Not OK, Zoomer: Here's Why You Hate Videoconference Meetings -- And What To Do About It

from the fighting-fatigue dept

With much of the world in various states of lockdown, the videoconference meeting has become a routine part of many people's day, and a hated one. A fascinating paper by Jeremy Bailenson, director of Stanford University's Virtual Human Interaction Lab, suggests that there are specific problems with videoconference meetings that have led to what has been called "Zoom fatigue", although the issues are not limited to that platform. Bailenson believes this is caused by "nonverbal overload", present in at least four different forms. The first involves eye gaze at a close distance:

On Zoom, behavior ordinarily reserved for close relationships -- such as long stretches of direct eye gaze and faces seen close up -- has suddenly become the way we interact with casual acquaintances, coworkers, and even strangers.

There are two aspects here. One is the size of the face on the screen, and the other is the amount of time a person is seeing a front-on view of another person's face with eye contact. Bailenson points out that in another setting where there is a similar problem -- an elevator -- people typically look down or avert their glance in order to minimize eye contact with others. That's not so easy with videoconferencing, where looking away suggests lack of attention or loss of interest. Another problem with Zoom and other platforms is that people need to send extra nonverbal cues:

Users are forced to consciously monitor nonverbal behavior and to send cues to others that are intentionally generated. Examples include centering oneself in the camera's field of view, nodding in an exaggerated way for a few extra seconds to signal agreement, or looking directly into the camera (as opposed to the faces on the screen) to try and make direct eye contact when speaking.

According to Bailenson, research shows people speak 15% louder on videoconference calls compared to face-to-face interaction. Over a day, this extra effort mounts up. Also problematic is that it's hard to read people's head and eye movements -- important for in-person communication -- in a video call. Often they are looking at something that has popped up on their screen, or to the side, and it may be unclear whether the movement is a nonverbal signal about the conversation that is taking place. Another oddity of Zoom meetings is that participants generally see themselves for hours on end -- an unnatural and unnerving experience:

Imagine in the physical workplace, for the entirety of an 8-hr workday, an assistant followed you around with a handheld mirror, and for every single task you did and every conversation you had, they made sure you could see your own face in that mirror. This sounds ridiculous, but in essence this is what happens on Zoom calls. Even though one can change the settings to "hide self view," the default is that we see our own real-time camera feed, and we stare at ourselves throughout hours of meetings per day.

Finally, Bailenson notes that the design of cameras used for videoconferencing means that people tend to remain within a fairly tight physical space (the camera's "frustrum"):

because many Zoom calls are done via computer, people tend to stay close enough to reach the keyboard, which typically means their faces are between a half-meter and a meter away from the camera (assuming the camera is embedded in the laptop or on top of the monitor). Even in situations where one is not tied to the keyboard, the cultural norms are to stay centered within the camera's view frustrum and to keep one's face large enough for others to see. In essence users are stuck in a very small physical cone, and most of the time this equates to sitting down and staring straight ahead.

That's sub-optimal, because in face-to-face meetings, people move around: "they pace, stand up, stretch, doodle on a notepad, get up to use a chalkboard, even walk over to the water cooler to refill their glass", as Bailenson writes. That's important because studies show that movements help create good meetings. The narrow physical cone that most people inhabit during videoconferences is not just tiring, but reduces efficiency.

The good news is that once you analyze what the problems are with Zoom and other platforms, it's quite straightforward to tweak the software to deal with them:

For example, the default setting should be hiding the self-window instead of showing it, or at least hiding it automatically after a few seconds once users know they are framed properly. Likewise, there can simply be a limit to how large Zoom displays any given head; this problem is simple technologically given they have already figured out how to detect the outline of the head with the virtual background feature.

Other problems can be solved by changing the hardware and office culture. For example, using an external webcam and external keyboard allows more flexibility and control over various seating arrangements. It might help to make audio-only Zoom meetings the default, or to use the old-fashioned telephone as an alternative to wall-to-wall videoconferencing. Exploring these changes is particularly important since it seems likely that working from home will remain an option or perhaps a requirement for many people, even after the current pandemic is brought under control. Now would be a good time to fight the fatigue it so often engenders.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: video conferencing, zoom fatique
Companies: zoom

Comcast Expands Its Bullshit Usage Caps...In The Middle Of A Pandemic

from the read-the-room dept

Contrary to what some try to claim, broadband usage caps have always been bullshit. They serve absolutely no technical function, do not help manage congestion, and exist exclusively to nickel-and-dime captive customers in monopolized U.S. markets. Worse, they can be used by incumbent ISPs anticompetitively to hamstring competitors in the streaming video and other markets.

Comcast, for years, has been slowly expanding these unnecessary and costly restrictions in line with the frog in the boiling pot fable (you're the frog, unless that wasn't clear). The only area the company hadn't yet deployed the restrictions was in the northeast, largely due to the added competition Comcast sees in the area from uncapped Verizon FiOS. Apparently Comcast has gotten tired of waiting, so they've announced that they've implemented a new 1.2 terabyte cap across the Northeast, which will be fully implemented by March:

"...effective March 1st, residential customers will begin facing overlimit fees for exceeding their data allowance at a rate of $10 for each 50 GB of excess usage, up to a maximum of $100 a month. Customers will not be credited for unused data, cannot rollover unused data, or be charged less than $10 in overlimit fees, regardless if one used 1 MB or 49 GB over the 1.2 TB allowance.

Customers approaching their usage limit will receive email, text messages, and Xfinity X1 on-screen notifications upon reaching 75% (email only), 90%, and 100% of 1.2 TB of data usage. Overlimit fees that subsequently start accumulating will be noted in email and X1 on-screen notifications for each additional 50 GB of usage over 1.2 TB, up to the maximum overage charge of $100."

Folks will quickly (as usual) get caught up in a discussion about how 1 terabyte a month is "fair," ignoring, again, that these restrictions serve no purpose outside of jacking up U.S. broadband bills, which, even under flat-rate pricing, are some of the most expensive in the developed world thanks to monopolization and corrupt state and federal regulators. The industry doesn't even try to pretend that such restrictions "help manage congestion" (they do not). Nor do they help manage "heavy users," which can already be shoved toward more expensive business-class tiers when needed.

It's not a great look for Comcast during a pandemic when broadband is essential and countless Americans are already struggling to pay their bills. Comcast must have done the calculus and figured the outrage will likely be muted enough to prevent any meaningful backlash. After all, unless you live in a Verizon FiOS market in the Northeast, most of these users don't have any competing ISPs to flock to. And historically, neither party has much cared that entrenched monopolies routinely rip off American consumers with costly and confusing restrictions that serve no purpose outside of jacking up already high monthly bills.

With neither competition nor adult regulatory oversight to keep Comcast in check, who is going to do anything about it?

Filed Under: broadband, competition, covid-19, data caps, pandemic, streaming, usage caps, video conferencing
Companies: comcast

Zoom Gets An FTC Wrist Slap For Misleading Users On Security, Encryption

from the not-really-encrypted dept

In many ways, Zoom is an incredible success story. A relative unknown before the pandemic, the company's userbase exploded from 10 million pre-pandemic to 300 million users worldwide as of last April. One problem: like so many modern tech companies, its security and privacy practices weren't up to snuff. Researchers found that the company's "end-to-end encryption" didn't actually exist. The company also came under fire for features that let employers track employees' attention levels, and for sharing data with Facebook that wasn't revealed in the company's privacy policies.

While the company has taken great strides to improve most of these problems, the company received a bit of a wrist slap by the FTC this week for misleading marketing and "a series of deceptive and unfair practices that undermined the security of its users." A settlement (pdf) and related announcement make it clear that the company repeatedly misled consumers with its marketing, particularly on the issue of end-to-end encryption:

"In reality, Zoom maintained the cryptographic keys that could allow Zoom to access the content of its customers’ meetings, and secured its Zoom Meetings, in part, with a lower level of encryption than promised. Zoom’s misleading claims gave users a false sense of security, especially for those who used the company’s platform to discuss sensitive topics such as health and financial information.

The FTC also criticized Zoom for storing some meeting recordings unencrypted in the cloud for up to two months, despite marketing claims that meetings would be encrypted immediately following session completion. The agency also criticized Zoom for bypassing Safari malware detection when it installed ZoomOpener web server software as part of a Mac desktop application update in July 2018:

"Without the ZoomOpener web server, the Safari browser would have provided users with a warning box, prior to launching the Zoom app, that asked users if they wanted to launch the app. The complaint alleges that Zoom did not implement any offsetting measures to protect users’ security, and increased users’ risk of remote video surveillance by strangers. The software remained on users’ computers even after they deleted the Zoom app, and would automatically reinstall the Zoom app—without any user action—in certain circumstances."

The settlement itself isn't much of one. As part of it, Zoom simply has to "establish and implement a comprehensive security program" and adhere to "a prohibition on privacy and security misrepresentations," stuff the company insists it has already done. The settlement doesn't come with any meaningful financial penalties or consumer compensation of any kind, resulting in some dissenting Democratic Commissioners (like commissioner Rebecca Kelly Slaughter) arguing it wasn't really much of a settlement at all:

"Zoom is not required to offer redress, refunds, or even notice to its customers that material claims regarding the security of its services were false. This failure of the proposed settlement does a disservice to Zoom’s customers, and substantially limits the deterrence value of the case."

Again, Zoom should be applauded for the fact that the company has taken many concrete steps to improve things sense reports first surfaced that its privacy and security standards weren't up to snuff. But it's not clear that the FTC, arriving late to the party and "requiring" the company do a bunch of things it had already accomplished, really acts as much of a deterrent for the long line of companies that phone in their privacy and security standards. Especially when most of them get far less (if any) attention for similar behavior, in part because the FTC routinely lacks the resources to seriously police privacy at any real scale.

Filed Under: end-to-end encryption, false advertising, ftc, video conferencing
Companies: zoom

Teleconferencing Company Zoom Pitching End-To-End Encryption That Really Isn't End-To-End

from the some-sort-of-magic-happens-at-both-ends-so-probably-good-enough dept

As Karl Bode wrote what feels like a decade ago on March 19, 2020, privacy and encryption will be more important than ever during this pandemic and the future that succeeds it. Plenty of governments have been sacrificing citizens' privacy for better virus tracking and plenty of governments were already throwing shade at encryption well before the pandemic became a pandemic. That includes our government, which has been agitating against encryption for several years now and fighting against our privacy in federal courts for decades.

An influx of remote workers makes encryption and privacy even more important, as there's plenty of sensitive company business being done over open networks with minimal protections. The beneficiaries of this new normal are responding quickly to the unexpected demand, but protection of work-at-home employees and their employers seems to have been forgotten.

The field is crowded with lots of telecommuting software providers. Standing out is key if you're going to take advantage of the current health crisis. Video conference software developer Zoom, however, is playing fast and loose with terminology in an attempt to scoop up more market share. As Micah Lee and Yael Grauer report for The Intercept, words don't seem to mean what they normally mean when they're being used by Zoom.

Zoom offers reliability, ease of use, and at least one very important security assurance: As long as you make sure everyone in a Zoom meeting connects using “computer audio” instead of calling in on a phone, the meeting is secured with end-to-end encryption, at least according to Zoom’s website, its security white paper, and the user interface within the app.

Sounds comforting, but Zoom is apparently using a proprietary definition of "end-to-end encryption." Zoom explained that phrase means something else when used in marketing materials or when users hover over the green padlock on their session screens that delivers a pop-up saying "Zoom is using an end to end encrypted connection."

This is what "E2EE" means when Zoom says it:

[W]hen reached for comment about whether video meetings are actually end-to-end encrypted, a Zoom spokesperson wrote, “Currently, it is not possible to enable E2E encryption for Zoom video meetings. Zoom video meetings use a combination of TCP and UDP. TCP connections are made using TLS and UDP connections are encrypted with AES using a key negotiated over a TLS connection.”

Well, if it's not possible to do the thing people think you're doing when you say "end to end encryption," maybe you should stop saying you're using end-to-end encryption. All Zoom is doing is encrypting the endpoints, much in the way sites using HTTPS do. This protects you from outsiders wishing to eavesdrop on your internet connection. But it doesn't mean Zoom can't access the content of teleconferencing sessions. And it means anyone that can find a way to access what Zoom can access is going to be able to do access possibly-sensitive communications.

One offering is actually encrypted end-to-end: Zoom's text chat. But that's not a standout feature. There are plenty of encrypted messaging apps. There's been no increase in demand for those. But when privacy and security matter most, Zoom is misleading users about what it's doing to protect them.

Update: Zoom has since put out two fairly detailed blog posts, the first one much more clearly explaining the encryption issue, and then a more important one explaining what the company is doing to respond to recent security concerns, including freezing all feature development to focus solely on "trust, safety, and privacy issues." It remains to be seen how that plays out in practice, but it's much better than the typical defensive response that most companies have.

Filed Under: encryption, end-to-end, privacy, security, video conferencing
Companies: zoom

NSA Tapping UN Isn't A Huge Surprise -- But Ability To Crack Video Conferencing Encryption Raises Questions

from the yay! dept

Over the weekend, Der Spiegel broke the somewhat unsurprising news that the NSA had bugged the UN and various EU embassies in the US and had hacked into the UN's videoconferencing software to be able to get access to such calls. On a first pass, this isn't all that surprising. As we noted with some earlier leaks, spying on foreign diplomats is just something that countries do. Spying on foreign government officials is very different than spying on the public. Of course, since the NSA insists that it does everything to avoid intercepting communications of people inside the US, I wondered how they could make that claim while directly tapping conference calls from the UN in NY. The answer is likely to be yet another classic NSA twisting of the words to find a loophole. While the UN headquarters are in NYC, "technically" the headquarters are outside of the US and in the control of the UN itself, but with an agreement that it abides by all local laws. This is similar to embassies, which are often treated as if they are the territory of the country that uses them. I'm wondering if the NSA is using that to argue these are fair game, since they're "outside" the US.

There's also the issue, as noted in the article, that President Obama has insisted that the spying on people was only done to prevent terrorism -- and spying on EU diplomats seems unlikely to have anything to do with terrorism prevention. But, again, spying between government officials is kind of expected, and not quite a huge deal, even if it may present a diplomatic problem for the US.

Much more interesting to me, however, is the snippet claiming that the NSA had figured out how to hack into the UN's video conferencing software, allowing them to record internal video conferences. In fact, after this was cracked just a year ago, a document was sent around, "celebrating" this:

Furthermore, NSA technicians working for the Blarney program have managed to decrypt the UN's internal video teleconferencing (VTC) system. The combination of this new access to the UN and the cracked encryption code have led to "a dramatic improvement in VTC data quality and (the) ability to decrypt the VTC traffic," the NSA agents noted with great satisfaction: "This traffic is getting us internal UN VTCs (yay!)." Within just under three weeks, the number of decrypted communications increased from 12 to 458.

Yay! We can spy on more things! Yay! Either way, I'm curious if anyone knows who provides the UN's video conferencing technology, because that's now a much more interesting issue. The suggestion being made that the NSA "cracked" the encryption that was being used could have much wider implications if true -- so it would be nice to know what kind of encryption, and what sort of system is being used. Either way, I'm guessing that many in the UN will be seeking out alternative communication methods shortly.

Filed Under: diplomacy, encryption, espionage, eu, nsa, nsa surveillance, spying, un, video conferencing