7 ms·

Shitting on zoom in your headline appears to be this week's low latency path to more clicks, no matter how contrived the claim is.

by luma 7y ago

deleted 7y ago
[deleted]
ghostpepper 7y ago
Criticize him for irresponsible disclosure maybe, but is it wrong to say that an unpatched local privilege escalation is a zero day?
- DyslexicAtheist 7y ago
  judging from their past behavior towards security researchers they have done nothing that deserves responsible disclosure. responsible disclosure starts with responsible QA by the vendor.
BoysenberryPi 7y ago
I'm typically very out of the loop on things but is there any particular reason HN seems to be hell bent on shitting on Zoom this week. Don't recall seeing this much vitriol for a particular product in a while.
- TallGuyShort 7y ago
  With more and more of the world, and especially Silicon Valley, being locked-down and quarantined, video conferencing is obviously going through the roof and Zoom seems to be winning. It's just getting a lot of attention, and any flaws are suddenly more impactful.
  - neltnerb 7y ago
    On the one hand, all the attention (if pride is removed from the equation) should be win-win since remote workers might end up less spied on or hacked and zoom still makes a huge profit.
    - DyslexicAtheist 7y ago
      if the best predictor of the future is past behavior then it doesn't look good.
      - neltnerb 7y ago
        But in answer to "why is HN shitting all over Zoom", I think the answer is "because they aren't doing good enough". There's no malice there (on the posters' side). If Zoom does better people won't have cause for shining a flashlight on their data privacy policies or security holes. We will see if Zoom grows up fast, since the momentum towards them is already so large I don't see it changing prior to the Fall when schools might risk re-evaluating their tools.
- remcob 7y ago
  Due to quarantine remote working, a lot of people are obliged to use Zoom. To some Zoom has a reputation of not taking security seriously, so they feel forced to compromise the security of their computers. Personally I think this reputation is justified. You can access Zoom meetings through a pure web interface without installing anything. The experience is somewhat reduced.
  - zeeZ 7y ago
    And to get to the pure web interface you'll have to either know the magic URL or fight some more dark patterns, because they really want you to install their software.
- andrepd 7y ago
  Zoom has plenty to be shat on about, if anything I find most commenters on hn defending it (at least it "just works", etc).
- izacus 7y ago
  Probably everyone got bored from constant Google bashing so it's time to do something else before going back.
- obmelvin 7y ago
  I'm sure there are other reasons, but three understandable reasons I've seen: 1) The lack of e2e encryption despite trying to market themselves as having secure video chat. 2) https://news.ycombinator.com/item?id=22749805 https://news.ycombinator.com/item?id=22749805 (comment in this thread - they literally phish you) 3) https://twitter.com/c1truz_/status/1244737672930824193 https://twitter.com/c1truz_/status/1244737672930824193 abusing the traditional installation process on OSX EDIT: OK (2) may be a real system prompt - https://twitter.com/DigitalResist0r/status/1245281378293280768 https://twitter.com/DigitalResist0r/status/12452813782932807...? I didn't see anyone else in the twitter thread claim that it was using a real system dialog, so I'd still say it was poor practice of them to have such a shady looking system dialog.
kristiandupont 7y ago
I am very weary of angry mobs but I have to say that it looks to me like Zoom needs to be called out on some of these practices. Personally, the fact that I filled out what turns out to not be a system dialog with my password (https://twitter.com/raganwald/status/1244994636982222848 https://twitter.com/raganwald/status/1244994636982222848) makes me feel violated.
- andybak 7y ago
  Wow. They literally just phished me. I was distracted while installing Zoom and didn't look too carefully. I'm genuinely quite angry about this. I never enter passwords into 3rd party apps - I've had arguments with companies who embed oAuth flows into their app about this.
  - saagarjha 7y ago
    If it’s any consolation, they didn’t get your password.
    - DenisM 7y ago
      How so?
    - obmelvin 7y ago
      Excuse my ignorance here, then what is the purpose of the fake system dialog?
      - tprynn 7y ago
        It's a real system dialog popped by the OS when the install script requests superuser privileges. It's not fake, and the password goes to the OS, not the script.
        finnh 7y ago
        Why is it ungrammatical then? (serious question, i take that as a sign that it is not a real OS dialogue)
gortok 7y ago
It's especially relevant to me and my family; as the room-moms in my children's classrooms want to use Zoom to set up playdates so the kids from the classroom can interact, since they really miss each other (and don't get to see each other otherwise). None of this is contrived; and all of it is serious when you're the parent of a school age child.
- Talanes 7y ago
  And you're worried that your child will use this exploit to gain root access to your system?
CivBase 7y ago
Is this contrived? The security risk may be overstated in the headline, but it definitely seems like a problem. Regarding the hatred for Zoom... I'm sure a lot of people feel the same as me. I'm tired of having to install and trust yet another native app just to perform a task I've been able to easily do with countless other solutions for well over a decade. I understand why Zoom in particular has found recent success, but it's still annoying. Zoom's recent surge in popularity also probably draws a lot of attention from cynics and skeptics.
draw_down 7y ago
Come on.
nilkn 7y ago
My first experience with Zoom was the installer opening, telling me it was going to perform a pre-install check to see if the software could be installed, then immediately closing without explanation. It turns out it installed everything immediately without even telling me. This immediately set off alarm bells and made it feel like it was malware.
- hota_mazi 7y ago
  It's actually using this deceptive phrasing to install (literally, copy) all its files directly into /Applications instead of going through the standard Mac OS install flow.
joshstrange 7y ago
Shitting on people pointing out concerns with/exploits in zoom appears to be this week's low latency path to more upvotes no matter how serious the claim is. Every zoom post I've read here has at least one highly-upvoted comment about "hey everyone lay off zoom". Why? Why should we give a company that millions are now using for the first time a break? Why should we ignore issues with software that tons of people are now using and potentially opening themselves up to danger? I use zoom, I used to before the pandemic and I've used it with friends since multiple times. I'm not some anti-zoom, burn it all down type. That said I think issues with it warrant a discussion and there is a reason these things are upvoted: because millions of people are now using it and are unaware of the risk they are taking.
- InfoSecJoe 7y ago
  I wonder if many even read the article. I wouldn't shit on the fact that there are vulnerabilities but if I score these . However, telling people "if you care about your security and privacy, perhaps stop using Zoom” is a wee bit hyperbolic. When I score these using CVSS 3 I come up with a Medium vulnerability. Here's the vector string for the first vuln that I scored 6.5- CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
deleted 7y ago
[deleted]

Shitting on zoom in your headline appears to be this week's low latency path to more clicks, no matter how contrived the claim is.

by luma 7y ago

Shitting on zoom in your headline appears to be this week's low latency path to more clicks, no matter how contrived the claim is.

deleted 7y ago

[deleted]

ghostpepper 7y ago

Criticize him for irresponsible disclosure maybe, but is it wrong to say that an unpatched local privilege escalation is a zero day?

DyslexicAtheist 7y ago
judging from their past behavior towards security researchers they have done nothing that deserves responsible disclosure. responsible disclosure starts with responsible QA by the vendor.

BoysenberryPi 7y ago

I'm typically very out of the loop on things but is there any particular reason HN seems to be hell bent on shitting on Zoom this week. Don't recall seeing this much vitriol for a particular product in a while.

TallGuyShort 7y ago
With more and more of the world, and especially Silicon Valley, being locked-down and quarantined, video conferencing is obviously going through the roof and Zoom seems to be winning. It's just getting a lot of attention, and any flaws are suddenly more impactful.
- neltnerb 7y ago
  On the one hand, all the attention (if pride is removed from the equation) should be win-win since remote workers might end up less spied on or hacked and zoom still makes a huge profit.
  - DyslexicAtheist 7y ago
    if the best predictor of the future is past behavior then it doesn't look good.
    - neltnerb 7y ago
      But in answer to "why is HN shitting all over Zoom", I think the answer is "because they aren't doing good enough". There's no malice there (on the posters' side). If Zoom does better people won't have cause for shining a flashlight on their data privacy policies or security holes. We will see if Zoom grows up fast, since the momentum towards them is already so large I don't see it changing prior to the Fall when schools might risk re-evaluating their tools.
remcob 7y ago
Due to quarantine remote working, a lot of people are obliged to use Zoom. To some Zoom has a reputation of not taking security seriously, so they feel forced to compromise the security of their computers. Personally I think this reputation is justified. You can access Zoom meetings through a pure web interface without installing anything. The experience is somewhat reduced.
- zeeZ 7y ago
  And to get to the pure web interface you'll have to either know the magic URL or fight some more dark patterns, because they really want you to install their software.
andrepd 7y ago
Zoom has plenty to be shat on about, if anything I find most commenters on hn defending it (at least it "just works", etc).
izacus 7y ago
Probably everyone got bored from constant Google bashing so it's time to do something else before going back.
obmelvin 7y ago
I'm sure there are other reasons, but three understandable reasons I've seen: 1) The lack of e2e encryption despite trying to market themselves as having secure video chat. 2) https://news.ycombinator.com/item?id=22749805 https://news.ycombinator.com/item?id=22749805 (comment in this thread - they literally phish you) 3) https://twitter.com/c1truz_/status/1244737672930824193 https://twitter.com/c1truz_/status/1244737672930824193 abusing the traditional installation process on OSX EDIT: OK (2) may be a real system prompt - https://twitter.com/DigitalResist0r/status/1245281378293280768 https://twitter.com/DigitalResist0r/status/12452813782932807...? I didn't see anyone else in the twitter thread claim that it was using a real system dialog, so I'd still say it was poor practice of them to have such a shady looking system dialog.

kristiandupont 7y ago

I am very weary of angry mobs but I have to say that it looks to me like Zoom needs to be called out on some of these practices. Personally, the fact that I filled out what turns out to not be a system dialog with my password (https://twitter.com/raganwald/status/1244994636982222848 https://twitter.com/raganwald/status/1244994636982222848) makes me feel violated.

andybak 7y ago
Wow. They literally just phished me. I was distracted while installing Zoom and didn't look too carefully. I'm genuinely quite angry about this. I never enter passwords into 3rd party apps - I've had arguments with companies who embed oAuth flows into their app about this.
- saagarjha 7y ago
  If it’s any consolation, they didn’t get your password.
  - DenisM 7y ago
    How so?
  - obmelvin 7y ago
    Excuse my ignorance here, then what is the purpose of the fake system dialog?
    - tprynn 7y ago
      It's a real system dialog popped by the OS when the install script requests superuser privileges. It's not fake, and the password goes to the OS, not the script.
      - finnh 7y ago
        Why is it ungrammatical then? (serious question, i take that as a sign that it is not a real OS dialogue)

gortok 7y ago

It's especially relevant to me and my family; as the room-moms in my children's classrooms want to use Zoom to set up playdates so the kids from the classroom can interact, since they really miss each other (and don't get to see each other otherwise). None of this is contrived; and all of it is serious when you're the parent of a school age child.

Talanes 7y ago
And you're worried that your child will use this exploit to gain root access to your system?

CivBase 7y ago

Is this contrived? The security risk may be overstated in the headline, but it definitely seems like a problem. Regarding the hatred for Zoom... I'm sure a lot of people feel the same as me. I'm tired of having to install and trust yet another native app just to perform a task I've been able to easily do with countless other solutions for well over a decade. I understand why Zoom in particular has found recent success, but it's still annoying. Zoom's recent surge in popularity also probably draws a lot of attention from cynics and skeptics.

draw_down 7y ago

Come on.

nilkn 7y ago

My first experience with Zoom was the installer opening, telling me it was going to perform a pre-install check to see if the software could be installed, then immediately closing without explanation. It turns out it installed everything immediately without even telling me. This immediately set off alarm bells and made it feel like it was malware.

hota_mazi 7y ago
It's actually using this deceptive phrasing to install (literally, copy) all its files directly into /Applications instead of going through the standard Mac OS install flow.

joshstrange 7y ago

Shitting on people pointing out concerns with/exploits in zoom appears to be this week's low latency path to more upvotes no matter how serious the claim is. Every zoom post I've read here has at least one highly-upvoted comment about "hey everyone lay off zoom". Why? Why should we give a company that millions are now using for the first time a break? Why should we ignore issues with software that tons of people are now using and potentially opening themselves up to danger? I use zoom, I used to before the pandemic and I've used it with friends since multiple times. I'm not some anti-zoom, burn it all down type. That said I think issues with it warrant a discussion and there is a reason these things are upvoted: because millions of people are now using it and are unaware of the risk they are taking.

InfoSecJoe 7y ago
I wonder if many even read the article. I wouldn't shit on the fact that there are vulnerabilities but if I score these . However, telling people "if you care about your security and privacy, perhaps stop using Zoom” is a wee bit hyperbolic. When I score these using CVSS 3 I come up with a Medium vulnerability. Here's the vector string for the first vuln that I scored 6.5- CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

deleted 7y ago

[deleted]