271–280 of 473 posts
Well, the company and product are dead to me now, gonna hassle our CTO to switch. I just really hope theres some dev at Zoom who hated this whole installing backdoors idea who's gonna have the greatest "I told you so" day at the office tomorrow.
I've lost all trust in Zoom at this point
Click on the app icon, hold, move to Trash.
It is mentioned in the third paragraph already, highlighted in green. They don't offer a method of clean removal to their users. They run a web server on your machine that will reinstall Zoom on your macOS whenever it is convenient for them (secretly, without asking you first). See here: https://apple.stackexchange.com/questions/358651/unable-to-c... That web server is exploitable, as explained in the article. Note t…
Earlier quoted context omitted.
It's mentioned in the article. After uninstalling the main application, you also have to kill the helper app named ZoomOpener. The article gives some Terminal commands to do this, but you should be able to find it in Activity Monitor if your more comfortable there. Once you kill ZoomOpener, remove it from the list of Login Items in System Preferences -> Users & Groups. Lastly delete the folder called .zoomus from you…
Now go explain that to the folks in Marketing.
Earlier quoted context omitted.
RingCentral Meetings uses zoom.us engine but the local server runs on port 19424 instead. I'm able to replicate the issue on it. PoC: http://localhost:19424/launch?action=join&confno=3535353535
In my case it's 19421 as written in the article.
I've lost all trust in Zoom at this point
(prior reply deleted once I read about the fucking local webserver & phantom reinstallation bullshit. Fuck zoom.)
They already have you on video at that point. The summary above is very fair, there's no point trying to throw more PR at this problem. Ignoring other issues and focusing on the main point: They need to increase security by a huge amount by implementing a simple dialog with "Yes" not selected as default. They also need to communicate why they did this to their users and be honest.
I've lost all trust in Zoom at this point
(prior reply deleted once I read about the fucking local webserver & phantom reinstallation bullshit. Fuck zoom.)
In my experience (the energy sector), most of the people I interact with on Zoom would definitely fall for joining some random meeting that popped up. They are incredibly good at their field of expertise, but certainly doofuses when it comes to knowing how to click on things in zoom.
Zoom’s response to this[1] is a wonderful example of how not to respond to security issues. It includes the classic tropes: * Our users don’t care about security. > Our video-first platform is a key benefit to our users around the world, and our customers have told us that they choose Zoom for our frictionless video communications experience. * We have no way of knowing if this has been exploited in the wild, so it’s…
TBH, they're not as dismissive as you're sounding them to be
How do you recommend uninstalling this?
From the article: > To shut down the web server, run lsof -i :19421 to get the PID of the process, then do kill -9 [process number]. Then you can delete the ~/.zoomus directory to remove the web server application files. > To prevent this server from being restored after updates you can execute the following in your terminal: rm -rf ~/.zoomus touch ~/.zoomus
My guess is that if sometime in the future you want to use zoom again, the install will fail until you remove the file ~/.zoom
Earlier quoted context omitted.
You might be able to remove this with https://github.com/Lord-Kamina/SwiftDefaultApps
I’ve opted to remove Zoom instead.