Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘War Dialing’ tool exposes Zoom’s password problems

krebsonsecurity.com

Post reply on HN
Print view View original

231–240 of 247 posts

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#231

Post by eythian »

littldevl wrote: post #194
joshspankit wrote: post #188

Earlier quoted context omitted.

Agreed. I will add: security and convenience are always polar opposites. The most successful companies are typically the ones that can get away with being as convenient as possible for the longest.

I would disagree about "always" polar opposites. For example SSO/iDP like Okta add a ton of security but also makes it easier while more secure for employees to log in to their multitude of company apps.

I think the catch is that people only notice when they're opposites. If making something more secure also improved the usability (or didn't harm it), then things would (generally) be done the better way. It's only when there's tension or compromises to be made between the requirements that we actually see it, and start to think that they're opposites - because in those cases it is.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#232

Post by eythian »

avh02 wrote: post #214
cozzyd wrote: post #187

Earlier quoted context omitted.

Zoom meeting ids have to be enterable in the phone bridge

speech recognition's probably good enough if you pick your dictionary well

Across a range of accents and such, I'd be surprised.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#234

Post by fart_ratty »

govg wrote: post #186
wazanator wrote: post #175

Earlier quoted context omitted.

A phone number is already 10 digits. As long as you put proper break characters between the groupings it's not hard to read IMO.

They could also just generate 4 words and string them together as the password. Considerably more entropy than 10 digital and easier to communicate too.

Using american-english dictionary from aspell [1] and filtering for lines that only contain lower case letters [2] gives you 77649 words. For four words that gives approx 64 bits of entropy [3].

[1] Probably available on a Linux system at /usr/share/dict/american-english

[2] '^[a-z]+$'

[3] log_2(77649^4)

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#235

Post by sasper »

antoncohen wrote: post #114
dewey wrote: post #72

Earlier quoted context omitted.

An important Zoom feature is that you can dial in from a regular cell phone / landline and conference phones. That's one of the selling points of Zoom.

But when joining a Zoom call from your phone you dial a number, then enter the meeting ID. The meeting ID has the same number of digits as a US phone number, but it isn't the number you dial. The calendar invites generated by Zoom format the number + meeting ID in such as way that a user can tap them and it will dial the number and enter the meeting ID. Basically, in both cases (computer/app or dial-in), increasing t…

The one-tap feature only works on iOS (<15% of cellphone market), although I would assume that it's higher in the enterprise space. There are also conference room telephony systems where there is no one-click solution.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#236

Post by kardos »

vikramkr wrote: post #202
kardos wrote: post #190

Earlier quoted context omitted.

> Even having an 9- to 11-digit meeting code plus say a 6-digit passcode would be a burden for some people, though it's really the only way to do that portion of it right. Strong disagree; people can handle 10-digit phone numbers, they can handle an order 10-digit meeting ID.

Who memorizes phone numbers anymore? Just because you can doesnt mean you will if theres an easier alternate version, and a lot of the public doesnt care about security enough to not use to easier option

Who said anything about memorize? There is no universal dial-in number -- for dialling into a conference, you're provided with a phone number and a meeting code. People already can manage that much. If the meeting code needs to be 15 digits in order to neuter "zoombombing", that's not much of a hurdle or burden.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#238

Post by andrepd »

cs702 wrote: post #65

One positive thing about all these horrendous security flaws that have been recently discovered in Zoom, due to its popularity, is that the company seems to be taking them seriously, recently instituting a feature freeze to focus on fixing them: https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-u... As a consequence, I suspect Zoom's security is more likely than not to improve going forward... although it wi…

>Also, I cannot think of any other multi-video-conferencing solution that "just works"

Another post about Zoom, another comment how it's the only video conferencing platform in the planet that "just works". You know I find that really hard to believe... not least of all because I personally use other solutions without never having major hiccups at all.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#239

Post by joshspankit »

littldevl wrote: post #194
joshspankit wrote: post #188

Earlier quoted context omitted.

Agreed. I will add: security and convenience are always polar opposites. The most successful companies are typically the ones that can get away with being as convenient as possible for the longest.

I would disagree about "always" polar opposites. For example SSO/iDP like Okta add a ton of security but also makes it easier while more secure for employees to log in to their multitude of company apps.

While I agree that things like SSO can be more secure and more convenient for the user, that doesn’t actually make them more convenient overall. In your example it’s mainly the fact that Okta has abstracted away the complexity so that businesses don’t see it.

I’m open to being proven wrong, and as eythian implied, I may in fact be subconsciously cherry-picking times where security and convenience were opposites and missing times where they were not, but even with that awareness no counter examples are coming to mind.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#240

Post by joshspankit »

eythian wrote: post #231
littldevl wrote: post #194

Earlier quoted context omitted.

I would disagree about "always" polar opposites. For example SSO/iDP like Okta add a ton of security but also makes it easier while more secure for employees to log in to their multitude of company apps.

I think the catch is that people only notice when they're opposites. If making something more secure also improved the usability (or didn't harm it), then things would (generally) be done the better way. It's only when there's tension or compromises to be made between the requirements that we actually see it, and start to think that they're opposites - because in those cases it is.

An excellent point, and I’m hoping some examples come up to show that convenience and security actually can be in the same direction.
Post reply on HN