‘War Dialing’ tool exposes Zoom’s password problems

Post by Twirrim » Thu, Apr 02, 2020, 8:19 PM UTC

tpmx wrote: post #80

Twirrim wrote: post #74

I feel a little bit sorry for the Zoom devs. All of a sudden there are a _lot_ of eyes on Zoom. Every design decision and mistake are under a big microscope, while also presumably having to deal with some major scaling.

It's a ~2k person company with a market cap of $34B. So the valuation is $17M per employee. I don't feel sorry for them. Also: this crisis is giving them vast amounts of marketing for free. I'm based in Sweden. I was just vaguely aware of Zoom until a few days ago - now I suddenly hear of them all of the time from Late Night hosts on Youtube.

Post by x0x0 » Thu, Apr 02, 2020, 8:24 PM UTC

diebeforei485 wrote: post #30

devit wrote: post #5

Not a good idea to use 9 to 11 digit long IDs with no password requirement by default; they should have used at least 128-bit random ids, i.e. 21 character long base64-encoded strings.

This is likely to support dial-in over the telephone network. I think "no password" is the bigger issue, because repeated attempts with incorrect passwords can be rate-limited. Zoom should be generating a random 6-digit password for each meeting by default. There may be use cases for not having any password, but that should be explicitly opt-in and have a warning message to every participant that anyone can join and…

Post by bluntfang » Thu, Apr 02, 2020, 8:27 PM UTC

cs702 wrote: post #65

One positive thing about all these horrendous security flaws that have been recently discovered in Zoom, due to its popularity, is that the company seems to be taking them seriously, recently instituting a feature freeze to focus on fixing them: https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-u... As a consequence, I suspect Zoom's security is more likely than not to improve going forward... although it wi…

Post by bobbyi_settv » Thu, Apr 02, 2020, 8:28 PM UTC

Nextgrid wrote: post #18

umvi wrote: post #10

Earlier quoted context omitted.

Yeah but then it sucks for people calling in to have to punch in a 21+ character long meeting ID

The telephone dial-in option should've been separate - if the user chooses to enable it then they can fall back to shorter IDs, while meetings that don't need it (or where it doesn't make sense anyway - screen shares, presentations, etc) would use longer, more secure IDs.

Post by panarky » Thu, Apr 02, 2020, 8:31 PM UTC

DrJokepu wrote: post #70

varelaz wrote: post #37

TLDR: With 17 digits meeting password is not needed at all. If meeting will be 17 numbers it will be the same as to protect 11 length digit number with 6 digit password. So basically that's the trade off. One could say that password is not the same as meeting ID, but usually they both sent in one email/message and lifetime and protection for them is equal. Also it's easier to input one number than 2 different.

If you don’t separate the access key from the secret you can’t change the secret if and when it gets compromised.