Maybe naive, but why doesnt Zooom do something like SSO? Why is the identity of attendees not validated? Wouldn't that solve the problem?
Then they'd need to charge extra for the SSO tax ;)
‘War Dialing’ tool exposes Zoom’s password problems
211–220 of 247 posts
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#212Earlier quoted context omitted.
I think you overestimate the reliability of the alternatives. Zoom focused all their early engineering muscle on reliability. When we build new products, we don't have infinite resources to attack every front simultaneously. We have finite resources to prove a concept, and we incur debt in just about every other dimension. Now that everyone is using them (precisely because of reliability) the emphasis becomes other t…
That last statement, I'm there with you on. Tech debt is necessary, it could even be renamed "tech leverage," because that's what a lot of it is. My thing is that there are tons of potential ways to mitigate zoombombing, even incrementally, and that they haven't or chose not to indicates it's because there were cost barriers to doing it. It has the tech debt smell, and it's what I've seen in other orgs.
Do any of those potential ways impact on the ease of use of Zoom? Do they make it harder to join a meeting?
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#213wow! haven't heard that term in a while. we used to do this looking for modems to dial into.
I remember WarDriving - driving around to pick up WiFi SSIDs. That was about 20 years ago.
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#214Earlier quoted context omitted.
Isn't it easily fixed by making IDs slightly higher entropy, and also rate limiting retries? Something like a Youtube ID which is 11-char in Base62, which is short enough but has so much entropy that even know with billions of videos, entering a random ID will most likely not work. You should also always have some reasonable rate limit of any sort of API query, if someone is querying rooms at 10qps or more, there's c…
Zoom meeting ids have to be enterable in the phone bridge
speech recognition's probably good enough if you pick your dictionary well
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#215Earlier quoted context omitted.
They could also just generate 4 words and string them together as the password. Considerably more entropy than 10 digital and easier to communicate too.
You need the ability to enter the code on a numeric keypad when dialing in from an office phone. Compatibility with "ancient" enterprise practices is also important.
Ah, that makes a lot of sense. I'd never considered that!
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#216Earlier quoted context omitted.
Aside from the fact that you're wrong, I think you need to take a break from the internet. You seem stressed.
Aside from the fact I'm not wrong. I think you need to source and/or explain your unfounded claims: Google Delays Hangouts Shutdown Until June 2020 https://www.extremetech.com/internet/297037-google-delays-ha... WebRTC Internals in Chrome with frame rate capped at 5 FPS while screen sharing: https://www.reddit.com/r/chromeos/comments/absxt2/chromebox_... Screen Share through Hangouts/Meet with high FPS? R: Nope https…
hangouts meet does 1080p (whether it works now during the covid pandemic I don't know) and is Google's replacement for the regular hangouts. it has been available for companies and has been part of g-suite for enterprise since 2017.
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#217Earlier quoted context omitted.
They could also just generate 4 words and string them together as the password. Considerably more entropy than 10 digital and easier to communicate too.
You need the ability to enter the code on a numeric keypad when dialing in from an office phone. Compatibility with "ancient" enterprise practices is also important.
Why not a word-based code for most people, and a numerical one for places that need them (can be enabled/disabled in the tenant), and only allows for phone connections?
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#218Earlier quoted context omitted.
The developers are still people. Doesn't matter the size of the company, it's still a bunch of individuals who are likely suddenly dealing with a lot of stress and pressure that could never have been predicted, or have opportunity to scale up their engineering to meet.
Yeah.. no. Only on HN could these winners become "victims".
> Only on HN could these winners become "victims".
Maybe because the users on here have an unique perspective on developers / development?
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#219Earlier quoted context omitted.
Why do people keep saying it just works? It just works if you install their app, probably. But audio doesn't work at all in Firefox. That's not really just works for me.
Yea, Hangouts is a lot more "it just works" than Zoom is for me. That being said, the quality of the actual calls on Zoom is _way_ better than Hangouts.
Is Hangouts now the same as Meet, or does Google have two different products? Hangouts used to work fine back when it was integrated with Google+ (I miss those days), but I just tried to go to a meet for my son's school, where nobody could see or hear us, and Meet claimed the mic was muted by the system, while the system said it was turned on and the browser had access. That's clearly not "it just works", but apparently nothing is.
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#220Earlier quoted context omitted.
For the phone only route, it seems like you could still mostly automate it by going oldschool. Give the host an option to play the meeting code as a DTMF signal (or whatever) while the other person holds their phone near the mic.
DTMF signal played over what exactly? The phone option is for when you aren't at a computer (driving, conference, etc..).
Maybe I'm misunderstanding the use case then? I'm imagining something like:
A and B are on a phone call. A starts a video meeting. B goes to shortlink.dtmf or opens the app, which starts listening. A clicks "transmit room code" which goes over the existing phone connection. B's client hears the signal, decodes it, and gives them a link to join.