Hacker News Reader

Comment by ziddoap | Hacker News Reader

Just spitballing here, but it could be due to previous bad encounters with Zoom, previous cases where Zoom has dismissed or downplayed an exploit, etc. Is Zoom one of those companies that requires excessive NDA's for exploits? That could be a factor.

I can think of a few other reasons, although it probably would have been better to disclose to Zoom /alongside/ whoever else they thought should get it.

View on HN

> bad encounters with Zoom, previous cases where Zoom has dismissed or downplayed an exploit, etc.

Have they?

Their disclosure policy [1] sounds reasonable and their public response [2] to the recent accusations has been text book, if you ask me. They even hired top industry experts (Alex Stamos, Matthew Green, etc.) and acquired keybase to strengthen their security.

To me it looks like Zoom got lots of attention at once, and thus had lots of security issues at once, that would not be out of the ordinary if they had been more spread out. However, them lying to their customers about E2EE is hard to forgive.

[1] https://hackerone.com/zoom

[2] https://blog.zoom.us/a-message-to-our-users/

As I mentioned, I was just stating some generic reasons why a researcher may choose not to disclose specifically (and only) to the company in question.

They do seem to be taking it seriously, but their history of poor security well predates the recent influx of users.

Before covid, all i knew about Zoom was "That video chat with all the exploits"

Reply on news.ycombinator.com