31–40 of 247 posts
How hard is this for them to fix?
Rate-limiting incorrect password attempts could take a bit longer to implement, but still not a particularly difficult problem to solve.
Earlier quoted context omitted.
Yeah but then it sucks for people calling in to have to punch in a 21+ character long meeting ID
> Yeah but then it sucks for people calling in to have to punch in a 21+ character long meeting ID I may be out of touch with the average biz-guy, but how many people are realistically calling in manually, over traditional phone-lines these days? Is it really a significant percentage?
Also if you don't want to install the Zoom client, you can just dial in from your cell phone or desk phone.
Not a good idea to use 9 to 11 digit long IDs with no password requirement by default; they should have used at least 128-bit random ids, i.e. 21 character long base64-encoded strings.
This is likely to support dial-in over the telephone network. I think "no password" is the bigger issue, because repeated attempts with incorrect passwords can be rate-limited. Zoom should be generating a random 6-digit password for each meeting by default. There may be use cases for not having any password, but that should be explicitly opt-in and have a warning message to every participant that anyone can join and…
It's 1985 all over again: I'm in my bedroom running a ProDOS wardialer on my 300/1200 baud AppleModem; I have found zero computers, but it is fun watching the numbers flick past, hoping that I, too, can discover a WOPR and start global thermonuclear war.
Not a good idea to use 9 to 11 digit long IDs with no password requirement by default; they should have used at least 128-bit random ids, i.e. 21 character long base64-encoded strings.
Or my personal favorite for anything you show to a user: https://www.crockford.com/base32.html
Not a good idea to use 9 to 11 digit long IDs with no password requirement by default; they should have used at least 128-bit random ids, i.e. 21 character long base64-encoded strings.
It's an incredibly simple thing to screw up. I wonder where else they use low entropy random strings. I wonder if their password reset functionality can be brute forced too. Another problem is where they put rate limiting as it seems probable based on this article there are holes.
Not a good idea to use 9 to 11 digit long IDs with no password requirement by default; they should have used at least 128-bit random ids, i.e. 21 character long base64-encoded strings.
This is likely to support dial-in over the telephone network. I think "no password" is the bigger issue, because repeated attempts with incorrect passwords can be rate-limited. Zoom should be generating a random 6-digit password for each meeting by default. There may be use cases for not having any password, but that should be explicitly opt-in and have a warning message to every participant that anyone can join and…
There's never a reason to share the id without the password.