Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom fixes major Mac webcam security flaw with emergency patch

theverge.com

Post reply on HN
Print view View original

101–110 of 151 posts

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#101

Post by IshKebab »

oil25 wrote: post #65
Jedi72 wrote: post #28

The security flaw isnt even the outrageous part. It was secretly installing webservers that dont even remove themselves when you uninstall the app that makes them scum.

> It was secretly installing webservers that dont even remove themselves when you uninstall the app that makes them scum. To be fair, dragging an "app" to Trash does not constitute un-installation. It was a poor design decision to implement features using a local web server, but let's not be so quick to attribute covert, malicious intentions.

Erm yes it does. That's how it is supposed to work on Mac and that's how it would work if they didn't sneakily install a web server.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#102

Post by baq »

irq wrote: post #35
olliej wrote: post #16

Earlier quoted context omitted.

As a non-lawyer forum commentator I can say with absolute correctness that it will (or will not) maybe apply. More seriously: I would guess no, as the GDPR is concerned with data collection and compromise, but I can’t imagine they store all the video they forward. Of course I wouldn’t be surprised if someone sues them in the US (but given that the US sees companies as people for rights, but not punishment I imagine t…

“Can say”? Did you mean to write “cannot say”?

it doesn't matter, that's the joke

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#103

Post by rhinoceraptor »

rossng wrote: post #89
beobab wrote: post #86

Earlier quoted context omitted.

Is noisily deleting passwords acceptable in your eyes? (i.e. "Your password contains spaces, which is disallowed by our policy. Please try again.")

It's annoying in either case. Passwords should be any string I want! You're just going to hash it anyway. I found it particularly egregious that Zoom's form auto-trims any spaces from the end of the string - so they are deleted as you type with no feedback (unless you happen to be watching the dots flicker).

> You're just going to hash it anyway

Wow, you're optimistic :)

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#104

Post by Retric »

8ytecoder wrote: post #55
read_if_gay_ wrote: post #54

Earlier quoted context omitted.

That’s more of a reason not to trust anything ever. If leaders change for the worse, your investment in the company gets screwed no matter how well they’d done previously. And that investment can be stocks or it can be data, to give an example which you can’t just pull.

Leaders influence company culture but it's also a self-feedback loop where leaders that fit the company culture end up being leaders in the first place. To break that feedback loop and change course is usually a conscious choice for a company. Even then leadership change and direction at the top is only one of the many signals. It's entirely possible for Zoom's CEO to be a security minded person and the PM/Infosec pe…

Slow degradation to industry standards is the norm not the exception. That accelerates with growth as the original culture gets diluted.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#105

Post by dannyw »

azernik wrote: post #97
vinay_ys wrote: post #62

Let us be clear. Running a local helper agent that accepts properly formatted requests (includes authn/authz) to provide a valid expected functionality is a perfectly valid architectural choice for a full-fledged desktop computer and we shouldn't throw out this capability. The mistakes I see here are: - UX Dark Patterns – making uninstall hard/duplicitous - Helper process having security vulnerability - unauthenticat…

Running a local helper to take control from the browser is absolutely a bad architectural choice. The browser doesn't allow websites to open local programs without going through a user confirmation process for damned good reasons, and Zoom decided to put a lot of effort into circumventing that security measure to save users a click and so boost their conversion rates by a few percentage points.

It really sounds like what we need is:

“Always allow zoom.us to open ‘Zoom’” within browsers.

Even Spotify runs a local web server for this.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#106

Post by dannyw »

colechristensen wrote: post #76
xref wrote: post #73

Earlier quoted context omitted.

That’s the meat of it, Zoom wanted an app feature macOS said was a no-no so they coded up an insecure workaround. On iOS that would get your app pulled at the least.

I want an operating system with a permissions model which specifically forbids this kind of thing. My Linux desktops are also always full of processes which I have to dig to figure the purpose, unless I build my own distribution it's hard to make anything work which feels satisfactorily under control.

So how does your OS differenate between Apache and a local helper?

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#107

Post by vinay_ys »

azernik wrote: post #97
vinay_ys wrote: post #62

Let us be clear. Running a local helper agent that accepts properly formatted requests (includes authn/authz) to provide a valid expected functionality is a perfectly valid architectural choice for a full-fledged desktop computer and we shouldn't throw out this capability. The mistakes I see here are: - UX Dark Patterns – making uninstall hard/duplicitous - Helper process having security vulnerability - unauthenticat…

Running a local helper to take control from the browser is absolutely a bad architectural choice. The browser doesn't allow websites to open local programs without going through a user confirmation process for damned good reasons, and Zoom decided to put a lot of effort into circumventing that security measure to save users a click and so boost their conversion rates by a few percentage points.

Yep, those definitely are the dark patterns.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#108

Post by vinay_ys »

LaGrange wrote: post #90
vinay_ys wrote: post #74

Earlier quoted context omitted.

I disagree with declaring all helper agents as dark patterns. From a regular user point of view, it would be acceptable to have a helper agent as long as it follows: - platform provided background process methodology (example: launchd could launch your process when you hit the socket), - and it is made clearly apparent that such a thing is installed on your system (say, via system preferences panel, via status bar ic…

> From a regular user point of view, it would be acceptable It would be not, stop pretending acquiring consent from a statistical model counts as acquiring consent from the actual user. Thing you wrote may make it acceptable for you, but certainly ain't sufficient for me.

> It would be not, stop pretending acquiring consent from a statistical model counts as acquiring consent from the actual user.

I don't know what you are referring to here. Care to elaborate?

> Thing you wrote may make it acceptable for you, but certainly ain't sufficient for me.

This isn't about individual taste. Nothing I wrote above was about my personal taste. My point was about differentiating between the OS provided valid architectural mechanisms vs surreptitious dark patterns applied on top of it by an application developer.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#109

Post by RomanBob »

eeeeeeeeeeeee wrote: post #25

Glad to see the company is changing course, but I’m not sure it would have happened without the public shaming. I want companies to fix things because something is insecure and it endangers the public, not because they have their feet to the fire. I know companies don’t always respond right the first time, I know I haven’t, but Zoom had over 90 days to consider their responses and possible options / software changes.…

Companies are not interested in not endangering their users. They only care about making money. So you have the make endangering their users negative on their bottom-line.

This is a perfectly workable system, that does not require any party to not be selfish. It's a much better system that those that require somebody to be 'good' rather than 'rational'

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#110

Post by supernes »

colechristensen wrote: post #68
vinay_ys wrote: post #62

Let us be clear. Running a local helper agent that accepts properly formatted requests (includes authn/authz) to provide a valid expected functionality is a perfectly valid architectural choice for a full-fledged desktop computer and we shouldn't throw out this capability. The mistakes I see here are: - UX Dark Patterns – making uninstall hard/duplicitous - Helper process having security vulnerability - unauthenticat…

Helper agents are dark patterns. Unless installing an always running service on my device is directly related to the intended functionality of your software, setting one up is unwelcome and deceptive. Especially when it is done to work around existing security controls.

Helper agents are an integral part of said security controls, e.g. for XPC, privilege separation, etc.
Post reply on HN