wow! haven't heard that term in a while.
we used to do this looking for modems to dial into.
‘War Dialing’ tool exposes Zoom’s password problems
201–210 of 247 posts
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#202Earlier quoted context omitted.
This is a really good point, and I actually sympathize with how difficult it is for Zoom to strike the right balance here. If the only method of operation here were for people to invite others by copy/pasting a URL, and the invitees' only method of joining were to click on that link, then long UUIDs or such would be just fine. But Zoom lets you dial in audio-only from a regular phone. You simply just cannot use "long…
> Even having an 9- to 11-digit meeting code plus say a 6-digit passcode would be a burden for some people, though it's really the only way to do that portion of it right. Strong disagree; people can handle 10-digit phone numbers, they can handle an order 10-digit meeting ID.
Who memorizes phone numbers anymore? Just because you can doesnt mean you will if theres an easier alternate version, and a lot of the public doesnt care about security enough to not use to easier option
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#203Earlier quoted context omitted.
I'm not a fan of Zoom... But the pile-on of grief is ridiculous. The "war dialing" issue is a great example. Webex has had the exact same "flaw" for a decade, with the exact same solution - set a meeting password. Other solutions like Google Meet or Skype have the "lobby" approach.
Zoom in fact also allows you to enable a "waiting room" for all meetings owned by your account. It's not always ideal though. I've organized meetings with 10+ people, want able to attend the meeting and now nobody can join the session.
I'm not sure about this, but there is a way to make someone a co-host who could then presumably make those decisions?
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#204Earlier quoted context omitted.
A phone number is already 10 digits. As long as you put proper break characters between the groupings it's not hard to read IMO.
They could also just generate 4 words and string them together as the password. Considerably more entropy than 10 digital and easier to communicate too.
This is exactly what jitsi does
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#205Earlier quoted context omitted.
Fun fact - perhaps not widely known and perhaps why it shares a similar philosophy as Webex: Zoom was founded in 2011 by Eric Yuan, a lead engineer from Cisco Systems and its collaboration business unit WebEx.[1] [1] https://en.wikipedia.org/wiki/Zoom_Video_Communications#Hist...
I've always wondered about spinoff startups like this from larger companies: aren't there usually non competes that would prevent them starting them?
They're generally not enforceable in California, provided you're not making use of any protected IP or what not.
https://casetext.com/statute/california-codes/california-bus...
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#206Earlier quoted context omitted.
> Even having an 9- to 11-digit meeting code plus say a 6-digit passcode would be a burden for some people, though it's really the only way to do that portion of it right. Strong disagree; people can handle 10-digit phone numbers, they can handle an order 10-digit meeting ID.
Who memorizes phone numbers anymore? Just because you can doesnt mean you will if theres an easier alternate version, and a lot of the public doesnt care about security enough to not use to easier option
People didn’t really memorize 10 numbers that often anyway. Most people whose numbers you knew would be in a small set of area codes, or just one, and even the next three might only have a couple possibilities for most useful numbers, unless you lived in a very dense area.
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#207One positive thing about all these horrendous security flaws that have been recently discovered in Zoom, due to its popularity, is that the company seems to be taking them seriously, recently instituting a feature freeze to focus on fixing them: https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-u... As a consequence, I suspect Zoom's security is more likely than not to improve going forward... although it wi…
So there's two kinds of problems here - not all security flaws are created equal.
One kind is missing something or unintended consequences. Making all URLs clickable opens a UNC attack due to some obscure Windows "feature", for example. Or having N digit numbers means they're technically iterable, but this is the same for cellphones, and there are workarounds.
The other kind is security holes caused by explicitly working to bypass security restrictions yourself. Installing a server with webcam permissions that you don't cleanup so reinstallation is easier for you (don't be surprised when other apps start telling it to switch on the webcam), impersonating the system root password dialog (don't act surprised when other apps steal the password from you), claiming end to end encryption without being clear about where and when it's on, and others.
The first is normal security work, the second is sleazy. We all forgive the first, but we shouldn't let sleaziness slide.
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#208Earlier quoted context omitted.
Yea, Hangouts is a lot more "it just works" than Zoom is for me. That being said, the quality of the actual calls on Zoom is _way_ better than Hangouts.
I mean, I don't really know how "consistently high call quality" is not the most important feature of any video chat application. My experience on hangouts has always been garbage. Delays, choppy sound, my machine starts going insane while rendering other people's live video. It may just work in the sense that you can immediately use it, but if even 20% of the time you use it the call quality sucks, then it's a crap…
> It may just work in the sense that you can immediately use it, but if even 20% of the time you use it the call quality sucks, then it's a crap product IMO.
"it just works" doesn't mean "its a superior product". I use Zoom over hangouts whenever I'm on a call with more than ~3 people, but automatic gcal integration + being fully functional from a browser means that hangouts makes more sense sometimes.
(I also don't have nearly the amount of issues you do with hangouts. The biggest problem for me is how much worse they handle crosstalk, which isn't an issue when there are only a couple of people on a call.
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#209One positive thing about all these horrendous security flaws that have been recently discovered in Zoom, due to its popularity, is that the company seems to be taking them seriously, recently instituting a feature freeze to focus on fixing them: https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-u... As a consequence, I suspect Zoom's security is more likely than not to improve going forward... although it wi…
Ok. This was way too funny. Linking to a wordpress blog about their focus on fixing security bugs.
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#210I worked in videoconferencing for a while. When it comes to meeting identifiers, striking the right balance between ease of use and security is really hard. On the one side, maximum ease-of-use is a name or code short enough for someone to say over the phone. "Here, just jump into the videoconferencing meeting 'mikefred' or 'john10' or '39584'". That works particularly well for small meetings where it's immediate obv…
> striking the right balance between ease of use and security is really hard.
Why not give more "Options"?
For example when generating conference id, provide an option to generate more random digits or hash codes. When installing provide an option to customize everything. Meanwhile provide a fast and fool-proof path for rest of users.