4 ms·

Is there any technical merit to this ban? Why would forcing use of web version mitigate any concerns? (The concerns I have heard are lack of proper end-to-end e

by chvid 7y ago

Is there any technical merit to this ban? Why would forcing use of web version mitigate any concerns? (The concerns I have heard are lack of proper end-to-end encryption, servers in China and the possibility to join chatrooms by guessing a name (zoom-bombing)).

mulmen 7y ago
Seems perfectly sensible to ban all software that is not pre-approved by IT, InfoSec and Legal. You can't safely assume all your employees are properly assessing the risks unless that is their actual job. If you only allow what you know then you can reason about your risk.
- chvid 7y ago
  This reads like it is specifically targeting zoom.
  - deleted 7y ago
    [deleted]
- closeparen 7y ago
  Google’s reputation as an employer stems in large part from rejecting that belief, and more generally the enterprise bureaucratic culture it lives in. Engineers aren’t clamoring to get into the kinds of companies where IT needs to pre-approve software for their workstations.
  - thelean12 7y ago
    You might be disappointed to know that native applications need pre-approval in most cases. There's a whitelist. Of course, after years and years and hundreds of thousands of engineers, the whitelist is pretty robust. I don't know for sure, but I bet Zoom has been on that whitelist, and "banning" is removing it from that whitelist.
    - closeparen 7y ago
      I'll be absolutely stunned if people are really having to raise JIRA tickets instead of typing "brew install" but my information is secondhand so what do I know. Our laptops are configuration managed, force upgraded, and surveilled, but we all have root and IT has never stood in the way of "power user" behavior. The extent of the frustration in engineering is that their management processes sometimes eat CPU. My understanding is that most of the Valley is like this.
      - tbodt 7y ago
        https://github.com/google/santa https://github.com/google/santa is used to whitelist binaries on Macs, but you can fill out a form to instantly opt out. One of the options for why is "I use a package manager".
  - jdashg 7y ago
    Most Google engineers don't have root on their own machines anymore.
    - tytso 7y ago
      That's not true; you can use "sudo" to get root access on gLinux desktops and servers.
milkthefat 7y ago
The Code execution vulns for both OSX and Win10 probably. In windows clicking a UNC path link would pass hashs. I believe for OSX there was an installer trick that allowed any code to run if triggered.
- jmcnulty 7y ago
  Those vulnerabilities are fixed in current versions: https://www.cvedetails.com/vulnerability-list/vendor_id-2159/Zoom.html https://www.cvedetails.com/vulnerability-list/vendor_id-2159... There is nothing new/outstanding.
  - gwd 7y ago
    But those vulnerabilities were there, at least on OSX, because they were trying to avoid OSX's security warnings. And this is not the first time they've done something skanky like that. Once may have been an honest mistake; 2+ times is now a pattern.
vkou 7y ago
> Is there any technical merit to this ban? Installing third-party software on corp devices is generally a no-go at a lot of workplaces. With the security problems that Zoom has been having, it's only prudent of IT to ban its use on work devices. > Why would forcing use of web version mitigate any concerns? Because the web version runs in a browser sandbox, so there's a reduced risk of it compromising the security of the corp device. > The concerns I have heard are lack of proper end-to-end encryption, servers in China and the possibility to join chatrooms by guessing a name (zoom-bombing)). Googlers don't use Zoom for work, they use it for personal stuff, so that's not the problem. From the perspective of a generic IT department: Even if there aren't any security problems with having the client installed on your workstation - the problem is that when they've made so many amateurish security mistakes, it's difficult for IT to trust the binary blob that Zoom wants you to install on your computer. Corporate device security is a series of safety-versus-efficiency tradeoffs, made with incomplete information. Banning Zoom does not really compromise efficiency, if you aren't using it for work stuff.
magicsmoke 7y ago
https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/ https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto... "For those who have no choice but to use Zoom, including in contexts where secrets may be shared, we speculate that the browser plugin may have some marginally better security properties, as data transmission occurs over TLS." Apparently the web version doesn't use their homegrown encryption scheme.
dodobirdlord 7y ago
Using Zoom or any other videoconferencing app that might retain data for an internal meeting is presumably banned regardless, and unnecessary given that Google Meet exists. But some employees might need to use it to videoconference with customers and partners, and some employees might be using it for personal calls on their work laptop. Banning the native app of a company that is clearly 100% shady 100% of the time seems wise.

by chvid 7y ago

mulmen 7y ago

Seems perfectly sensible to ban all software that is not pre-approved by IT, InfoSec and Legal. You can't safely assume all your employees are properly assessing the risks unless that is their actual job. If you only allow what you know then you can reason about your risk.

chvid 7y ago
This reads like it is specifically targeting zoom.
- deleted 7y ago
  [deleted]
closeparen 7y ago
Google’s reputation as an employer stems in large part from rejecting that belief, and more generally the enterprise bureaucratic culture it lives in. Engineers aren’t clamoring to get into the kinds of companies where IT needs to pre-approve software for their workstations.
- thelean12 7y ago
  You might be disappointed to know that native applications need pre-approval in most cases. There's a whitelist. Of course, after years and years and hundreds of thousands of engineers, the whitelist is pretty robust. I don't know for sure, but I bet Zoom has been on that whitelist, and "banning" is removing it from that whitelist.
  - closeparen 7y ago
    I'll be absolutely stunned if people are really having to raise JIRA tickets instead of typing "brew install" but my information is secondhand so what do I know. Our laptops are configuration managed, force upgraded, and surveilled, but we all have root and IT has never stood in the way of "power user" behavior. The extent of the frustration in engineering is that their management processes sometimes eat CPU. My understanding is that most of the Valley is like this.
    - tbodt 7y ago
      https://github.com/google/santa https://github.com/google/santa is used to whitelist binaries on Macs, but you can fill out a form to instantly opt out. One of the options for why is "I use a package manager".
- jdashg 7y ago
  Most Google engineers don't have root on their own machines anymore.
  - tytso 7y ago
    That's not true; you can use "sudo" to get root access on gLinux desktops and servers.

milkthefat 7y ago

The Code execution vulns for both OSX and Win10 probably. In windows clicking a UNC path link would pass hashs. I believe for OSX there was an installer trick that allowed any code to run if triggered.

jmcnulty 7y ago
Those vulnerabilities are fixed in current versions: https://www.cvedetails.com/vulnerability-list/vendor_id-2159/Zoom.html https://www.cvedetails.com/vulnerability-list/vendor_id-2159... There is nothing new/outstanding.
- gwd 7y ago
  But those vulnerabilities were there, at least on OSX, because they were trying to avoid OSX's security warnings. And this is not the first time they've done something skanky like that. Once may have been an honest mistake; 2+ times is now a pattern.

vkou 7y ago

> Is there any technical merit to this ban? Installing third-party software on corp devices is generally a no-go at a lot of workplaces. With the security problems that Zoom has been having, it's only prudent of IT to ban its use on work devices. > Why would forcing use of web version mitigate any concerns? Because the web version runs in a browser sandbox, so there's a reduced risk of it compromising the security of the corp device. > The concerns I have heard are lack of proper end-to-end encryption, servers in China and the possibility to join chatrooms by guessing a name (zoom-bombing)). Googlers don't use Zoom for work, they use it for personal stuff, so that's not the problem. From the perspective of a generic IT department: Even if there aren't any security problems with having the client installed on your workstation - the problem is that when they've made so many amateurish security mistakes, it's difficult for IT to trust the binary blob that Zoom wants you to install on your computer. Corporate device security is a series of safety-versus-efficiency tradeoffs, made with incomplete information. Banning Zoom does not really compromise efficiency, if you aren't using it for work stuff.

magicsmoke 7y ago

https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/ https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto... "For those who have no choice but to use Zoom, including in contexts where secrets may be shared, we speculate that the browser plugin may have some marginally better security properties, as data transmission occurs over TLS." Apparently the web version doesn't use their homegrown encryption scheme.

dodobirdlord 7y ago

Using Zoom or any other videoconferencing app that might retain data for an internal meeting is presumably banned regardless, and unnecessary given that Google Meet exists. But some employees might need to use it to videoconference with customers and partners, and some employees might be using it for personal calls on their work laptop. Banning the native app of a company that is clearly 100% shady 100% of the time seems wise.