Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New York City bans Zoom in schools, citing security concerns

techcrunch.com

Post reply on HN
Print view View original

31–40 of 61 posts

Re: New York City bans Zoom in schools, citing security concerns

#31

Post by thawaway1837 »

arcticbull wrote: post #16
simonh wrote: post #6

Earlier quoted context omitted.

We're talking about videos of children in their homes, in many cases probably their bedrooms. If they have to use it for school, they may also use it with their friends other than for school work as they will have it set up and know how to use it. I think the risks of illicit access to that material are pretty clear, and there are several serious vulnerabilities in Zoom that can grant direct access to video chats and…

None of that, while distasteful seems to signal any national security or personal security risk. This seems pretty hyperbolic. Why on earth would the Chinese government want access to videos of children in bedrooms? Ridiculous.

Can you imagine the lawsuits that are gonna come pouring in because some hacker was able to control the webcam on a students MacBook because Zoom’s installer basically acts as an insecure root kit, and takes videos of a kid in his private moments and releases them to the internet?

Re: New York City bans Zoom in schools, citing security concerns

#32

Post by thawaway1837 »

Krasnol wrote: post #24
addicted wrote: post #21

Earlier quoted context omitted.

Maybe because MS has a good solution that isn’t riddled with privacy issues? What’s actually behind this is the threat of a mountain of lawsuits that are gonna come descending on school systems that compromise little kids’ privacy by forcing them to use Zoom. If the images of one child during their private moments show up on the internet because Zoom has so many vilnerabilities and a malicious actor was able to contr…

You mean besides the usual privacy issues in the operating system or Office 365? https://thenextweb.com/privacy/2019/07/15/german-schools-ban...

Comparing an operating system to a video conference app...SMH. Anyways the article you list is more about privacy policy issues, the kind of which even ZOom is subject to because the US govt forever it on all their companies. Zoom, in addition to that, was also routing the video through Chinese servers,making you vulnerabl not only to the NSA but also the Chinese services.

More specifically, Teams has been in use for several years now, without a faction of the security issues that Zoom has had in the last couple of years.

Edit: The US government regulations are the problem there which is why the article mentions that Google and Apple also do not meet the same privacy standards. In other words, all the OS makers fail to do so, and not just Microsoft.

The only solution that would probably work for the German standards (and is something the EU should be investing heavily in anyways) would be Linux.

Re: New York City bans Zoom in schools, citing security concerns

#33

Post by presumably »

MaxBarraclough wrote: post #29
satysin wrote: post #25

Earlier quoted context omitted.

I respectfully disagree. I feel it is safe to say that Zoom have some serious issues in their development process. It seems every other day there is some new issue. Install fuckery on macOS, lying about E2EE, including code they did not properly understand, etc. We talk so much about wanting to protect children that we should not be using software that gives audio and video access to their computers that we do not ha…

Regarding the macOS installer: did this turn out to be real? Last time I saw this turn up, there seemed to be some question: https://news.ycombinator.com/item?id=22750619

There is no question that it was a real problem, details available in the linked post: https://objective-see.com/blog/blog_0x56.html

The only question is different interpretations of “fake”: it is a real system dialogue, invoked by a deprecated API; it is fake in that the text is set by Zoom to trick the user into allowing it to install itself without approval.

Re: New York City bans Zoom in schools, citing security concerns

#34

Post by simonh »

arcticbull wrote: post #28
est31 wrote: post #23

Earlier quoted context omitted.

There are more reasons to not give access than personal or national security. Privacy is one. We shouldn't be in a situation where you need to explain why you need privacy. It should be the default.

I don't disagree, I'm just tired of the (in this case blatant) "but think of the children" in situations where it's totally irrelevant.

"Think of the Children" is when an issue that is only tangentially or tenuously anything to do with children, and may not even be a legitimate concern anyway, uses a notional impact on children as emotional leverage to gain undeserved attention.

This case is literally and specifically about the protection of specific children from a proven risk.

Re: New York City bans Zoom in schools, citing security concerns

#35

Post by arcticbull »

simonh wrote: post #34
arcticbull wrote: post #28

Earlier quoted context omitted.

I don't disagree, I'm just tired of the (in this case blatant) "but think of the children" in situations where it's totally irrelevant.

"Think of the Children" is when an issue that is only tangentially or tenuously anything to do with children, and may not even be a legitimate concern anyway, uses a notional impact on children as emotional leverage to gain undeserved attention. This case is literally and specifically about the protection of specific children from a proven risk.

Is the proven risk that China is snooping on American children? If so, I'm sure I'd have read it everywhere. If not, it's sensationalism. The case is literally and specifically about Zoom having the ability to snoop. Children are ancillary.

Re: New York City bans Zoom in schools, citing security concerns

#36

Post by zkid18 »

simonh wrote: post #6
irjustin wrote: post #4

As the previous discussion already noted it seems disingenuous. Spacex has real security concerns with national security secrets and trade assets. Schools primary goal should be accessibility when it comes to teaching and Zoom arguably with its better video/audio has the best even with glaring security flaws (that do not necessarily seem decidedly worse than Hangouts). Banning Zoom seems to be getting on the negative…

We're talking about videos of children in their homes, in many cases probably their bedrooms. If they have to use it for school, they may also use it with their friends other than for school work as they will have it set up and know how to use it. I think the risks of illicit access to that material are pretty clear, and there are several serious vulnerabilities in Zoom that can grant direct access to video chats and…

I would agree with you on the point on adoption outside the school. Btw, what kind of serious vulnerabilities in Zoom are you talking about? Been using it in a big tech company for almost two years already. Our sec department seems confident with it afaik.

Re: New York City bans Zoom in schools, citing security concerns

#37

Post by simonh »

arcticbull wrote: post #35
simonh wrote: post #34

Earlier quoted context omitted.

"Think of the Children" is when an issue that is only tangentially or tenuously anything to do with children, and may not even be a legitimate concern anyway, uses a notional impact on children as emotional leverage to gain undeserved attention. This case is literally and specifically about the protection of specific children from a proven risk.

Is the proven risk that China is snooping on American children? If so, I'm sure I'd have read it everywhere. If not, it's sensationalism. The case is literally and specifically about Zoom having the ability to snoop. Children are ancillary.

I'll reluctantly repeat the below from another post of mine on this thread:

There are two vulnerabilities in particular that can grant access to videos to anyone. One is that Zoom video chat IDs are short enough and low enough entropy to be guessable so it's possible to crash meetings. Also saved videos have a standard naming scheme that makes their file names guessable and therefore accessible publicly, as anyone who knows the file name can access any saved video.

Both of these are deliberate choices. They made meeting IDs short and memorable, which makes them guessable. They also wanted saved videos to have meaningful names derived from meeting and user metadata, but again that means they are guessable, and easy to access without annoying security controls.

Re: New York City bans Zoom in schools, citing security concerns

#38

Post by igetspam »

zulln wrote: post #27
Nullabillity wrote: post #5

Earlier quoted context omitted.

How on earth is it acceptable to force students (who have pretty much no position to argue) to install what is effectively malware?

You can use Zoom online without installing anything.

I tried that the other day and could only get a 403. Is their web portal still active? I ended up just dialing in.

Re: New York City bans Zoom in schools, citing security concerns

#39

Post by igetspam »

est31 wrote: post #17
puszczyk wrote: post #14

Earlier quoted context omitted.

What would you instead?

NYC could set up a jitsi instance. https://github.com/jitsi/docker-jitsi-meet#quick-start

That's what I'm planning. I've been happy enough with jitsi that I'm going to run my own and enforce auth policies.

Re: New York City bans Zoom in schools, citing security concerns

#40

Post by igetspam »

thefounder wrote: post #26
satysin wrote: post #25

Earlier quoted context omitted.

I respectfully disagree. I feel it is safe to say that Zoom have some serious issues in their development process. It seems every other day there is some new issue. Install fuckery on macOS, lying about E2EE, including code they did not properly understand, etc. We talk so much about wanting to protect children that we should not be using software that gives audio and video access to their computers that we do not ha…

>> including code they did not properly understand, etc. Yeah we understand all of our code, right? I'm developing an Electron app. I let you guess how much I know about the code behind electron/chronium. >> We talk so much about wanting to protect children that we should not be using software that gives audio and video access to their computers that we do not have confidence in. Let's start banning facebook. Shall w…

I know you're saying that in jest but it's a good idea. If my wife wasn't sometimes active with a NPO, I'd have it filtered at the network.
Post reply on HN