‘War Dialing’ tool exposes Zoom’s password problems

Post by bscphil » Thu, Apr 02, 2020, 9:48 PM UTC

cbsmith wrote: post #123

_red wrote: post #119

Earlier quoted context omitted.

All good points. There is no reason why short meeting codes + 2-3 sec delay before joining + temporarily banning users who enter more than 10 invalid meeting codes in a row can't work. There are ways to improve the security without putting on the clients shoulders. A 6 digit room code is fine if a person can only "war dial" 10 tries before being banned for an hour or so.

There's a really good reason why that wouldn't work. There's no reason why a war dialer can't create millions of users. The 2-3 second delay doesn't really accomplish much unless you limit their capacity to have requests pending.

Post by motohagiography » Thu, Apr 02, 2020, 9:50 PM UTC

softwaredoug wrote: post #116

motohagiography wrote: post #95

This is what technical debt gets you. I really don't know that zoom has a lot or much at all, but I do know that the number of viable solutions to this could be taken off the table internally because they probably made tech debt commitments in their architecture during their scale up phase that prevents bolting on obvious fixes. I have a lot of sympathy for their position. They aren't evil or bad, but they could do a…

I think you overestimate the reliability of the alternatives. Zoom focused all their early engineering muscle on reliability. When we build new products, we don't have infinite resources to attack every front simultaneously. We have finite resources to prove a concept, and we incur debt in just about every other dimension. Now that everyone is using them (precisely because of reliability) the emphasis becomes other t…

Post by deegles » Thu, Apr 02, 2020, 9:52 PM UTC

chrismarlow9 wrote: post #115

deegles wrote: post #112

Earlier quoted context omitted.

> This is what technical debt gets you. Becoming one of the top names in video conferencing and displacing dozens of established players virtually overnight? Sign me up.

> Becoming one of the top names in video conferencing and displacing dozens of established players virtually overnight? Sign me up. What!? That's small thinking. You could be so many greater things than that if you're willing to compromise peoples security and personal information.

Post by tpmx » Thu, Apr 02, 2020, 10:02 PM UTC

Twirrim wrote: post #81

tpmx wrote: post #80

Earlier quoted context omitted.

It's a ~2k person company with a market cap of $34B. So the valuation is $17M per employee. I don't feel sorry for them. Also: this crisis is giving them vast amounts of marketing for free. I'm based in Sweden. I was just vaguely aware of Zoom until a few days ago - now I suddenly hear of them all of the time from Late Night hosts on Youtube.

The developers are still people. Doesn't matter the size of the company, it's still a bunch of individuals who are likely suddenly dealing with a lot of stress and pressure that could never have been predicted, or have opportunity to scale up their engineering to meet.

Post by somethoughts » Thu, Apr 02, 2020, 10:17 PM UTC

Spooky23 wrote: post #139

cs702 wrote: post #65

One positive thing about all these horrendous security flaws that have been recently discovered in Zoom, due to its popularity, is that the company seems to be taking them seriously, recently instituting a feature freeze to focus on fixing them: https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-u... As a consequence, I suspect Zoom's security is more likely than not to improve going forward... although it wi…

I'm not a fan of Zoom... But the pile-on of grief is ridiculous. The "war dialing" issue is a great example. Webex has had the exact same "flaw" for a decade, with the exact same solution - set a meeting password. Other solutions like Google Meet or Skype have the "lobby" approach.