Yeah. The problem here is that Zoom lied about it.
And, like, why? Sure, if no one ever caught them, e2e could be a reason to choose Zoom—but it's like lying on a resumé. Which, I guess is also a thing that happens sometimes, but it's generally understood to be a bad idea.
Because it was clearly botched marketing material rather than a coordinated plan. Hypothetical: somebody asked an engineer what kind of encryption Zoom used, the engineer responded somewhat vaguely and the marketing person heard "we encrypt between endpoints" as "end to end encryption" and then nobody noticed when reviewing the text.
Ooops. That sounds like it's going to hurt. If not, it sends the message "Hey, say you're HIPAA compliant, but it doesn't matter if you're not (wink wink)"
I develop electronics and firmware for medical devices, I have (almost) nothing to do with regulations compliance (except to the extent that I'm working on something where there is an intersection, like storage of patient data). But anyway, not a day goes by that I don't hear someone ask, "Is that HIPAA compliant?"
So yeah. Companies that have used Zoom based on that claim are probably going to extract some blood out of Zoom.
The odd thing is that EARN-IT pushers want to ban strong encryption "for the children" but they want to excoriate Zoom over weak encryption "for the children".
