9 ms·

One positive thing about all these horrendous security flaws that have been recently discovered in Zoom, due to its popularity, is that the company seems to be

by cs702 7y ago

One positive thing about all these horrendous security flaws that have been recently discovered in Zoom, due to its popularity, is that the company seems to be taking them seriously, recently instituting a feature freeze to focus on fixing them: https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-users/ https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-u... As a consequence, I suspect Zoom's security is more likely than not to improve going forward... although it will surely take a long while. Security is Capital-H Hard. Also, I cannot think of any other multi-video-conferencing solution that "just works" and has been as thoroughly stress-tested and attacked by bad actors in the wild at such a large scale. If Zoom does a decent-to-good job fixing all the security issues, it looks likely to continue to dominate its market.

bluntfang 7y ago
>recently instituting a feature freeze to focus on fixing them Or they're having productivity problems like every other company right now and are spinning it to seem like they are on top of things. These security issues have been around for years.
dang 7y ago
Discussions: https://news.ycombinator.com/item?id=22757697 https://news.ycombinator.com/item?id=22757697 https://news.ycombinator.com/item?id=22756730 https://news.ycombinator.com/item?id=22756730
ryandrake 7y ago
Pro: A worldwide, motivated, unpaid volunteer team is doing their thorough security audit, privacy review and QA testing for them. Con: After the product was released :)
Spooky23 7y ago
I'm not a fan of Zoom... But the pile-on of grief is ridiculous. The "war dialing" issue is a great example. Webex has had the exact same "flaw" for a decade, with the exact same solution - set a meeting password. Other solutions like Google Meet or Skype have the "lobby" approach.
- somethoughts 7y ago
  Fun fact - perhaps not widely known and perhaps why it shares a similar philosophy as Webex: Zoom was founded in 2011 by Eric Yuan, a lead engineer from Cisco Systems and its collaboration business unit WebEx.[1] [1] https://en.wikipedia.org/wiki/Zoom_Video_Communications#History https://en.wikipedia.org/wiki/Zoom_Video_Communications#Hist...
  - albertshin 7y ago
    I've always wondered about spinoff startups like this from larger companies: aren't there usually non competes that would prevent them starting them?
    - reaperducer 7y ago
      They're not usually infinite. My father waited one out for three years, then went back into the industry for a rival firm and put his old boss out of business.
    - andrewfong 7y ago
      They're generally not enforceable in California, provided you're not making use of any protected IP or what not. https://casetext.com/statute/california-codes/california-business-and-professions-code/division-7-general-business-regulations/part-2-preservation-and-regulation-of-competition/chapter-1-contracts-in-restraint-of-trade/section-16600-void-contracts/analysis?PHONE_NUMBER_GROUP=P&citingPage=1&sort=relevance https://casetext.com/statute/california-codes/california-bus...
- teraflop 7y ago
  IMO, when it comes to security, the fact that other people have made the same mistake makes a design flaw more egregious, not less.
  - tptacek 7y ago
    That is absolutely not an information security norm. Most security mistakes fall into common patterns.
RobotCaleb 7y ago
Why do people keep saying it just works? It just works if you install their app, probably. But audio doesn't work at all in Firefox. That's not really just works for me.
- wutbrodo 7y ago
  Yea, Hangouts is a lot more "it just works" than Zoom is for me. That being said, the quality of the actual calls on Zoom is _way_ better than Hangouts.
  - devin 7y ago
    I mean, I don't really know how "consistently high call quality" is not the most important feature of any video chat application. My experience on hangouts has always been garbage. Delays, choppy sound, my machine starts going insane while rendering other people's live video. It may just work in the sense that you can immediately use it, but if even 20% of the time you use it the call quality sucks, then it's a crap product IMO.
    - wutbrodo 7y ago
      > It may just work in the sense that you can immediately use it, but if even 20% of the time you use it the call quality sucks, then it's a crap product IMO. "it just works" doesn't mean "its a superior product". I use Zoom over hangouts whenever I'm on a call with more than ~3 people, but automatic gcal integration + being fully functional from a browser means that hangouts makes more sense sometimes. (I also don't have nearly the amount of issues you do with hangouts. The biggest problem for me is how much worse they handle crosstalk, which isn't an issue when there are only a couple of people on a call.
  - hyperluz 7y ago
    Hangouts is going to be discontinued. Hangouts meet is limited to 720p and sharing screen is limited to fcking 5 FPS. Repeat with me, three times: Hangouts scks for on-line presentations Hangouts scks for on-line presentations Hangouts scks for on-line presentations
JohnJamesRambo 7y ago
Your comment reads as an alternative form of “This is good for Bitcoin.” where its most rabid followers see nearly any news, even disastrous, as being good for it. You are saying because they had lax security, now they will have good security.
hermitdev 7y ago
> Security is Capital-H Hard. It is even harder when you try and graft the security on after the fact. Security needs to be a consideration from day 1, not once youve your minimal product. Proper security may steer architecture decisions that may be difficult or impossible which to adapt. This is especially true for internet facing services. I had a hell of a time bolting on authentication/permission to an internal API (not web based) at a previous employer. By the time I left, we had all users authenticating, but only maybe 20% of the API surface had permissions beyond being authenticated. It was a CRUD API over +300 objects. Yeah, everything was audited, so we couls recover from a malicious or bumbling idiot authenticated user, but the exposure was way to high with people having far more access than their roles needed. It was a mess.
- vehementi 7y ago
  Yeah... graft it on after you've lunged to make a sort of OK product and they're locked in but the vulnerabilities you're exposing them to aren't worth moving off the platform. The capitalist sweet spot
ryanlol 7y ago
>horrendous security flaws You’re kidding... right?
spicyramen 7y ago
Yes now Google meet uses random alphanumeric meeting ids this helps for sure you needed to find the.balance between security and accessibility.
sudhirj 7y ago
So there's two kinds of problems here - not all security flaws are created equal. One kind is missing something or unintended consequences. Making all URLs clickable opens a UNC attack due to some obscure Windows "feature", for example. Or having N digit numbers means they're technically iterable, but this is the same for cellphones, and there are workarounds. The other kind is security holes caused by explicitly working to bypass security restrictions yourself. Installing a server with webcam permissions that you don't cleanup so reinstallation is easier for you (don't be surprised when other apps start telling it to switch on the webcam), impersonating the system root password dialog (don't act surprised when other apps steal the password from you), claiming end to end encryption without being clear about where and when it's on, and others. The first is normal security work, the second is sleazy. We all forgive the first, but we shouldn't let sleaziness slide.
whirlwin 7y ago
Ok. This was way too funny. Linking to a wordpress blog about their focus on fixing security bugs.
perke11 7y ago
Jitsi "just work" and is much secure (https://meet.jit.si/ https://meet.jit.si/)
andrepd 7y ago
>Also, I cannot think of any other multi-video-conferencing solution that "just works" Another post about Zoom, another comment how it's the only video conferencing platform in the planet that "just works". You know I find that really hard to believe... not least of all because I personally use other solutions without never having major hiccups at all.

by cs702 7y ago

bluntfang 7y ago

>recently instituting a feature freeze to focus on fixing them Or they're having productivity problems like every other company right now and are spinning it to seem like they are on top of things. These security issues have been around for years.

dang 7y ago

Discussions: https://news.ycombinator.com/item?id=22757697 https://news.ycombinator.com/item?id=22757697 https://news.ycombinator.com/item?id=22756730 https://news.ycombinator.com/item?id=22756730

ryandrake 7y ago

Pro: A worldwide, motivated, unpaid volunteer team is doing their thorough security audit, privacy review and QA testing for them. Con: After the product was released :)

Spooky23 7y ago

I'm not a fan of Zoom... But the pile-on of grief is ridiculous. The "war dialing" issue is a great example. Webex has had the exact same "flaw" for a decade, with the exact same solution - set a meeting password. Other solutions like Google Meet or Skype have the "lobby" approach.

somethoughts 7y ago
Fun fact - perhaps not widely known and perhaps why it shares a similar philosophy as Webex: Zoom was founded in 2011 by Eric Yuan, a lead engineer from Cisco Systems and its collaboration business unit WebEx.[1] [1] https://en.wikipedia.org/wiki/Zoom_Video_Communications#History https://en.wikipedia.org/wiki/Zoom_Video_Communications#Hist...
- albertshin 7y ago
  I've always wondered about spinoff startups like this from larger companies: aren't there usually non competes that would prevent them starting them?
  - reaperducer 7y ago
    They're not usually infinite. My father waited one out for three years, then went back into the industry for a rival firm and put his old boss out of business.
  - andrewfong 7y ago
    They're generally not enforceable in California, provided you're not making use of any protected IP or what not. https://casetext.com/statute/california-codes/california-business-and-professions-code/division-7-general-business-regulations/part-2-preservation-and-regulation-of-competition/chapter-1-contracts-in-restraint-of-trade/section-16600-void-contracts/analysis?PHONE_NUMBER_GROUP=P&citingPage=1&sort=relevance https://casetext.com/statute/california-codes/california-bus...
teraflop 7y ago
IMO, when it comes to security, the fact that other people have made the same mistake makes a design flaw more egregious, not less.
- tptacek 7y ago
  That is absolutely not an information security norm. Most security mistakes fall into common patterns.

RobotCaleb 7y ago

Why do people keep saying it just works? It just works if you install their app, probably. But audio doesn't work at all in Firefox. That's not really just works for me.

wutbrodo 7y ago
Yea, Hangouts is a lot more "it just works" than Zoom is for me. That being said, the quality of the actual calls on Zoom is _way_ better than Hangouts.
- devin 7y ago
  I mean, I don't really know how "consistently high call quality" is not the most important feature of any video chat application. My experience on hangouts has always been garbage. Delays, choppy sound, my machine starts going insane while rendering other people's live video. It may just work in the sense that you can immediately use it, but if even 20% of the time you use it the call quality sucks, then it's a crap product IMO.
  - wutbrodo 7y ago
    > It may just work in the sense that you can immediately use it, but if even 20% of the time you use it the call quality sucks, then it's a crap product IMO. "it just works" doesn't mean "its a superior product". I use Zoom over hangouts whenever I'm on a call with more than ~3 people, but automatic gcal integration + being fully functional from a browser means that hangouts makes more sense sometimes. (I also don't have nearly the amount of issues you do with hangouts. The biggest problem for me is how much worse they handle crosstalk, which isn't an issue when there are only a couple of people on a call.
- hyperluz 7y ago
  Hangouts is going to be discontinued. Hangouts meet is limited to 720p and sharing screen is limited to fcking 5 FPS. Repeat with me, three times: Hangouts scks for on-line presentations Hangouts scks for on-line presentations Hangouts scks for on-line presentations

JohnJamesRambo 7y ago

Your comment reads as an alternative form of “This is good for Bitcoin.” where its most rabid followers see nearly any news, even disastrous, as being good for it. You are saying because they had lax security, now they will have good security.

hermitdev 7y ago

> Security is Capital-H Hard. It is even harder when you try and graft the security on after the fact. Security needs to be a consideration from day 1, not once youve your minimal product. Proper security may steer architecture decisions that may be difficult or impossible which to adapt. This is especially true for internet facing services. I had a hell of a time bolting on authentication/permission to an internal API (not web based) at a previous employer. By the time I left, we had all users authenticating, but only maybe 20% of the API surface had permissions beyond being authenticated. It was a CRUD API over +300 objects. Yeah, everything was audited, so we couls recover from a malicious or bumbling idiot authenticated user, but the exposure was way to high with people having far more access than their roles needed. It was a mess.

vehementi 7y ago
Yeah... graft it on after you've lunged to make a sort of OK product and they're locked in but the vulnerabilities you're exposing them to aren't worth moving off the platform. The capitalist sweet spot

ryanlol 7y ago

>horrendous security flaws You’re kidding... right?

spicyramen 7y ago

Yes now Google meet uses random alphanumeric meeting ids this helps for sure you needed to find the.balance between security and accessibility.

sudhirj 7y ago

So there's two kinds of problems here - not all security flaws are created equal. One kind is missing something or unintended consequences. Making all URLs clickable opens a UNC attack due to some obscure Windows "feature", for example. Or having N digit numbers means they're technically iterable, but this is the same for cellphones, and there are workarounds. The other kind is security holes caused by explicitly working to bypass security restrictions yourself. Installing a server with webcam permissions that you don't cleanup so reinstallation is easier for you (don't be surprised when other apps start telling it to switch on the webcam), impersonating the system root password dialog (don't act surprised when other apps steal the password from you), claiming end to end encryption without being clear about where and when it's on, and others. The first is normal security work, the second is sleazy. We all forgive the first, but we shouldn't let sleaziness slide.

whirlwin 7y ago

Ok. This was way too funny. Linking to a wordpress blog about their focus on fixing security bugs.

perke11 7y ago

Jitsi "just work" and is much secure (https://meet.jit.si/ https://meet.jit.si/)

andrepd 7y ago

>Also, I cannot think of any other multi-video-conferencing solution that "just works" Another post about Zoom, another comment how it's the only video conferencing platform in the planet that "just works". You know I find that really hard to believe... not least of all because I personally use other solutions without never having major hiccups at all.