5 ms·

Err, no. It would be understandable if their servers buckled under the load or something. Zoom's blatant disregard for their users' security and privacy is unac

Err, no. It would be understandable if their servers buckled under the load or something. Zoom's blatant disregard for their users' security and privacy is unacceptable regardless of whether they have 5 or 5 million users. > Any sw product has issues. The question is what the company does about it See https://news.ycombinator.com/item?id=20389812 https://news.ycombinator.com/item?id=20389812, https://news.ycombinator.com/item?id=20390755 https://news.ycombinator.com/item?id=20390755

JohnJamesRambo 7y ago
Other than Zoom stockholders, I’m unsure why this comment is being downvoted. It seems entirely factual and provides references.
- deleted 7y ago
  [deleted]
xenonite 7y ago
And more recently, Zoom Is Leaking Peoples' Email Addresses and Photos to Strangers https://news.ycombinator.com/item?id=22753675 https://news.ycombinator.com/item?id=22753675
- ninkendo 7y ago
  I let out an audible “wow” upon reading this. This is absolutely bone-headed and I have no idea how they thought automatically grouping members by their email domain name was a good idea. You gotta figure, as soon as you starting writing a blacklist of “common” domains like gmail.com, hotmail.com, etc, your immediate thought should probably be “wait, maybe we’re doing this wrong.”
  - planb 7y ago
    You’re right but I absolutely see why they are doing this. When I saw all my colleagues in the company list I immediately figured they only have the email domain and I found it extremely useful to see whom I can contact without explaining how zoom works. Privacy isn’t our most important concern right now, it’s keeping the world running, and this “feature” helped me/us (if only just a little bit) communicate more effectively.
    - luckylion 7y ago
      I don't mean to be overly snarky, but removing authentication from all computers and servers would also help everyone (if only just a little bit) be more effective. It's still a bad idea, crisis or not.
      - shadowgovt 7y ago
        Yep. And at the other end of the spectrum, never having users is the easiest way to maintain user privacy and security.
    - ninkendo 7y ago
      Why wouldn’t this be an opt in feature per-organization? I’m acme co, I buy a zoom subscription for acme.com, I click a box saying “let everyone with an acme.com email address see each other”. Done. Yes, I would have to prove I own acme.com, but we have solutions for that (didn’t set out to make this joke but, the ACME protocol, for one.) Why is it that it’s on by default for arbitrary domains (excepting the ones some poor soul has to blacklist)?
- yokohummer7 7y ago
  This problem also seems to stem from the fact that Zoom has been used primarily in the corporate settings until now, which kinda validates their claim. Definitely not ideal, but understandable.
  - xenonite 7y ago
    which exacerbates the problem. A possible scenario is that users continue to browse the user directory and join meetings with their Zoom account even after leaving a company.
    - javagram 7y ago
      Companies that are concerned about this can set up SSO authentication with zoom I believe. So once the user is removed from the company’s directory server they wouldn’t have access to the zoom address list either.
    - ryanbrunner 7y ago
      I'm not dismissing the overall security point, but this seems like a pretty weak attack vector. If your company is routinely not deactivating accounts associated with your domain as part of your offboarding, being able to see e-mails and pictures of your employees is not your biggest problem.
      - xenonite 7y ago
        Well, not if you still can log in to Zoom even if your email account was deactivated.
shadowgovt 7y ago
... by that special definition of "unacceptable" that means "It's been wildly accepted." If this situation isn't a mass condemnation of the idea users care about security or privacy more than usability, I don't know what is.

JohnJamesRambo 7y ago

Other than Zoom stockholders, I’m unsure why this comment is being downvoted. It seems entirely factual and provides references.

deleted 7y ago
[deleted]

xenonite 7y ago

And more recently, Zoom Is Leaking Peoples' Email Addresses and Photos to Strangers https://news.ycombinator.com/item?id=22753675 https://news.ycombinator.com/item?id=22753675

ninkendo 7y ago
I let out an audible “wow” upon reading this. This is absolutely bone-headed and I have no idea how they thought automatically grouping members by their email domain name was a good idea. You gotta figure, as soon as you starting writing a blacklist of “common” domains like gmail.com, hotmail.com, etc, your immediate thought should probably be “wait, maybe we’re doing this wrong.”
- planb 7y ago
  You’re right but I absolutely see why they are doing this. When I saw all my colleagues in the company list I immediately figured they only have the email domain and I found it extremely useful to see whom I can contact without explaining how zoom works. Privacy isn’t our most important concern right now, it’s keeping the world running, and this “feature” helped me/us (if only just a little bit) communicate more effectively.
  - luckylion 7y ago
    I don't mean to be overly snarky, but removing authentication from all computers and servers would also help everyone (if only just a little bit) be more effective. It's still a bad idea, crisis or not.
    - shadowgovt 7y ago
      Yep. And at the other end of the spectrum, never having users is the easiest way to maintain user privacy and security.
  - ninkendo 7y ago
    Why wouldn’t this be an opt in feature per-organization? I’m acme co, I buy a zoom subscription for acme.com, I click a box saying “let everyone with an acme.com email address see each other”. Done. Yes, I would have to prove I own acme.com, but we have solutions for that (didn’t set out to make this joke but, the ACME protocol, for one.) Why is it that it’s on by default for arbitrary domains (excepting the ones some poor soul has to blacklist)?
yokohummer7 7y ago
This problem also seems to stem from the fact that Zoom has been used primarily in the corporate settings until now, which kinda validates their claim. Definitely not ideal, but understandable.
- xenonite 7y ago
  which exacerbates the problem. A possible scenario is that users continue to browse the user directory and join meetings with their Zoom account even after leaving a company.
  - javagram 7y ago
    Companies that are concerned about this can set up SSO authentication with zoom I believe. So once the user is removed from the company’s directory server they wouldn’t have access to the zoom address list either.
  - ryanbrunner 7y ago
    I'm not dismissing the overall security point, but this seems like a pretty weak attack vector. If your company is routinely not deactivating accounts associated with your domain as part of your offboarding, being able to see e-mails and pictures of your employees is not your biggest problem.
    - xenonite 7y ago
      Well, not if you still can log in to Zoom even if your email account was deactivated.

shadowgovt 7y ago

... by that special definition of "unacceptable" that means "It's been wildly accepted." If this situation isn't a mass condemnation of the idea users care about security or privacy more than usability, I don't know what is.