3 ms·

Not sure how confidential that conference was but I'd imagine these use at least a 2FA dongle to authenticate. This is surprising.

pkz 6y ago
It was a six-digit pin of which 5 digits were accidentally shown in a tweet from the Dutch Defence Minister Ank Bijleveld.
j0057 6y ago
You'd imagine, but this conference software apparently only requires a pin that's visible as a GET parameter in the URL. I don't think you can blame the users for posting a screen shot.
- claudex 6y ago
  In this case, you can blame the user. They are the minister of defense, they can (and should) request an audit for the conference system they use. Personally, I think that they didn't want a more secure system like 2FA because it's not convenient for them.
- jakub_g 6y ago
  Zoom introduced meeting passwords a few months ago after similar issues to prevent randos joining meetings by guessing short meeting IDs. But there's a tradeoff between security and usability so they accept passwords as a param in URL, which for 95% cases is a good tradeoff (for example Outlook Zoom plugin generates the URL with password directly in meeting invites). Most people don't live-share their super secret in-progress meeting IDs and passwords on Twitter. Probably more people share their CC number or boarding passes on instagram each day. However what Zoom and other conf tools could do is that they could read the password from the URL and then use `history.pushState()` DOM API to replace the URL and erase the password once the meeting is launched. Downside would be though users wouldn't be able anymore to just copy the URL from browser's URL bar and send to other people to join.
  - TeMPOraL 6y ago
    Or, they could use a hash of the password in the URL, that's always longer than what will fit in the visible part of the address box.
claudex 6y ago
Some sources said they will hold off further meetings until the security is improved.
pkz 6y ago
Had the laptop had a 15 inch screen it would likely have shown the entire URL including the full PIN code. Also visible in the screen are bookmarks to Netflix and what looks like barber shop music. Also a Gmail tab open. Did now know defense ministers were using Gmail on official hardware...
- rapnie 6y ago
  Everyone and their mother uses Google services for their personal and/or confidential stuff, going from blind faith or just never thinking about it. After all it is good old Google, not some large surveillance capitalist.. Oh wait.

pkz 6y ago

It was a six-digit pin of which 5 digits were accidentally shown in a tweet from the Dutch Defence Minister Ank Bijleveld.

j0057 6y ago

You'd imagine, but this conference software apparently only requires a pin that's visible as a GET parameter in the URL. I don't think you can blame the users for posting a screen shot.

claudex 6y ago
In this case, you can blame the user. They are the minister of defense, they can (and should) request an audit for the conference system they use. Personally, I think that they didn't want a more secure system like 2FA because it's not convenient for them.
jakub_g 6y ago
Zoom introduced meeting passwords a few months ago after similar issues to prevent randos joining meetings by guessing short meeting IDs. But there's a tradeoff between security and usability so they accept passwords as a param in URL, which for 95% cases is a good tradeoff (for example Outlook Zoom plugin generates the URL with password directly in meeting invites). Most people don't live-share their super secret in-progress meeting IDs and passwords on Twitter. Probably more people share their CC number or boarding passes on instagram each day. However what Zoom and other conf tools could do is that they could read the password from the URL and then use `history.pushState()` DOM API to replace the URL and erase the password once the meeting is launched. Downside would be though users wouldn't be able anymore to just copy the URL from browser's URL bar and send to other people to join.
- TeMPOraL 6y ago
  Or, they could use a hash of the password in the URL, that's always longer than what will fit in the visible part of the address box.

claudex 6y ago

Some sources said they will hold off further meetings until the security is improved.

pkz 6y ago

Had the laptop had a 15 inch screen it would likely have shown the entire URL including the full PIN code. Also visible in the screen are bookmarks to Netflix and what looks like barber shop music. Also a Gmail tab open. Did now know defense ministers were using Gmail on official hardware...

rapnie 6y ago
Everyone and their mother uses Google services for their personal and/or confidential stuff, going from blind faith or just never thinking about it. After all it is good old Google, not some large surveillance capitalist.. Oh wait.