6 ms·

Zoom is basically malware with video chat.

by ianlevesque 5y ago

barbazoo 5y ago
Elaborate please
- infamouscow 5y ago
  This really should be self-evident
- miles 5y ago
  ‘Zoom is malware’: why experts worry about the video conferencing platform https://www.theguardian.com/technology/2020/apr/02/zoom-technology-security-coronavirus-video-conferencing https://www.theguardian.com/technology/2020/apr/02/zoom-tech... Zoom banned from New York City schools due to privacy and security flaws https://www.fastcompany.com/90486586/zoom-banned-from-new-york-city-schools-due-to-privacy-and-security-flaws https://www.fastcompany.com/90486586/zoom-banned-from-new-yo... Google Told Its Workers That They Can’t Use Zoom On Their Laptops Anymore https://www.buzzfeednews.com/article/pranavdixit/google-bans-zoom https://www.buzzfeednews.com/article/pranavdixit/google-bans... Elon Musk's SpaceX bans Zoom over privacy concerns https://www.reuters.com/article/us-spacex-zoom-video-commn/elon-musks-spacex-bans-zoom-over-privacy-concerns-memo-idUSKBN21J71H https://www.reuters.com/article/us-spacex-zoom-video-commn/e... Zoom lied to users about end-to-end encryption for years, FTC says https://arstechnica.com/tech-policy/2020/11/zoom-lied-to-users-about-end-to-end-encryption-for-years-ftc-says/ https://arstechnica.com/tech-policy/2020/11/zoom-lied-to-use... Zoom security issues: Here's everything that's gone wrong (so far) https://www.tomsguide.com/news/zoom-security-privacy-woes https://www.tomsguide.com/news/zoom-security-privacy-woes Maybe we shouldn’t use Zoom after all https://techcrunch.com/2020/03/31/zoom-at-your-own-risk/ https://techcrunch.com/2020/03/31/zoom-at-your-own-risk/ Attackers can use Zoom to steal users’ Windows credentials with no warning https://arstechnica.com/information-technology/2020/04/unpatched-zoom-bug-lets-attackers-steal-windows-credentials-with-no-warning/ https://arstechnica.com/information-technology/2020/04/unpat...
  - notwhereyouare 5y ago
    and on the front page currently: https://news.ycombinator.com/item?id=28210076 https://news.ycombinator.com/item?id=28210076
  - monocasa 5y ago
    I can't believe I'm saying this, but I'm not sure that last one is zoom's fault. It sounds like Zoom is just calling ShellExecute("open", link), and is getting blamed for the fact that Windows will then connect to random server on public internet and can be convinced to send a hash of the password that can be used to forge a different connection from a different host/client pair with the same credentials.
    - kamray23 5y ago
      I mean it is their fault, for a naïve implementation and trusting Windows.
      - monocasa 5y ago
        It's the mechanism meant for untrusted links, and it's the prescribed way for instance to open a link in the user's default browser. If Chrome took that link and started sending the user's password hash, that'd clearly be Chrome's fault. Same with, say, an ftp client that listened for ftp paths and would send replayable hashes as the first step. It's clearly SMB's terrible protocol. Yes they removed UNC paths to hack around this... but they shouldn't have to. Nope should they be expected to have known about this particular Windows footgun, IMO.
  - movedx 5y ago
    I'm really, really annoyed that you're being downvoted for providing citations: as f-ing requested! Thank you. These will make for some interesting reading.
- deleted 5y ago
  [deleted]
- humaniania 5y ago
  https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/ https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto...
dang 5y ago
Ok, but please don't post unsubstantive comments and/or shallow dismissals to Hacker News. It degrades discussion noticeably, and we're trying for better here. (Of course, the greater part of this damage is done by upvoters, but they can't upvote nothing.) https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- ianlevesque 5y ago
  Yeah I probably should’ve looked up the citations myself. People quickly swooped in with them at least.

Zoom is basically malware with video chat.

barbazoo 5y ago

Elaborate please

infamouscow 5y ago
This really should be self-evident
miles 5y ago
‘Zoom is malware’: why experts worry about the video conferencing platform https://www.theguardian.com/technology/2020/apr/02/zoom-technology-security-coronavirus-video-conferencing https://www.theguardian.com/technology/2020/apr/02/zoom-tech... Zoom banned from New York City schools due to privacy and security flaws https://www.fastcompany.com/90486586/zoom-banned-from-new-york-city-schools-due-to-privacy-and-security-flaws https://www.fastcompany.com/90486586/zoom-banned-from-new-yo... Google Told Its Workers That They Can’t Use Zoom On Their Laptops Anymore https://www.buzzfeednews.com/article/pranavdixit/google-bans-zoom https://www.buzzfeednews.com/article/pranavdixit/google-bans... Elon Musk's SpaceX bans Zoom over privacy concerns https://www.reuters.com/article/us-spacex-zoom-video-commn/elon-musks-spacex-bans-zoom-over-privacy-concerns-memo-idUSKBN21J71H https://www.reuters.com/article/us-spacex-zoom-video-commn/e... Zoom lied to users about end-to-end encryption for years, FTC says https://arstechnica.com/tech-policy/2020/11/zoom-lied-to-users-about-end-to-end-encryption-for-years-ftc-says/ https://arstechnica.com/tech-policy/2020/11/zoom-lied-to-use... Zoom security issues: Here's everything that's gone wrong (so far) https://www.tomsguide.com/news/zoom-security-privacy-woes https://www.tomsguide.com/news/zoom-security-privacy-woes Maybe we shouldn’t use Zoom after all https://techcrunch.com/2020/03/31/zoom-at-your-own-risk/ https://techcrunch.com/2020/03/31/zoom-at-your-own-risk/ Attackers can use Zoom to steal users’ Windows credentials with no warning https://arstechnica.com/information-technology/2020/04/unpatched-zoom-bug-lets-attackers-steal-windows-credentials-with-no-warning/ https://arstechnica.com/information-technology/2020/04/unpat...
- notwhereyouare 5y ago
  and on the front page currently: https://news.ycombinator.com/item?id=28210076 https://news.ycombinator.com/item?id=28210076
- monocasa 5y ago
  I can't believe I'm saying this, but I'm not sure that last one is zoom's fault. It sounds like Zoom is just calling ShellExecute("open", link), and is getting blamed for the fact that Windows will then connect to random server on public internet and can be convinced to send a hash of the password that can be used to forge a different connection from a different host/client pair with the same credentials.
  - kamray23 5y ago
    I mean it is their fault, for a naïve implementation and trusting Windows.
    - monocasa 5y ago
      It's the mechanism meant for untrusted links, and it's the prescribed way for instance to open a link in the user's default browser. If Chrome took that link and started sending the user's password hash, that'd clearly be Chrome's fault. Same with, say, an ftp client that listened for ftp paths and would send replayable hashes as the first step. It's clearly SMB's terrible protocol. Yes they removed UNC paths to hack around this... but they shouldn't have to. Nope should they be expected to have known about this particular Windows footgun, IMO.
- movedx 5y ago
  I'm really, really annoyed that you're being downvoted for providing citations: as f-ing requested! Thank you. These will make for some interesting reading.
deleted 5y ago
[deleted]
humaniania 5y ago
https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/ https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto...

dang 5y ago

Ok, but please don't post unsubstantive comments and/or shallow dismissals to Hacker News. It degrades discussion noticeably, and we're trying for better here. (Of course, the greater part of this damage is done by upvoters, but they can't upvote nothing.) https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

ianlevesque 5y ago
Yeah I probably should’ve looked up the citations myself. People quickly swooped in with them at least.