3 ms·
> bad encounters with Zoom, previous cases where Zoom has dismissed or downplayed an exploit, etc. Have they? Their disclosure policy [1] sounds reasonable an
by mr_mitm 6y ago
> bad encounters with Zoom, previous cases where Zoom has dismissed or downplayed an exploit, etc.
Have they?
Their disclosure policy [1] sounds reasonable and their public response [2] to the recent accusations has been text book, if you ask me. They even hired top industry experts (Alex Stamos, Matthew Green, etc.) and acquired keybase to strengthen their security.
To me it looks like Zoom got lots of attention at once, and thus had lots of security issues at once, that would not be out of the ordinary if they had been more spread out. However, them lying to their customers about E2EE is hard to forgive.
[1] https://hackerone.com/zoom https://hackerone.com/zoom
[2] https://blog.zoom.us/a-message-to-our-users/ https://blog.zoom.us/a-message-to-our-users/
- ziddoap 6y agoAs I mentioned, I was just stating some generic reasons why a researcher may choose not to disclose specifically (and only) to the company in question.
- Freeboots 6y agoThey do seem to be taking it seriously, but their history of poor security well predates the recent influx of users. Before covid, all i knew about Zoom was "That video chat with all the exploits"