undefined | Better HN

0 pointsmiles4y ago0 comments

‘Zoom is malware’: why experts worry about the video conferencing platform https://www.theguardian.com/technology/2020/apr/02/zoom-tech...

Zoom banned from New York City schools due to privacy and security flaws https://www.fastcompany.com/90486586/zoom-banned-from-new-yo...

Google Told Its Workers That They Can’t Use Zoom On Their Laptops Anymore https://www.buzzfeednews.com/article/pranavdixit/google-bans...

Elon Musk's SpaceX bans Zoom over privacy concerns https://www.reuters.com/article/us-spacex-zoom-video-commn/e...

Zoom lied to users about end-to-end encryption for years, FTC says https://arstechnica.com/tech-policy/2020/11/zoom-lied-to-use...

Zoom security issues: Here's everything that's gone wrong (so far) https://www.tomsguide.com/news/zoom-security-privacy-woes

Maybe we shouldn’t use Zoom after all https://techcrunch.com/2020/03/31/zoom-at-your-own-risk/

Attackers can use Zoom to steal users’ Windows credentials with no warning https://arstechnica.com/information-technology/2020/04/unpat...

0 comments

5 comments · 3 top-level

monocasa4y ago· 2 in thread

I can't believe I'm saying this, but I'm not sure that last one is zoom's fault. It sounds like Zoom is just calling ShellExecute("open", link), and is getting blamed for the fact that Windows will then connect to random server on public internet and can be convinced to send a hash of the password that can be used to forge a different connection from a different host/client pair with the same credentials.

kamray234y ago

I mean it is their fault, for a naïve implementation and trusting Windows.

monocasa4y ago

It's the mechanism meant for untrusted links, and it's the prescribed way for instance to open a link in the user's default browser. If Chrome took that link and started sending the user's password hash, that'd clearly be Chrome's fault. Same with, say, an ftp client that listened for ftp paths and would send replayable hashes as the first step. It's clearly SMB's terrible protocol. Yes they removed UNC paths to hack around this... but they shouldn't have to. Nope should they be expected to have known about this particular Windows footgun, IMO.

notwhereyouare4y ago

and on the front page currently: https://news.ycombinator.com/item?id=28210076

movedx4y ago

I'm really, really annoyed that you're being downvoted for providing citations: as f-ing requested!

Thank you. These will make for some interesting reading.

j / k navigate · click thread line to collapse