Hacker News Reader

Comment by Nullabillity | Hacker News Reader

Err, no. It would be understandable if their servers buckled under the load or something. Zoom's blatant disregard for their users' security and privacy is unacceptable regardless of whether they have 5 or 5 million users.

> Any sw product has issues. The question is what the company does about it

See https://news.ycombinator.com/item?id=20389812, https://news.ycombinator.com/item?id=20390755

View on HN

And more recently, Zoom Is Leaking Peoples' Email Addresses and Photos to Strangers

https://news.ycombinator.com/item?id=22753675

This problem also seems to stem from the fact that Zoom has been used primarily in the corporate settings until now, which kinda validates their claim. Definitely not ideal, but understandable.

which exacerbates the problem.

A possible scenario is that users continue to browse the user directory and join meetings with their Zoom account even after leaving a company.

Companies that are concerned about this can set up SSO authentication with zoom I believe. So once the user is removed from the company’s directory server they wouldn’t have access to the zoom address list either.

I'm not dismissing the overall security point, but this seems like a pretty weak attack vector. If your company is routinely not deactivating accounts associated with your domain as part of your offboarding, being able to see e-mails and pictures of your employees is not your biggest problem.

Well, not if you still can log in to Zoom even if your email account was deactivated.

I let out an audible “wow” upon reading this. This is absolutely bone-headed and I have no idea how they thought automatically grouping members by their email domain name was a good idea.

You gotta figure, as soon as you starting writing a blacklist of “common” domains like gmail.com, hotmail.com, etc, your immediate thought should probably be “wait, maybe we’re doing this wrong.”

You’re right but I absolutely see why they are doing this. When I saw all my colleagues in the company list I immediately figured they only have the email domain and I found it extremely useful to see whom I can contact without explaining how zoom works. Privacy isn’t our most important concern right now, it’s keeping the world running, and this “feature” helped me/us (if only just a little bit) communicate more effectively.

I don't mean to be overly snarky, but removing authentication from all computers and servers would also help everyone (if only just a little bit) be more effective. It's still a bad idea, crisis or not.

Yep. And at the other end of the spectrum, never having users is the easiest way to maintain user privacy and security.

Why wouldn’t this be an opt in feature per-organization? I’m acme co, I buy a zoom subscription for acme.com, I click a box saying “let everyone with an acme.com email address see each other”. Done. Yes, I would have to prove I own acme.com, but we have solutions for that (didn’t set out to make this joke but, the ACME protocol, for one.)

Why is it that it’s on by default for arbitrary domains (excepting the ones some poor soul has to blacklist)?

... by that special definition of "unacceptable" that means "It's been wildly accepted."

If this situation isn't a mass condemnation of the idea users care about security or privacy more than usability, I don't know what is.

Other than Zoom stockholders, I’m unsure why this comment is being downvoted. It seems entirely factual and provides references.

Reply on news.ycombinator.com