Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom still don't understand GDPR

threatspike.com

Post reply on HN
Print view View original

241–250 of 267 posts

Re: Zoom still don't understand GDPR

#241

Post by rglullis »

orestarod wrote: post #218
rglullis wrote: post #212

Earlier quoted context omitted.

- The code is open source - It provides all features for free - It is actually usable - AFAICT, no reports of security breaches - No privacy violations - At one point, they actually GAVE free lumens to its users. No strings attached at all. I received ~40USD worth of XLM which I transferred to an exchange and sold it right away. Please explain to me. again: how did they make you a sucker of you or their users?

Is server side open source?

Right, I meant the client - where it would be easier to claim malice or ill-intent from the company.

Re: Zoom still don't understand GDPR

#243

Post by franga2000 »

pbhjpbhj wrote: post #213
impendia wrote: post #194

Earlier quoted context omitted.

Because it's frictionless. It's very easy to set up a Zoom meeting with anyone in the world. When I tried MS Teams, my impression was that it required a fair amount of advance configuration. This is no problem if you're meeting the same people repeatedly and they work for the same employer as you. Indeed, as the name of the software suggests, it's good for "teams". But for me, anyway, this hasn't been my typical use…

Zoom seems pretty high-friction vs jit.si . It forces (kinda, tricks I suppose) install of a client exe for example and IIRC requires registration. Jitsi you just follow the link, webrtc means no download.

The high friction with Jitsi is browser permissions. You need to interact with both the webpage and the browser's chrome to set up and switch media devices, which can get confusing even for someone with deep knowledge of the browser APIs, let alone for someone who couldn't tell a UAC prompt from a MsgBox().

That's why Zoom uses all these dark patterns to get native code running as soon as possible and as privileged as possible so it can do all the work for you. See also: Mac installer disaster.

Re: Zoom still don't understand GDPR

#244

Post by franga2000 »

awinter-py wrote: post #18

wow as with everything that's come out about them it feels like they're trying to get the job done but with limited platform support and badly it's not absurd for a product manager to want your desktop zoom app to inherit your browser login though as a user if I saw this behavior I would have a few wtfs. But as a user I would never ever install zoom on a laptop my takeaway from this isn't GDPR implications, it's that…

> it's not absurd for a product manager to want your desktop zoom app to inherit your browser login

Of course not, and there are many ways to do this while respecting the application boundary. In no particular order: passing a token in the launch URI, a bundled WebExtension, a local WebSocket/HTTP server, on-demand executable customization.

Re: Zoom still don't understand GDPR

#245

Post by boogies »

jt94mf90d wrote: post #234
gspr wrote: post #197

Earlier quoted context omitted.

Yes, of course. People wouldn't be crazy enough to install the binary blob of this extremely sketchy company, would they!?

My zoom shows up recording audio in the audo mixer even after leaving meetings.

My elementary school students’ Chromebooks’ Zooms keep the webcam light on when they click the Zoom button to turn it off.

https://my.fsf.org/give-students-userfreedom

Re: Zoom still don't understand GDPR

#246

Post by dylz »

foota wrote: post #190
dylz wrote: post #89

Earlier quoted context omitted.

They're not wrong. A large amount of the basically exist off gross privacy violations. Fingerprinting, gross PII sharing and overstorage, port scanning users' computers and LAN from their browser behind the FW/NAT for "security purposes",

Maybe we're thinking of cyber security as different things, I'm mostly thinking about application security and enterprise security? What are you talking about?

anti-scraping, l7 ddos/bot/spider prevention, "anti fraud", fingerprinting devices on login, port scanning devices on login, this is pretty common in application and enterprise

Re: Zoom still don't understand GDPR

#247

Post by nojvek »

Have you seen Zoom’s stock price? Wall Street don’t give a shit about security unless the company goes under due to a massive fine.

Let’s accept the fact that US govt doesn’t give a shit about little privacy/security like this. EU will sometimes strike a big hammer but even that is sporadic.

Zoom has built momentum on “dark growth hacks” and they’re reaping the rewards. This is standard Silicon Valley.

Re: Zoom still don't understand GDPR

#248

Post by andrewnicolalde »

timerol wrote: post #235
andrewnicolalde wrote: post #104

Earlier quoted context omitted.

It had excellent chat functionality that worked well, and this was at a time in which the Signal client for Android was still quite buggy (hundreds of Bad encrypted message messages flooding group chats, messages delivered hours late and all at once, poor performance etc.) My group naturally gravitated towards Keybase as our secure messaging platform. The other killer feature was KBFS, which was a sort of shared encr…

FYI, if you want to liquidate those, AnchorUSD makes it really easy to transfer them out to a US bank account.

Thanks for the heads up :)

Re: Zoom still don't understand GDPR

#249

Post by andrewnicolalde »

wongarsu wrote: post #191
andrewnicolalde wrote: post #153

Earlier quoted context omitted.

Could you elaborate on that? Of course no computer is completely secure against all forms of attack, but I’ve found statements like these to not contribute very much towards solving any practical security problems.

On windows any program can read the contents of any window on the current desktop (with some exceptions, like UAC prompts and other windows that dim your entire screen). This has legimate use cases for screen readers or dictation, but of course it can also be abused. Same for X11. On more modern operating systems like Android the user needs to take very explicit action to allow an app to do that.

Wow, I had no idea this was also the case on Windows! I was aware of this on X11 and switched to a Wayland compositor as a result. Is this true for macOS? I know for sure that on more recent versions of macOS, applications which want to capture the entire screen require special user-approved permissions, but can they selectively read other windows?

Re: Zoom still don't understand GDPR

#250

Post by pbhjpbhj »

franga2000 wrote: post #243
pbhjpbhj wrote: post #213

Earlier quoted context omitted.

Zoom seems pretty high-friction vs jit.si . It forces (kinda, tricks I suppose) install of a client exe for example and IIRC requires registration. Jitsi you just follow the link, webrtc means no download.

The high friction with Jitsi is browser permissions. You need to interact with both the webpage and the browser's chrome to set up and switch media devices, which can get confusing even for someone with deep knowledge of the browser APIs, let alone for someone who couldn't tell a UAC prompt from a MsgBox(). That's why Zoom uses all these dark patterns to get native code running as soon as possible and as privileged a…

Browser just says "give permission to use mic and camera" and you click yes.

If you click no, then I think you're going to struggle to intuit how to proceed; but it's no harder than navigating UAC dialogs to install software, much easier IMO.

None of the olds in my family had a problem. YMMV I guess.

Post reply on HN