5 ms·

I read an article on NPR [1] this morning about a guy giving his doctoral dissertation over Zoom. It was broken into by someone putting porn up on the screen an

I read an article on NPR [1] this morning about a guy giving his doctoral dissertation over Zoom. It was broken into by someone putting porn up on the screen and then a few racial epithets as well. I don’t think it’s unfair to criticize them if this is allowed to happen on their service. Yes we need to keep it civil and yes acknowledge that they are working on fixing it but, given the type of service they offer, I think things like security should have had more focus before they launched rather than dealing with it after the fact. [1] https://www.npr.org/2020/04/03/826129520/a-must-for-millions-zoom-has-a-dark-side-and-an-fbi-warning https://www.npr.org/2020/04/03/826129520/a-must-for-millions...

manfredo 7y ago
But isn't that fundamentally s problem with users not setting passwords? A 6 digit meeting key means that if there's 50,000 meetings running at once, each code has a 1/20 chance of hitting an active room.
- jonny_eh 7y ago
  They can slow down repeated failed attempts to stop "dictionary" attacks.
  - lostlogin 7y ago
    Between different devices and VPNs, getting 20 unique attempts wouldn’t very hard to do manually.
    - jonny_eh 7y ago
      Always have a 3 second delay? Paypal does something like that, even on success.
- _jal 7y ago
  > A 6 digit meeting key But this is the sort of lack of foresight that bothers me about Zoom. Let's be clear - - It isn't that they're being attacked, that happens to any service where there's a payoff. - Is is not that they have vulnerabilities, bugs happen. Is is that they actively tried to deceive about E2E. It is that they never anticipated having 1M simultaneous connections, or the problem that would result before that. It is that they do insecure things to people's machines. They act like undisciplined malware authors who happen to work on what is supposed to be a business product. What will the next "bug" be? Actively looking for something that will work for us that isn't so untrustworthy.
  - uberdru 7y ago
    You nailed it. It is the trust issue. This warning may have absolved them, "your shared encryption keys may be issued from data centers in China". It also would have destroyed their business.
    - rstuart4133 7y ago
      It strikes me that if trust was a big an issue to most people as it appears to be to you, the US would have a different president. I'm not knocking the need for trust, but trusting an closed source code served up by a central server is a bit of stretch for me. The temptation to monetise it is huge, and failing the governments around the world are give themselves permission to order the centralised server to decrypt it and send them a copy, and keep quiet about it. Finally there is absolutely no visibility to keep the vendor honest. They can silently update their code at any point without telling you, include switches that turn any feature off and on without you being aware of it and with little risk of researchers seeing it. In circumstances like that any "trust" seems to me to be a huge stretch. About the best you can hope for competition is going to keep respecting the customers needs rather than their own need for money. It better to assume it's sent in the clear - which is what I assume with zoom.
- smhenderson 7y ago
  I mean sure and I get they are catering to a very large audience with users with all levels of knowledge/skill sets but that's also why they needed to put a lot more work into security up front. If they want to make it easy for users that don't know/care much about security it's on them to make it secure for everyone. I know it's easy for me to sit here and arm-chair quarter back and I don't have a solution for them. If I did I'd be working for them instead of my current day job! But lacking the ability to assist I still think it's fair to publicly criticize them so they pay attention and fix this ASAP. The more people that do the more emphasis they will put on getting past this, if nothing else to stop the negative PR. When the FBI steps in and tells people to think twice about using an online service I hope even the most uniformed user will pay attention.

manfredo 7y ago

But isn't that fundamentally s problem with users not setting passwords? A 6 digit meeting key means that if there's 50,000 meetings running at once, each code has a 1/20 chance of hitting an active room.

jonny_eh 7y ago
They can slow down repeated failed attempts to stop "dictionary" attacks.
- lostlogin 7y ago
  Between different devices and VPNs, getting 20 unique attempts wouldn’t very hard to do manually.
  - jonny_eh 7y ago
    Always have a 3 second delay? Paypal does something like that, even on success.
_jal 7y ago
> A 6 digit meeting key But this is the sort of lack of foresight that bothers me about Zoom. Let's be clear - - It isn't that they're being attacked, that happens to any service where there's a payoff. - Is is not that they have vulnerabilities, bugs happen. Is is that they actively tried to deceive about E2E. It is that they never anticipated having 1M simultaneous connections, or the problem that would result before that. It is that they do insecure things to people's machines. They act like undisciplined malware authors who happen to work on what is supposed to be a business product. What will the next "bug" be? Actively looking for something that will work for us that isn't so untrustworthy.
- uberdru 7y ago
  You nailed it. It is the trust issue. This warning may have absolved them, "your shared encryption keys may be issued from data centers in China". It also would have destroyed their business.
  - rstuart4133 7y ago
    It strikes me that if trust was a big an issue to most people as it appears to be to you, the US would have a different president. I'm not knocking the need for trust, but trusting an closed source code served up by a central server is a bit of stretch for me. The temptation to monetise it is huge, and failing the governments around the world are give themselves permission to order the centralised server to decrypt it and send them a copy, and keep quiet about it. Finally there is absolutely no visibility to keep the vendor honest. They can silently update their code at any point without telling you, include switches that turn any feature off and on without you being aware of it and with little risk of researchers seeing it. In circumstances like that any "trust" seems to me to be a huge stretch. About the best you can hope for competition is going to keep respecting the customers needs rather than their own need for money. It better to assume it's sent in the clear - which is what I assume with zoom.
smhenderson 7y ago
I mean sure and I get they are catering to a very large audience with users with all levels of knowledge/skill sets but that's also why they needed to put a lot more work into security up front. If they want to make it easy for users that don't know/care much about security it's on them to make it secure for everyone. I know it's easy for me to sit here and arm-chair quarter back and I don't have a solution for them. If I did I'd be working for them instead of my current day job! But lacking the ability to assist I still think it's fair to publicly criticize them so they pay attention and fix this ASAP. The more people that do the more emphasis they will put on getting past this, if nothing else to stop the negative PR. When the FBI steps in and tells people to think twice about using an online service I hope even the most uniformed user will pay attention.