Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom fixes major Mac webcam security flaw with emergency patch

theverge.com

Post reply on HN
Print view View original

91–100 of 151 posts

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#91

Post by iguy »

rossng wrote: post #89
beobab wrote: post #86

Earlier quoted context omitted.

Is noisily deleting passwords acceptable in your eyes? (i.e. "Your password contains spaces, which is disallowed by our policy. Please try again.")

It's annoying in either case. Passwords should be any string I want! You're just going to hash it anyway. I found it particularly egregious that Zoom's form auto-trims any spaces from the end of the string - so they are deleted as you type with no feedback (unless you happen to be watching the dots flicker).

Does it matter? I mean is there another way of entering this string which preserves the spaces, or is deleting them just part of the hash function?

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#92

Post by rossng »

iguy wrote: post #91
rossng wrote: post #89

Earlier quoted context omitted.

It's annoying in either case. Passwords should be any string I want! You're just going to hash it anyway. I found it particularly egregious that Zoom's form auto-trims any spaces from the end of the string - so they are deleted as you type with no feedback (unless you happen to be watching the dots flicker).

Does it matter? I mean is there another way of entering this string which preserves the spaces, or is deleting them just part of the hash function?

Yes, you can paste a string with internal spaces. I guess you can also disable JS and type whatever you want. Passwords with spaces work absolutely fine, too - it's just the signup form that is broken.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#93

Post by z3t4 »

rossng wrote: post #89
beobab wrote: post #86

Earlier quoted context omitted.

Is noisily deleting passwords acceptable in your eyes? (i.e. "Your password contains spaces, which is disallowed by our policy. Please try again.")

It's annoying in either case. Passwords should be any string I want! You're just going to hash it anyway. I found it particularly egregious that Zoom's form auto-trims any spaces from the end of the string - so they are deleted as you type with no feedback (unless you happen to be watching the dots flicker).

I remember when I started out with SQL databases, someone managed to hack the site using SQL injects. So I made a SQL sanitation function, but soon enough someone complained that they couln't have escape characters in their password. =) Now a days I always use a library that parameterize all SQL variables to avoid SQL injections.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#95

Post by comex »

oil25 wrote: post #70
diafygi wrote: post #42

I'm confused. Does the patch now make it to where if you drag the app to the trash, it actually uninstalls?

A macOS "app" is just a directory with an executable binary and some convenient helper files for Finder. Dragging it to the trash does not remove artifacts, such as logs, supporting binaries, even methods of persistence, which may get placed somewhere else on the filesystem as part of a typical installation. This is not unique to Zoom or even Apple operating systems.

However, if you're going to automatically install a daemon, you can and should make that daemon check whether the originating app still exists, and automatically uninstall itself if not.

(Better still, reconsider whether you really need a daemon in the first place...)

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#96

Post by azernik »

Phlarp wrote: post #61
crazysim wrote: post #58

Earlier quoted context omitted.

What's scary is that they have a bounty program but it comes with a gag catch.

Most corporate bounty programs are going to include an NDA and following their release schedule. No corporate legal department is going to sign off on a bounty program that would both pay third parties for bugs and allow outside researchers to unilaterally decide when to disclose the bug to a wider audience.

They include an NDA, but a time-limited one - i.e. they require the researcher to give them a period of time (usually 90 days or more) to create, test, and deploy a fix, after which time the researcher can publish. Zoom's NDA was a permanent gag order, which puts no pressure on the company to actually fix the issue and doesn't alert laggard users that they need to update their software.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#97

Post by azernik »

vinay_ys wrote: post #62

Let us be clear. Running a local helper agent that accepts properly formatted requests (includes authn/authz) to provide a valid expected functionality is a perfectly valid architectural choice for a full-fledged desktop computer and we shouldn't throw out this capability. The mistakes I see here are: - UX Dark Patterns – making uninstall hard/duplicitous - Helper process having security vulnerability - unauthenticat…

Running a local helper to take control from the browser is absolutely a bad architectural choice. The browser doesn't allow websites to open local programs without going through a user confirmation process for damned good reasons, and Zoom decided to put a lot of effort into circumventing that security measure to save users a click and so boost their conversion rates by a few percentage points.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#100

Post by lifthrasiir »

gok wrote: post #52
lawnchair_larry wrote: post #36

Earlier quoted context omitted.

Responsible disclosure doesn’t mean anything. It’s an obsolete term. You’re referring to coordinated disclosure. https://blogs.technet.microsoft.com/ecostrat/2010/07/22/coor...

This case is actually a really great demonstration of why this often-repeated claim is false. This was responsible, but not coordinated, disclosure.

Only in the literal sense. A commonly cited issue on the term "responsible disclosure" is that the discoverer is responsible for one's action, even though the action indeed benefits the public. In this viewpoint the vender can argue that it is not responsible to ignore the vendor, even though the vendor itself is being unreasonable. The term "coordinated disclosure" is invented to fix this abuse. You can't literally interpret "responsible" or "coordinated" without this context.
Post reply on HN