5 ms·

Zoom is the Windows of conferencing apps: It is the most popular one, so researchers actually look at it and say it's shit, but the alternatives aren't much bet

by mhils 6y ago

Zoom is the Windows of conferencing apps: It is the most popular one, so researchers actually look at it and say it's shit, but the alternatives aren't much better [1]. [1] Just one example: https://github.com/jitsi/docker-jitsi-meet/blob/master/CHANGELOG.md#stable-4384-1 https://github.com/jitsi/docker-jitsi-meet/blob/master/CHANG...

Dunedan 6y ago
Here is another example: Tracking in the mobile apps for Jitsi Meet without the ability to opt-out (which the Jitsi developers apparently consider to be fine): https://github.com/jitsi/jitsi-meet/issues/5799 https://github.com/jitsi/jitsi-meet/issues/5799
- jimbob45 6y ago
  Looks legitimate - real shame. This prevents me from being able to recommend this to my friends. I hope it was worth it for 8x8.
  - number6 6y ago
    The bin from fdroid comes without tracking
    - jimbob45 6y ago
      I’m on iOS though. I read through the Q&A and it kind like the tracking is done because Crashlytics, something they integrate with, got bought out by Google. I don’t know how much solace that brings me, though.
      - joking 6y ago
        use the webapp then, or use the jitsi sdk for ios or android and build your own app. They even don't enable some tracking when you are not using their servers and use your own. Anyone who has published an app to any of the app stores, recognizes the valuable information than services like crashlytics provide and the hundreds of ways an app can crash on the user devices. You may be don't like how it is, but as the parent said, that's not an app issue neither github issues is the place to discuss it.
- brownbat 6y ago
  > which the Jitsi developers apparently consider to be fine I expected the devs in the link to get caught saying something like "Yolo! Move fast and break things!" Instead they had a pretty reasonable response considering the circumstances. You don't have to use the app stores you don't like to use the service, they don't actually seek or store personal data, they don't use any data they do have for marketing, the use of those services falls under an identified GPDR exception, the other services they rely on for the service also have GPDR obligations with respect to any data they should collect, etc. But even after all that, the devs realized they aren't professional lawyers. So what do they do? Ignore it all? No, they hire some. What did those lawyers say? Looks good, looks compliant. So you've hired counsel, they say, "Good job, green light." Then someone on GitHub says, "But I have a different legal theory than the people you specifically hired to tell you how the law works!" What do you tell someone in that situation? Fire your counsel and instead rely on advice from random strangers on the internet? Or... there are a lot of people with crazy theories on the internet. I thought it was big of emcho to, even seeming pretty confident Alvar was mistaken, still put him in touch with his legal team. Because, I'm not a professional GPDR expert, maybe the random internet stranger is right this time? But if Alvar's right, GitHub isn't really equipped to figure that out. This has to be a conversation with lawyers. Backing up a step... Zoom rolls their own crypto, routes calls through China, and has a mysterious 10 char hard limit on passwords. They're also massively more popular. Zoom's CEO has been admirably up front about how they're fixing some of these issues, but I'm not sure why a speculative GPDR complaint about a much less common service should get the same prominent media coverage.
prophesi 6y ago
The Jitsi alternative is open-source, so it's much easier to take a look at its security. That link just proves that they're doing their best to fix security issues that the community finds. You can't prove the same with Zoom; it had to wait until their default of password-less rooms were exploited to the point of the media catching on for it to be changed. And for a sister comment noting their usage of app analytics; all three services that they use are GDPR-compliant, and you can install a "libre" version via F-Droid for Android. Very, very minor issues in comparison to Zoom's privacy & security issues.
microcolonel 6y ago
But honestly, the main reason people use Zoom is that it is by far the most reliable video conferencing app out there. Anyone who has used other video conferencing systems on uncontrolled networks knows the pain that Zoom seems to magically avoid. Now, it seems lately others have been getting better, but I'm not really sure what the source of that is; when I've been pulled into Zoom calls over the last five years, they've been absolutely rock-solid.
- bengale 6y ago
  This has been my experience, zoom has been flawless while our team has had to go remote.
- asdkhadsj 6y ago
  Yea, agreed. I've had tons of problems with Windows, and over the years I ended up using Zoom because it was rock solid compared to the competition[1]. The comparison seems unfair, perhaps too kind to windows[2]. [1]: This was several years ago, competition these days may be more on par with Zoom. [2]: I imagine windows is becoming more stable these days. Again, my comment may be unfair to modern windows.
- microcolonel 6y ago
  Separate from whether it works or not, I will not install it unsandboxed on any endpoints, nor use it deliberately. Their security architecture is ???, and their excuse for its use of servers in PRC to move encryption secrets makes no sense, and honestly gives me the impression that at some level, somebody working on Zoom made that decision with the conscious intention to make secrets available to the PLA.
- FabHK 6y ago
  One reason it works so well is that it makes your computer wide open. If you dispense with security and privacy, of course everything works just so much easier.
shezi 6y ago
I disagree with that example. This bug is exposing a server side infrastructure password and has nothing to do with user safety. Of course, as an operator of servers on the Internet, one must be aware of risks of bugs. This article talks about the security of the client application, which has been in the news recently. There was little news on the zoom infrastructure security, so we might as well guess about that. Apart from that, the bug you mentioned was found and fixed by the community, and someone scanned all servers and notified the server operators. I'd say that this is about the most professional response to a vulnerability I've ever seen.
ris 6y ago
This is not a comparable example. It only relates to the possibility of conference content being intercepted. The linked article's concern is over every client machine which has the software installed being exploited. This is not something possible (or at least anywhere near as likely) with browser-based conferencing. And zoom really only seems to offer this as a last-ditch option, the vast majority of users I'm certain ending up installing the software. It's something which I think has received far too little attention amongst the recent security focus over zoom. How traffic is routed is a bit of a red herring if you ask me. The galling thing is how the web community put a lot of effort into figuring out a sensible security model for apps' access to webcams and microphones, and the first thing popular services do is lead people to completely circumvent that and grant permanent high level privileges with seemingly little thought.
consonaut 6y ago
As someone who has recently adopted Zoom and who has to justify this decision quite a lot, my question is where are all the exploits? If any of this is easily exploitable there would be such a shitstorm about it. Considering the current usage everybody would know about it. To me, these look like things that could be used for local escalation or MITM attacks. This is not good but frankly, for most of Zooms use cases, it's not an issue. The only frightening thing is the turbojpeg.dll one. A POC that leads to an RCE or even a crash would be devastating for Zoom, especially considering the amount of edu setups that don't enforce passwords even now. IDK, for me and the edu organization I'm responsible for Zoom has been a great offering (especially considering the pricing they were able to offer by default for edu and after very little negotiation) but we are actively looking at teams as a successor for the next semester. Zoom has had 3 killer features over teams (virtual background, easy dial-in, no effort guests) and all of them have gone away now with the recent teams changes. If teams finally gets customer skype calling figured out Zoom will most likely be done in the edu field because that's quite a big part of switching to teams for an all out integrated comms solution, especially since you can't use your office 365 account for consumer skype.
- staticassertion 6y ago
  There are exploits though - for example, the lowest barrier to exploit vulns like 'zoom bombing' are being exploited quite often. Others, like perhaps an RCE, are not being seen. This is for a lot of reasons. * Many are being found by whitehats/ researchers, so by the time they're made public an attacker is already playing catch-up - it can take days or weeks to build a good exploit chain, so starting from "A patch is out" or "The vuln is disclosed" is not encouraging. * In general, exploitation of vulnerabilities is actually quite rare. Patching practices, mitigation strategies, etc, have radically improved over the last decade. It isn't that the attackers can't do it, but the majority of attacks will just phish you, install malware, and try to make money the simplest way possible. Does that mean you accept that risk of vulnerable software? These are not strong mitigating factors and are mostly about risk profiling and motivation. So that decision is up to you.
ptrenko 6y ago
I wonder what allows Zoom to have a $20B market cap with such silly security loopholes? Like isnt that a consideration in enterprise

by mhils 6y ago

Dunedan 6y ago

Here is another example: Tracking in the mobile apps for Jitsi Meet without the ability to opt-out (which the Jitsi developers apparently consider to be fine): https://github.com/jitsi/jitsi-meet/issues/5799 https://github.com/jitsi/jitsi-meet/issues/5799

jimbob45 6y ago
Looks legitimate - real shame. This prevents me from being able to recommend this to my friends. I hope it was worth it for 8x8.
- number6 6y ago
  The bin from fdroid comes without tracking
  - jimbob45 6y ago
    I’m on iOS though. I read through the Q&A and it kind like the tracking is done because Crashlytics, something they integrate with, got bought out by Google. I don’t know how much solace that brings me, though.
    - joking 6y ago
      use the webapp then, or use the jitsi sdk for ios or android and build your own app. They even don't enable some tracking when you are not using their servers and use your own. Anyone who has published an app to any of the app stores, recognizes the valuable information than services like crashlytics provide and the hundreds of ways an app can crash on the user devices. You may be don't like how it is, but as the parent said, that's not an app issue neither github issues is the place to discuss it.
brownbat 6y ago
> which the Jitsi developers apparently consider to be fine I expected the devs in the link to get caught saying something like "Yolo! Move fast and break things!" Instead they had a pretty reasonable response considering the circumstances. You don't have to use the app stores you don't like to use the service, they don't actually seek or store personal data, they don't use any data they do have for marketing, the use of those services falls under an identified GPDR exception, the other services they rely on for the service also have GPDR obligations with respect to any data they should collect, etc. But even after all that, the devs realized they aren't professional lawyers. So what do they do? Ignore it all? No, they hire some. What did those lawyers say? Looks good, looks compliant. So you've hired counsel, they say, "Good job, green light." Then someone on GitHub says, "But I have a different legal theory than the people you specifically hired to tell you how the law works!" What do you tell someone in that situation? Fire your counsel and instead rely on advice from random strangers on the internet? Or... there are a lot of people with crazy theories on the internet. I thought it was big of emcho to, even seeming pretty confident Alvar was mistaken, still put him in touch with his legal team. Because, I'm not a professional GPDR expert, maybe the random internet stranger is right this time? But if Alvar's right, GitHub isn't really equipped to figure that out. This has to be a conversation with lawyers. Backing up a step... Zoom rolls their own crypto, routes calls through China, and has a mysterious 10 char hard limit on passwords. They're also massively more popular. Zoom's CEO has been admirably up front about how they're fixing some of these issues, but I'm not sure why a speculative GPDR complaint about a much less common service should get the same prominent media coverage.

prophesi 6y ago

The Jitsi alternative is open-source, so it's much easier to take a look at its security. That link just proves that they're doing their best to fix security issues that the community finds. You can't prove the same with Zoom; it had to wait until their default of password-less rooms were exploited to the point of the media catching on for it to be changed. And for a sister comment noting their usage of app analytics; all three services that they use are GDPR-compliant, and you can install a "libre" version via F-Droid for Android. Very, very minor issues in comparison to Zoom's privacy & security issues.

microcolonel 6y ago

But honestly, the main reason people use Zoom is that it is by far the most reliable video conferencing app out there. Anyone who has used other video conferencing systems on uncontrolled networks knows the pain that Zoom seems to magically avoid. Now, it seems lately others have been getting better, but I'm not really sure what the source of that is; when I've been pulled into Zoom calls over the last five years, they've been absolutely rock-solid.

bengale 6y ago
This has been my experience, zoom has been flawless while our team has had to go remote.
asdkhadsj 6y ago
Yea, agreed. I've had tons of problems with Windows, and over the years I ended up using Zoom because it was rock solid compared to the competition[1]. The comparison seems unfair, perhaps too kind to windows[2]. [1]: This was several years ago, competition these days may be more on par with Zoom. [2]: I imagine windows is becoming more stable these days. Again, my comment may be unfair to modern windows.
microcolonel 6y ago
Separate from whether it works or not, I will not install it unsandboxed on any endpoints, nor use it deliberately. Their security architecture is ???, and their excuse for its use of servers in PRC to move encryption secrets makes no sense, and honestly gives me the impression that at some level, somebody working on Zoom made that decision with the conscious intention to make secrets available to the PLA.
FabHK 6y ago
One reason it works so well is that it makes your computer wide open. If you dispense with security and privacy, of course everything works just so much easier.

shezi 6y ago

I disagree with that example. This bug is exposing a server side infrastructure password and has nothing to do with user safety. Of course, as an operator of servers on the Internet, one must be aware of risks of bugs. This article talks about the security of the client application, which has been in the news recently. There was little news on the zoom infrastructure security, so we might as well guess about that. Apart from that, the bug you mentioned was found and fixed by the community, and someone scanned all servers and notified the server operators. I'd say that this is about the most professional response to a vulnerability I've ever seen.

ris 6y ago

This is not a comparable example. It only relates to the possibility of conference content being intercepted. The linked article's concern is over every client machine which has the software installed being exploited. This is not something possible (or at least anywhere near as likely) with browser-based conferencing. And zoom really only seems to offer this as a last-ditch option, the vast majority of users I'm certain ending up installing the software. It's something which I think has received far too little attention amongst the recent security focus over zoom. How traffic is routed is a bit of a red herring if you ask me. The galling thing is how the web community put a lot of effort into figuring out a sensible security model for apps' access to webcams and microphones, and the first thing popular services do is lead people to completely circumvent that and grant permanent high level privileges with seemingly little thought.

consonaut 6y ago

As someone who has recently adopted Zoom and who has to justify this decision quite a lot, my question is where are all the exploits? If any of this is easily exploitable there would be such a shitstorm about it. Considering the current usage everybody would know about it. To me, these look like things that could be used for local escalation or MITM attacks. This is not good but frankly, for most of Zooms use cases, it's not an issue. The only frightening thing is the turbojpeg.dll one. A POC that leads to an RCE or even a crash would be devastating for Zoom, especially considering the amount of edu setups that don't enforce passwords even now. IDK, for me and the edu organization I'm responsible for Zoom has been a great offering (especially considering the pricing they were able to offer by default for edu and after very little negotiation) but we are actively looking at teams as a successor for the next semester. Zoom has had 3 killer features over teams (virtual background, easy dial-in, no effort guests) and all of them have gone away now with the recent teams changes. If teams finally gets customer skype calling figured out Zoom will most likely be done in the edu field because that's quite a big part of switching to teams for an all out integrated comms solution, especially since you can't use your office 365 account for consumer skype.

staticassertion 6y ago
There are exploits though - for example, the lowest barrier to exploit vulns like 'zoom bombing' are being exploited quite often. Others, like perhaps an RCE, are not being seen. This is for a lot of reasons. * Many are being found by whitehats/ researchers, so by the time they're made public an attacker is already playing catch-up - it can take days or weeks to build a good exploit chain, so starting from "A patch is out" or "The vuln is disclosed" is not encouraging. * In general, exploitation of vulnerabilities is actually quite rare. Patching practices, mitigation strategies, etc, have radically improved over the last decade. It isn't that the attackers can't do it, but the majority of attacks will just phish you, install malware, and try to make money the simplest way possible. Does that mean you accept that risk of vulnerable software? These are not strong mitigating factors and are mostly about risk profiling and motivation. So that decision is up to you.

ptrenko 6y ago

I wonder what allows Zoom to have a $20B market cap with such silly security loopholes? Like isnt that a consideration in enterprise