4 ms·

And more recently, Zoom Is Leaking Peoples' Email Addresses and Photos to Strangers https://news.ycombinator.com/item?id=22753675 https://news.ycombinator.com/

And more recently, Zoom Is Leaking Peoples' Email Addresses and Photos to Strangers https://news.ycombinator.com/item?id=22753675 https://news.ycombinator.com/item?id=22753675

ninkendo 7y ago
I let out an audible “wow” upon reading this. This is absolutely bone-headed and I have no idea how they thought automatically grouping members by their email domain name was a good idea. You gotta figure, as soon as you starting writing a blacklist of “common” domains like gmail.com, hotmail.com, etc, your immediate thought should probably be “wait, maybe we’re doing this wrong.”
- planb 7y ago
  You’re right but I absolutely see why they are doing this. When I saw all my colleagues in the company list I immediately figured they only have the email domain and I found it extremely useful to see whom I can contact without explaining how zoom works. Privacy isn’t our most important concern right now, it’s keeping the world running, and this “feature” helped me/us (if only just a little bit) communicate more effectively.
  - luckylion 7y ago
    I don't mean to be overly snarky, but removing authentication from all computers and servers would also help everyone (if only just a little bit) be more effective. It's still a bad idea, crisis or not.
    - shadowgovt 7y ago
      Yep. And at the other end of the spectrum, never having users is the easiest way to maintain user privacy and security.
  - ninkendo 7y ago
    Why wouldn’t this be an opt in feature per-organization? I’m acme co, I buy a zoom subscription for acme.com, I click a box saying “let everyone with an acme.com email address see each other”. Done. Yes, I would have to prove I own acme.com, but we have solutions for that (didn’t set out to make this joke but, the ACME protocol, for one.) Why is it that it’s on by default for arbitrary domains (excepting the ones some poor soul has to blacklist)?
yokohummer7 7y ago
This problem also seems to stem from the fact that Zoom has been used primarily in the corporate settings until now, which kinda validates their claim. Definitely not ideal, but understandable.
- xenonite 7y ago
  which exacerbates the problem. A possible scenario is that users continue to browse the user directory and join meetings with their Zoom account even after leaving a company.
  - javagram 7y ago
    Companies that are concerned about this can set up SSO authentication with zoom I believe. So once the user is removed from the company’s directory server they wouldn’t have access to the zoom address list either.
  - ryanbrunner 7y ago
    I'm not dismissing the overall security point, but this seems like a pretty weak attack vector. If your company is routinely not deactivating accounts associated with your domain as part of your offboarding, being able to see e-mails and pictures of your employees is not your biggest problem.
    - xenonite 7y ago
      Well, not if you still can log in to Zoom even if your email account was deactivated.

And more recently, Zoom Is Leaking Peoples' Email Addresses and Photos to Strangers https://news.ycombinator.com/item?id=22753675 https://news.ycombinator.com/item?id=22753675

ninkendo 7y ago

I let out an audible “wow” upon reading this. This is absolutely bone-headed and I have no idea how they thought automatically grouping members by their email domain name was a good idea. You gotta figure, as soon as you starting writing a blacklist of “common” domains like gmail.com, hotmail.com, etc, your immediate thought should probably be “wait, maybe we’re doing this wrong.”

planb 7y ago
You’re right but I absolutely see why they are doing this. When I saw all my colleagues in the company list I immediately figured they only have the email domain and I found it extremely useful to see whom I can contact without explaining how zoom works. Privacy isn’t our most important concern right now, it’s keeping the world running, and this “feature” helped me/us (if only just a little bit) communicate more effectively.
- luckylion 7y ago
  I don't mean to be overly snarky, but removing authentication from all computers and servers would also help everyone (if only just a little bit) be more effective. It's still a bad idea, crisis or not.
  - shadowgovt 7y ago
    Yep. And at the other end of the spectrum, never having users is the easiest way to maintain user privacy and security.
- ninkendo 7y ago
  Why wouldn’t this be an opt in feature per-organization? I’m acme co, I buy a zoom subscription for acme.com, I click a box saying “let everyone with an acme.com email address see each other”. Done. Yes, I would have to prove I own acme.com, but we have solutions for that (didn’t set out to make this joke but, the ACME protocol, for one.) Why is it that it’s on by default for arbitrary domains (excepting the ones some poor soul has to blacklist)?

yokohummer7 7y ago

This problem also seems to stem from the fact that Zoom has been used primarily in the corporate settings until now, which kinda validates their claim. Definitely not ideal, but understandable.

xenonite 7y ago
which exacerbates the problem. A possible scenario is that users continue to browse the user directory and join meetings with their Zoom account even after leaving a company.
- javagram 7y ago
  Companies that are concerned about this can set up SSO authentication with zoom I believe. So once the user is removed from the company’s directory server they wouldn’t have access to the zoom address list either.
- ryanbrunner 7y ago
  I'm not dismissing the overall security point, but this seems like a pretty weak attack vector. If your company is routinely not deactivating accounts associated with your domain as part of your offboarding, being able to see e-mails and pictures of your employees is not your biggest problem.
  - xenonite 7y ago
    Well, not if you still can log in to Zoom even if your email account was deactivated.