4 ms·

I am very weary of angry mobs but I have to say that it looks to me like Zoom needs to be called out on some of these practices. Personally, the fact that I fi

I am very weary of angry mobs but I have to say that it looks to me like Zoom needs to be called out on some of these practices. Personally, the fact that I filled out what turns out to not be a system dialog with my password (https://twitter.com/raganwald/status/1244994636982222848 https://twitter.com/raganwald/status/1244994636982222848) makes me feel violated.

andybak 7y ago
Wow. They literally just phished me. I was distracted while installing Zoom and didn't look too carefully. I'm genuinely quite angry about this. I never enter passwords into 3rd party apps - I've had arguments with companies who embed oAuth flows into their app about this.
- saagarjha 7y ago
  If it’s any consolation, they didn’t get your password.
  - DenisM 7y ago
    How so?
  - obmelvin 7y ago
    Excuse my ignorance here, then what is the purpose of the fake system dialog?
    - tprynn 7y ago
      It's a real system dialog popped by the OS when the install script requests superuser privileges. It's not fake, and the password goes to the OS, not the script.
      - finnh 7y ago
        Why is it ungrammatical then? (serious question, i take that as a sign that it is not a real OS dialogue)
        JonathonW 7y ago
        Because the text displayed in the dialog is specified by the caller.
      - MaxBarraclough 7y ago
        So the tweet is mistaken? How do you know this?
      - obmelvin 7y ago
        You are the first person I've seen to know enough about the OSX APIs to know that it is real. I went back to look at the twitter thread and only saw (certainly could've overlooked) one person who was saying that it is real. Thanks for clearing that up, though I must say they (Zoom) bring this upon themselves by having such a poorly worded dialog.
        oefrha 7y ago
        Maybe try to read the blog post https://objective-see.com/blog/blog_0x56.html https://objective-see.com/blog/blog_0x56.html instead of a Twitter thread. People trying to glean information from truncated 140-char messages (often written in the most attention-grabbing way possible) is one of the main reasons why Twitter is full of misinformation.
        obmelvin 7y ago
        I've tried googling and didn't see any blog posts. 140 chars is certainly enough for someone to link that :). Anyway, thank you for making me and others aware of this blog.
        oefrha 7y ago
fock 7y ago
We have to use it too (lectures), I wasn't too concerned, bc this is just another web-app, isn't it... Well - it is (judging from the exe-tar which mainly include a QT-webview...), but like in 2003 they expect you to download and execute random crap unsandboxed. Wheew...
jp10558 7y ago
Me too. I swear they are stretching "vulnerability" to the point of stupidity. So, if a Hacker gets into your Zoom Meeting (itself a problem) and sends you a link, and you click it, bad things happen? Why, send out the hounds to any thing that has clickable links. Better boycot web browsers too while we're at it. Because the problem here isn't a clickable link, what if someone copy pastes it? Is that a zoom vulnerability too? The issue is Microsoft allowing SMB to the internet by default, or bad IT config allowing it to the net by default. The password problem is Microsoft STILL using insecure auth mechanisms there. NONE OF THIS has ANYTHING to do with Zoom or e-mail or a web browser IMO. Oh, if you're already hacked in enough to run code on MacOS, you can grab the camera with Zoom. Or, you know, use any of many methods to do that I'm sure. The problem, and the reason for HIPS / AV / security solutions is to stop running "hacker code". If I'm running arbitrary code on your Mac, I don't need Zoom to grab a password. Now, the bad installer methods used on MacOS - yes, those should not happen and ought to be fixed. I think it's the big problem, no one gets paid for a secure system, but one that people can use. Security just causes issues sadly, and making it possible for the most incapable computer user is why everyone loves Zoom for "just working". That sadly incentivizes them to try and work around security roadblocks, which is bad.
DenisM 7y ago
Makes you wonder what was Apple thinking when they designed this security feature? Any app can spoof a system-looking dialog and ask for the password. Not sure about about a better way tho.
- oefrha 7y ago
  It’s not a spoofed dialog, it’s the app asking the system (using a rather dangerous API) to ask you to grant access. It’s a legit system prompt. The app doesn’t see your password. It’s like sudo rm doesn’t give your password to rm. Can we stop the misinformation?
  - kristiandupont 7y ago
    Sadly it's too late for me to edit or delete my post. Thank you for clarifying.

andybak 7y ago

Wow. They literally just phished me. I was distracted while installing Zoom and didn't look too carefully. I'm genuinely quite angry about this. I never enter passwords into 3rd party apps - I've had arguments with companies who embed oAuth flows into their app about this.

saagarjha 7y ago
If it’s any consolation, they didn’t get your password.
- DenisM 7y ago
  How so?
- obmelvin 7y ago
  Excuse my ignorance here, then what is the purpose of the fake system dialog?
  - tprynn 7y ago
    It's a real system dialog popped by the OS when the install script requests superuser privileges. It's not fake, and the password goes to the OS, not the script.
    - finnh 7y ago
      Why is it ungrammatical then? (serious question, i take that as a sign that it is not a real OS dialogue)
      - JonathonW 7y ago
        Because the text displayed in the dialog is specified by the caller.
    - MaxBarraclough 7y ago
      So the tweet is mistaken? How do you know this?
    - obmelvin 7y ago
      You are the first person I've seen to know enough about the OSX APIs to know that it is real. I went back to look at the twitter thread and only saw (certainly could've overlooked) one person who was saying that it is real. Thanks for clearing that up, though I must say they (Zoom) bring this upon themselves by having such a poorly worded dialog.
      - oefrha 7y ago
        Maybe try to read the blog post https://objective-see.com/blog/blog_0x56.html https://objective-see.com/blog/blog_0x56.html instead of a Twitter thread. People trying to glean information from truncated 140-char messages (often written in the most attention-grabbing way possible) is one of the main reasons why Twitter is full of misinformation.
        obmelvin 7y ago
        I've tried googling and didn't see any blog posts. 140 chars is certainly enough for someone to link that :). Anyway, thank you for making me and others aware of this blog.
        oefrha 7y ago

fock 7y ago

We have to use it too (lectures), I wasn't too concerned, bc this is just another web-app, isn't it... Well - it is (judging from the exe-tar which mainly include a QT-webview...), but like in 2003 they expect you to download and execute random crap unsandboxed. Wheew...

jp10558 7y ago

Me too. I swear they are stretching "vulnerability" to the point of stupidity. So, if a Hacker gets into your Zoom Meeting (itself a problem) and sends you a link, and you click it, bad things happen? Why, send out the hounds to any thing that has clickable links. Better boycot web browsers too while we're at it. Because the problem here isn't a clickable link, what if someone copy pastes it? Is that a zoom vulnerability too? The issue is Microsoft allowing SMB to the internet by default, or bad IT config allowing it to the net by default. The password problem is Microsoft STILL using insecure auth mechanisms there. NONE OF THIS has ANYTHING to do with Zoom or e-mail or a web browser IMO. Oh, if you're already hacked in enough to run code on MacOS, you can grab the camera with Zoom. Or, you know, use any of many methods to do that I'm sure. The problem, and the reason for HIPS / AV / security solutions is to stop running "hacker code". If I'm running arbitrary code on your Mac, I don't need Zoom to grab a password. Now, the bad installer methods used on MacOS - yes, those should not happen and ought to be fixed. I think it's the big problem, no one gets paid for a secure system, but one that people can use. Security just causes issues sadly, and making it possible for the most incapable computer user is why everyone loves Zoom for "just working". That sadly incentivizes them to try and work around security roadblocks, which is bad.

DenisM 7y ago

Makes you wonder what was Apple thinking when they designed this security feature? Any app can spoof a system-looking dialog and ask for the password. Not sure about about a better way tho.

oefrha 7y ago
It’s not a spoofed dialog, it’s the app asking the system (using a rather dangerous API) to ask you to grant access. It’s a legit system prompt. The app doesn’t see your password. It’s like sudo rm doesn’t give your password to rm. Can we stop the misinformation?
- kristiandupont 7y ago
  Sadly it's too late for me to edit or delete my post. Thank you for clarifying.