5 ms·

Of all the Zoom articles I've seen over the past few days, I think this is one of the more even-keeled and explanatory (vs the hyperbolic and emotional commenta

by wenc 7y ago

Of all the Zoom articles I've seen over the past few days, I think this is one of the more even-keeled and explanatory (vs the hyperbolic and emotional commentary on HN). I think a level-headed, focused technical discussion (sans incendiary language) does more to advance the conversation than snarky, emotional outbursts. From the article: "Are we being unfair to Zoom? I want to close by saying that many people are doing the best they can during a very hard time. This includes Zoom’s engineers, who are dealing with an unprecedented surge of users, and somehow managing to keep their service from falling over. They deserve a lot of credit for this. It seems almost unfair to criticize the company over some hypothetical security concerns right now. But at the end of the day, this stuff is important. The goal here isn’t to score points against Zoom, it’s to make the service more secure. And in the end, that will benefit Zoom as much as it will benefit all of the rest of us."

fossuser 7y ago
I also found this one to be pretty good: https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/ https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto... It was submitted to HN, but got less attention (ironically maybe because it's more technical?)
- seemslegit 7y ago
  How does that even remotely vindicate Zoom if it shows they bungled even the non-end-to-end encryption ?
  - fossuser 7y ago
    It doesn't? I just thought it was a high quality article going over some of the actual technical detail (rather than high-level anti-zoom articles about nothing, like the Facebook SDK). Two things can be true, Zoom can still be comically better than the alternatives like Cisco/Webex which are universally terrible, but they can also have serious security concerns. Hopefully this attention will cause them to fix it (though it may be hard to fix the Chinese development shop concerns). I have some hope that Zoom can improve their security posture, but I have no hope that Cisco can make a good product.
    - seemslegit 7y ago
      Why is the use of facebook sdk for users who have no desire to be associated with facebook nothing ? If anything there wasn't nearly enough scrutiny of the adware domains in the CORS headers. Also a "security posture" is corporate speak and has little to do with actual security - quite often the opposite, posturing security is what they have been doing all along.
smhenderson 7y ago
I read an article on NPR [1] this morning about a guy giving his doctoral dissertation over Zoom. It was broken into by someone putting porn up on the screen and then a few racial epithets as well. I don’t think it’s unfair to criticize them if this is allowed to happen on their service. Yes we need to keep it civil and yes acknowledge that they are working on fixing it but, given the type of service they offer, I think things like security should have had more focus before they launched rather than dealing with it after the fact. [1] https://www.npr.org/2020/04/03/826129520/a-must-for-millions-zoom-has-a-dark-side-and-an-fbi-warning https://www.npr.org/2020/04/03/826129520/a-must-for-millions...
- manfredo 7y ago
  But isn't that fundamentally s problem with users not setting passwords? A 6 digit meeting key means that if there's 50,000 meetings running at once, each code has a 1/20 chance of hitting an active room.
  - jonny_eh 7y ago
    They can slow down repeated failed attempts to stop "dictionary" attacks.
    - lostlogin 7y ago
      Between different devices and VPNs, getting 20 unique attempts wouldn’t very hard to do manually.
      - jonny_eh 7y ago
        Always have a 3 second delay? Paypal does something like that, even on success.
  - _jal 7y ago
    > A 6 digit meeting key But this is the sort of lack of foresight that bothers me about Zoom. Let's be clear - - It isn't that they're being attacked, that happens to any service where there's a payoff. - Is is not that they have vulnerabilities, bugs happen. Is is that they actively tried to deceive about E2E. It is that they never anticipated having 1M simultaneous connections, or the problem that would result before that. It is that they do insecure things to people's machines. They act like undisciplined malware authors who happen to work on what is supposed to be a business product. What will the next "bug" be? Actively looking for something that will work for us that isn't so untrustworthy.
president 7y ago
I think you're giving Zoom too much credit. Companies should be held accountable for their security goofs and over-exaggeration of their security capabilities. When people end up getting hacked due to these "hypothetical security concerns", we the consumer are the ones who suffer and end up footing the bill. Equifax comes to mind here.

by wenc 7y ago

fossuser 7y ago

I also found this one to be pretty good: https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/ https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto... It was submitted to HN, but got less attention (ironically maybe because it's more technical?)

seemslegit 7y ago
How does that even remotely vindicate Zoom if it shows they bungled even the non-end-to-end encryption ?
- fossuser 7y ago
  It doesn't? I just thought it was a high quality article going over some of the actual technical detail (rather than high-level anti-zoom articles about nothing, like the Facebook SDK). Two things can be true, Zoom can still be comically better than the alternatives like Cisco/Webex which are universally terrible, but they can also have serious security concerns. Hopefully this attention will cause them to fix it (though it may be hard to fix the Chinese development shop concerns). I have some hope that Zoom can improve their security posture, but I have no hope that Cisco can make a good product.
  - seemslegit 7y ago
    Why is the use of facebook sdk for users who have no desire to be associated with facebook nothing ? If anything there wasn't nearly enough scrutiny of the adware domains in the CORS headers. Also a "security posture" is corporate speak and has little to do with actual security - quite often the opposite, posturing security is what they have been doing all along.

smhenderson 7y ago

I read an article on NPR [1] this morning about a guy giving his doctoral dissertation over Zoom. It was broken into by someone putting porn up on the screen and then a few racial epithets as well. I don’t think it’s unfair to criticize them if this is allowed to happen on their service. Yes we need to keep it civil and yes acknowledge that they are working on fixing it but, given the type of service they offer, I think things like security should have had more focus before they launched rather than dealing with it after the fact. [1] https://www.npr.org/2020/04/03/826129520/a-must-for-millions-zoom-has-a-dark-side-and-an-fbi-warning https://www.npr.org/2020/04/03/826129520/a-must-for-millions...

manfredo 7y ago
But isn't that fundamentally s problem with users not setting passwords? A 6 digit meeting key means that if there's 50,000 meetings running at once, each code has a 1/20 chance of hitting an active room.
- jonny_eh 7y ago
  They can slow down repeated failed attempts to stop "dictionary" attacks.
  - lostlogin 7y ago
    Between different devices and VPNs, getting 20 unique attempts wouldn’t very hard to do manually.
    - jonny_eh 7y ago
      Always have a 3 second delay? Paypal does something like that, even on success.
- _jal 7y ago
  > A 6 digit meeting key But this is the sort of lack of foresight that bothers me about Zoom. Let's be clear - - It isn't that they're being attacked, that happens to any service where there's a payoff. - Is is not that they have vulnerabilities, bugs happen. Is is that they actively tried to deceive about E2E. It is that they never anticipated having 1M simultaneous connections, or the problem that would result before that. It is that they do insecure things to people's machines. They act like undisciplined malware authors who happen to work on what is supposed to be a business product. What will the next "bug" be? Actively looking for something that will work for us that isn't so untrustworthy.

president 7y ago

I think you're giving Zoom too much credit. Companies should be held accountable for their security goofs and over-exaggeration of their security capabilities. When people end up getting hacked due to these "hypothetical security concerns", we the consumer are the ones who suffer and end up footing the bill. Equifax comes to mind here.