Live data from Hacker News

‘War Dialing’ tool exposes Zoom’s password problems

krebsonsecurity.com

11–20 of 247 posts

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#11
post #6

Hey look it's Mr "it's 2020 but I still don't give a shit about mobile users". Why would anyone want to alienate a substantial amount of users especially if they're serving ads on their blog?

> Hey look it's Mr "it's 2020 but I still don't give a shit about mobile users". Nobody owes you their site behaving a certain way on your phone.

are those metal implants for your head?

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#12
post #6

Hey look it's Mr "it's 2020 but I still don't give a shit about mobile users". Why would anyone want to alienate a substantial amount of users especially if they're serving ads on their blog?

> Hey look it's Mr "it's 2020 but I still don't give a shit about mobile users". Nobody owes you their site behaving a certain way on your phone.

It's not really about entitlement. He's the one benefiting from people consuming his content, why not make it more accessible? All at the cost of some CSS rules.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#13
post #10
post #5

Not a good idea to use 9 to 11 digit long IDs with no password requirement by default; they should have used at least 128-bit random ids, i.e. 21 character long base64-encoded strings.

Yeah but then it sucks for people calling in to have to punch in a 21+ character long meeting ID

Could you not use a telephone intent, where the meeting ID is the suffix to the dial in number with commas for any necessary pauses? Skype for business meeting invites have this. Zoom might then support inviting mobile phone conference participants using SMS, containing the link (think weak 2FA).

Example: tel://18005551212,,#

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#14
post #5

Not a good idea to use 9 to 11 digit long IDs with no password requirement by default; they should have used at least 128-bit random ids, i.e. 21 character long base64-encoded strings.

It's an incredibly simple thing to screw up. I wonder where else they use low entropy random strings. I wonder if their password reset functionality can be brute forced too. Another problem is where they put rate limiting as it seems probable based on this article there are holes.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#16

Hey look it's Mr "it's 2020 but I still don't give a shit about mobile users". Why would anyone want to alienate a substantial amount of users especially if they're serving ads on their blog?

Maybe it isn't a substantial number of users?

FWIW I loaded the article on my Pixel 2 and it looks fine. In the Chrome browser if you double tap on the article text it zooms in to the article.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#17
post #10
post #5

Not a good idea to use 9 to 11 digit long IDs with no password requirement by default; they should have used at least 128-bit random ids, i.e. 21 character long base64-encoded strings.

Yeah but then it sucks for people calling in to have to punch in a 21+ character long meeting ID

> Yeah but then it sucks for people calling in to have to punch in a 21+ character long meeting ID

I may be out of touch with the average biz-guy, but how many people are realistically calling in manually, over traditional phone-lines these days?

Is it really a significant percentage?

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#18
post #10
post #5

Not a good idea to use 9 to 11 digit long IDs with no password requirement by default; they should have used at least 128-bit random ids, i.e. 21 character long base64-encoded strings.

Yeah but then it sucks for people calling in to have to punch in a 21+ character long meeting ID

The telephone dial-in option should've been separate - if the user chooses to enable it then they can fall back to shorter IDs, while meetings that don't need it (or where it doesn't make sense anyway - screen shares, presentations, etc) would use longer, more secure IDs.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#19
post #6

Earlier quoted context omitted.

> Hey look it's Mr "it's 2020 but I still don't give a shit about mobile users". Nobody owes you their site behaving a certain way on your phone.

It's not really about entitlement. He's the one benefiting from people consuming his content, why not make it more accessible? All at the cost of some CSS rules.

> It's not really about entitlement.

The tone of your opening sentence fooled me then.

> why not make it more accessible?

Maybe because he doesn't give a shit about mobile users.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#20
post #5

Not a good idea to use 9 to 11 digit long IDs with no password requirement by default; they should have used at least 128-bit random ids, i.e. 21 character long base64-encoded strings.

Or my personal favorite for anything you show to a user:

https://www.crockford.com/base32.html

Post reply on HN