3 ms·
It's an incredibly simple thing to screw up. I wonder where else they use low entropy random strings. I wonder if their password reset functionality can be brut
by shiado 7y ago
It's an incredibly simple thing to screw up. I wonder where else they use low entropy random strings. I wonder if their password reset functionality can be brute forced too. Another problem is where they put rate limiting as it seems probable based on this article there are holes.
- andor 7y agoReal engineering is about compromises. In this case, relatively short numeric meeting ids allow users to dial in via plain old phone lines. If my meeting guests had to enter a UUID via their phone keypad, they would probably skip the meeting instead.
- shiado 7y agoThat actually makes sense I didn't know you could dial in with a phone.
- _6fmb 7y agoEvery time I read about a Zoom "screwup" I see a feature that's UX centric. It's pretty cool tbh.
- JadeNB 7y ago> Every time I read about a Zoom "screwup" I see a feature that's UX centric. It's pretty cool tbh. Like dialing Facebook even if you're not a Facebook user (https://news.ycombinator.com/item?id=22693792 https://news.ycombinator.com/item?id=22693792)?
- jlmorton 7y agoI mean, this is intentional. They even allow you to set your meeting ID to a well-known number, like your company's published phone number. If you want to join the all-hands meetings of a company I used to work for, you only need to go their website and lookup their primary phone number. That's the Zoom meeting ID.