandated information security program within 60 days. It must also use more secure safeguards like multi-factor authentication and data deletion; document potential risks annually and ways to mitigate those risks; and implement a vulnerability management program. The video-calling company also agreed not to make misrepresentations about privacy, security and data usage. Independent security audits are required every other year.

Zoom didn't immediately respond to a request for comment.

from CNET https://ift.tt/35eQXUH
via IFTTT