Zoom Has a Dark Side – and an FBI Warning
npr.org
npr.org
https://news.ycombinator.com/item?id=22762173
But a fear-mongering article like this has no place on HN. A "dark side"? "FBI warning"? This is pure propaganda and sensationalism -- that if someone joins your unprotected Zoom meeting, they can stream whatever they want (obviously) which could include pornography.
You might as well issue an FBI warning about phones because someone can randomly dial you and say gross stuff.
I don't have a problem with HN articles about legitimate security concerns around a newly popular tool, but linking it to pornography is pure fearmongering at its worst.
This article doesn't deserve to be here.
Orders of magnitude worse than anything Zoom ever did. Will it be reported with the same level of hair rending?
That said, I also agree with some of the sentiment here that it feels like there are a dozen articles per day posted about Zoom that are nothing more than hyperbole or worse, simply an aggregation of links to articles posted earlier in the week. I say this as someone who has argued against Zoom being used in my workplace and who refuses to install it on my machine (I use it through Chrome): I’ve simply started to roll my eyes each time I see a new Zoom post.
It’s easy for technologists to forget that video-conferencing was terribly, horribly broken not because of some terribly difficult technological challenge, but because the average user simply couldn’t get it to work.
Security always involves either bootstrapping of an existing trust, or some level of ease-of-use trade off.
For example, the calculus for “I need this meeting to start on time” and “My meeting password needs more entropy against brute force attacks” necessarily comes down on the side of starting the meeting in most threat environments.
But in the end I just don’t see Zoom as the evil empire, and I’m deeply suspicious of articles which try to convince me otherwise. I’m not sure where your perception of “growth at all costs” comes from.
From what I can tell, they make one of the best conferencing products on the market in terms of quality and usability. I think the privacy and security issues are significantly overblown.
For example, why refuse to install their client software? It seems highly unobtrusive, it’s not malware, nor spyware, nor adware... it doesn’t ever nag me or get in the way, or randomly start sapping CPU or give annoying update prompts. It’s quick and simple to install and uninstall. Overall it seems nicely written.
I see the “dirty tricks” they had to pull to make their install simpler overall as reasonable hacks aimed at improving their end user experience and increasing the percentage of users who are successfully able to get into a meeting.
Again, I think we tend to underestimate how hard using computers can be for so many people. Making video conferencing accessible to quarantined populations is pretty crucial right now.
Zoom doesn’t have a monopoly position to leverage like some do to pre-install their product on billions of devices. So they need every little bit they can find to make on boarding fast and easy.
They screwed up on their marketing of end-to-end encryption and should be fined by the FCC for that. I never saw that marketing claim, but nor would I stop using their product knowing that it’s not decentralized.
Except when it's security from Apple itself.
More like free advertising.
A massive proportion have heard of Zoom this week compared to last because of the PR. Pretty much an ideal free viral marketing campaign!
How about:
- A good UI which encourages users to do the correct thing - Systems to detect and block war dialers
Why should they have to? I don't get why Zoom doesn't just make the meeting ID longer.
Apparently there isn't enough going on in the world so every outlet feels the need to repeat previously disclosed information with less detail and more pearl clutching. At least npr was decent enough to link to some of the better sources.
Meanwhile we still get another few potential RCEs in Windows every month and the same editors are like "whatcha gonna do, bill gates amirite."
Now it's zoom, last year it was facebook, next year it will be someone else. Don't know what value this comment adds, just an observation.
At the same time Zoom clearly has some work to do. Having a strong Infosec team with proper release controls would solve many of the problems published to date.
Of course the list of mistakes is smaller than eg Microsoft's but it's also a much younger company and their attitude doesn't reflect a striving for better.
e.g. College Lectures giving online lectures. Employers hosting meetings.
Normally you pick software to your preference but things like social media have strong network effects. This is the battle thats being fought.
If you're going to make me use something I'm going to push back if it's not up to scratch. Otherwise I wouldn't care.
Anecdotal, sure, but I'm betting it's a good indicator - I work at a small, small, small, under-resourced community college in 'average' America. Zoom has been a thing on our campus for at least two years. We never really used it, because we didn't need to. Until about three weeks ago.
We chose it during our crisis planning sessions, because they were already in our space. They got in our space years ago through clever partnerships and integrations with our learning management system (online course delivery platforms). They were the 'preferred provider' according to the LMS teams, both on campus and nationally. They have automatic integration with our accessibility tools for live transcriptions/captions and interpreting. They were the suggested provider by our professional organizations related to disabilities, under-represented students, and ease-of-use technology. Therefore, we use them exclusively now.
Students never saw any of that back-end conversation, because it is literally irrelevant to their experience. But it was there, and it 100% impacted our conscious choice to move to zoom for live meetings.
If we were targeted for all of this, with a student population of <2000, I guaran-damn-tee larger institutions were.
A couple days ago, more scrupulous reporters were able to explain this succintly and help people avoid it.
Yes, Zoom should amend their bug bounty policy to allow for responsible disclosure, rather than non-disclosure, but it's not like they're alone in that failing, nor most of the other failings involved in this dogpile.
I like it when vendors are held to account, but the way that this has been reported over the last few days has seemed like more of a shakedown than a genuine consumer reporting effort.