Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom fixes major Mac webcam security flaw with emergency patch

theverge.com

Post reply on HN
Print view View original

121–130 of 151 posts

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#121

Post by o-__-o »

yoz-y wrote: post #87
oil25 wrote: post #70

Earlier quoted context omitted.

A macOS "app" is just a directory with an executable binary and some convenient helper files for Finder. Dragging it to the trash does not remove artifacts, such as logs, supporting binaries, even methods of persistence, which may get placed somewhere else on the filesystem as part of a typical installation. This is not unique to Zoom or even Apple operating systems.

One thing I'd like to see (and this is definitely doable on macOS side) is that if you trash a .app, the OS would automatically revoke all permissions to it. If this were done then even with the sneaky reinstalling, the user would be alerted by a system dialog requesting access to their webcam.

If you have a ktext kernel driver to implement generic access to video input subsystems (think v4l) then why exactly would the user be alerted if the developer didn’t add the feature?

Read: anyone can write a kernel driver for macOS, you are too trusting of your software vendors. Get a hardware switch

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#122

Post by o-__-o »

aaomidi wrote: post #12
pcx wrote: post #8

Good to see that they’ve turned around and fixed this issue the right way. I was gonna stop using Zoom otherwise.

You should anyway. They had 90 days to do this, they didn't. Incompetent company. Incompetent management.

Dat IPO lyfe.

Investors got their money, what’s the problem here?

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#124

Post by Corrado »

dangoor wrote: post #41

Amusingly enough, the standard menu position for Quit on the Mac is at the bottom of the menu… _now_ the Uninstall Zoom option is at the bottom of the menu, making it easy to accidentally invoke if you're used to selecting the last item there to quit. (I happened to have my hand on the mouse rather than keyboard at the time… normally I'd just cmd-Q).

Wow, I just checked and you are absolutely correct. How is it this hard for companies to check the Apple HIG for this type of thing?

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#126

Post by chrisbro »

ajna91 wrote: post #32
PunksATawnyFill wrote: post #7

Earlier quoted context omitted.

Exactly. My company is actively shopping for a conferencing tool, and Zoom just ensured that it's eliminated.

Anger is certainly justified, but it should give way to reconciliation once the offending party truly repents. Do we want a world of people who change their ways, even if for somewhat impure reasons, or a world in which no one ever does because it's pointless?

The thought process is that if they did this bad thing, only walked back the bad thing when it became public, and are maintaining that they didn't think the bad thing was that bad in the first place...what other nefarious things will that product team do?

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#127

Post by latexr »

jbverschoor wrote: post #94

This is why I love the appstore and forced sandboxing. I hope adobe will finally use the appstore for once. Glas that office is using it. No more buggy updater apps

Adobe has been using the App Store for years[1], but not for the Creative Suite apps.

[1]: https://apps.apple.com/us/developer/adobe-inc/id331646274

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#128

Post by LaGrange »

vinay_ys wrote: post #108
LaGrange wrote: post #90

Earlier quoted context omitted.

> From a regular user point of view, it would be acceptable It would be not, stop pretending acquiring consent from a statistical model counts as acquiring consent from the actual user. Thing you wrote may make it acceptable for you, but certainly ain't sufficient for me.

> It would be not, stop pretending acquiring consent from a statistical model counts as acquiring consent from the actual user. I don't know what you are referring to here. Care to elaborate? > Thing you wrote may make it acceptable for you, but certainly ain't sufficient for me. This isn't about individual taste. Nothing I wrote above was about my personal taste. My point was about differentiating between the OS pro…

I don't know what you are referring to here. Care to elaborate?

You make assumptions about individual user's consent from whatever bulk experiences you might have measured. Either that, or you didn't even measure anything and therefore you're just making things up about what's "acceptable."

> This isn't about individual taste.

Who said anything about taste, it's about individual boundaries.

> My point was about differentiating between the OS provided valid architectural mechanisms vs surreptitious dark patterns applied on top of it by an application developer.

First, that's a word salad. Second, after untangling it, I'm pretty sure you mean "if there's a mechanism in the OS that enables this then it's okay" in which case that's even more absurd than the usual "if it's legal then it's okay." Look, even if you take Zoom's "let's leave a tray icon there when you thought you quit the app without putting a honking huge notice you just did that like a decent app usually does" is more about having a way to disawov ("see, we did leave a notification, lol") than actually ethical design. That's the _essence_ of a dark pattern.

Seriously, though, you're being creepy and advocating pushing people's boundaries here.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#129

Post by yoz-y »

o-__-o wrote: post #121
yoz-y wrote: post #87

Earlier quoted context omitted.

One thing I'd like to see (and this is definitely doable on macOS side) is that if you trash a .app, the OS would automatically revoke all permissions to it. If this were done then even with the sneaky reinstalling, the user would be alerted by a system dialog requesting access to their webcam.

If you have a ktext kernel driver to implement generic access to video input subsystems (think v4l) then why exactly would the user be alerted if the developer didn’t add the feature? Read: anyone can write a kernel driver for macOS, you are too trusting of your software vendors. Get a hardware switch

> anyone can write a kernel driver for macOS

No they can't. With SIP you won't be able to install it if it is not signed (for kernel extensions only a very few developers have certificates) and in any case you will be alerted about it. Also there are plans to completely disallow making kernel extensions in release after Catalina (since they can now run in userspace, I imagine that userspace will not get access to pre-installed hardware)

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#130

Post by Faark »

rossng wrote: post #92
iguy wrote: post #91

Earlier quoted context omitted.

Does it matter? I mean is there another way of entering this string which preserves the spaces, or is deleting them just part of the hash function?

Yes, you can paste a string with internal spaces. I guess you can also disable JS and type whatever you want. Passwords with spaces work absolutely fine, too - it's just the signup form that is broken.

They probably had to many people accidentally copy-pasting strings with spaces into the form. Like the good old "double click to select a word" also picking up the space after the word.

The reason I can empathize with your complain is it being highly unlikely they are able to keep those restrictions consistent across all password forms & login methods.

Post reply on HN