kerng

60 ms·

661.
by kerng 7y ago
This is a great summary of the ongoing issues, it however does miss a few things. Including a security vulnerability in their lobby feature that has privately been reported to Zoom by CitizenLab the other day - and which still needs fixing.
662.
by kerng 7y ago
Correct - but it also shows that they continue to actively mislead people.
663.
by kerng 7y ago
Thanks for highlighting this, i totally missed that there is waiting room security issue pending disclosure.
664.
by kerng 7y ago
Your comment above mentions chat encryption- not video..
665.
by kerng 7y ago
They are behind with their responses, what about the ECB usage? https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto... That by itself might render encryption claims from Zoom as meaningless.
666.
by kerng 7y ago
Seems plausible. My issue with companies that do bug bounties often is that they appear to use it as a replacement (not an addition) for doing any internal security or penetrating testing. Which at times is obvious by the low hanging fruit
667.
by kerng 7y ago
It would be good for the title to contain that the encryption they use is broken.
668.
by kerng 7y ago
Yep, showing up to uninvited random meetings by guessing IDs is now called Zoombombing apparently
669.
by kerng 7y ago
They are using EBC mode? I don't know of a single crypto library that would pick that as a default, so someone actually made this decision (like actively lowered encryption capability). I thought of some of the previous issues of not b
670.
by kerng 7y ago
Not a single reference to the actual creator of this model, John Boyd, a fighter pilot.
671.
by kerng 7y ago
Maybe naive, but why doesnt Zooom do something like SSO? Why is the identity of attendees not validated? Wouldn't that solve the problem?
672.
by kerng 7y ago
Agreed, Microsoft has been running cloud services for long time, even before the cloud got its name. Things like Windows Update, Xbox Live, MSN, Hotmail... some of them have been around for 20+ years.
673.
by kerng 7y ago
GDPR, CCPA, etc. Things are changing in the industry and law makers are slowly catching up to protect their citizens.
674.
by kerng 7y ago
They are making a lot of money at the cost of putting their users at risk - a big fine seems in order.
675.
by kerng 7y ago
Companies that are under ITAR take security indeed seriously- this is not your average ad-selling business.
676.
by kerng 7y ago
I'm curious what actual infection and death rates are in China- there seems to be no mentioning in the article. Given what is happening in Italy and Spain, its probably horrible. :(
677.
by kerng 7y ago
This should also allow relay attacks, so password recovery isn't the only attack angle.
678.
by kerng 7y ago
Thanks for sharing. I'm not too concerned about engineering happening in China but data storage seems problematic, especially because of the lack of encryption on their side. The post or the CNBC link don't seem to have the word T
679.
by kerng 7y ago
The good thing according to the article is that supermarkets will hand them out - I assume, for free.
680.
Google: Ending Support for Multiplayer APIs in Play Games Services(support.google.com)
26 points by kerng 7y ago|7 comments
681.
by kerng 7y ago
Switching to C# is straight forward - for majority of projects you won't need many language specific features. Most operations are about increasing counters, performing if and switch scenarios, some event messaging, and doing math and
682.
by kerng 7y ago
Does Facebook still use Phabricator?
683.
by kerng 7y ago
Imperial college says it's about 0.8% with the data available at this point.
684.
by kerng 7y ago
The word quarantine comes from having to spend 40 days mooring outside of Venice before being allowed to enter for trade.
685.
by kerng 7y ago
It's interesting how much different, and even opposing information is floating around. Just the other day I read an article that said masks are bad because you will and need to touch your face more often... Regardless, most reputable s
686.
by kerng 7y ago
Applying both is better, then just depending on one of them.
687.
by kerng 7y ago
Apparently Austria just banned any gatherings of 5+ people. Are we in the US behind?
688.
by kerng 7y ago
They have the strategic vision to do zero trust with whatever ships out of box, but not more. Like we use GSuites and have MFA, all our problems are solved because we now are BeyondCorp. That's marketing speak.
689.
by kerng 7y ago
Exactly, endpoints should not be listening on the network for instance (its not just about outbound connectivity). Company laptops often have RDP or SSH open - and newly added software might expose a remote endpoint in future (or a 0 day, l
690.
by kerng 7y ago
Organizations that have high value assets would deploy multiple layers of these, not just one, basically depending on value of assets.

More ›