O/T:- Zoom Zoom

[Old_pie]

Once upon a time Zoom Zoom meant you'd got a Mazda. Now it means you're having a conference that is being hacked:

https://www.theregister.co.uk/2020/0...ment_zoom_ban/

Despite this the Government are going ahead with a conference:

https://www.bbc.co.uk/news/uk-politics-52299514

Maybe someone would like to try Zoom-bombing but no flashing in front of the children eg:
https://www.independent.co.uk/life-s...-a9459081.html

Well at least we've taught the Indians well, shame we can't follow their lead.

[SwalePie]

Once upon a time Zoom Zoom meant you'd got a Mazda. Now it means you're having a conference that is being hacked:

https://www.theregister.co.uk/2020/0...ment_zoom_ban/

Despite this the Government are going ahead with a conference:

https://www.bbc.co.uk/news/uk-politics-52299514

Maybe someone would like to try Zoom-bombing but no flashing in front of the children eg:
https://www.independent.co.uk/life-s...-a9459081.html

Well at least we've taught the Indians well, shame we can't follow their lead.

Been using Zoom for business for about 5 years now and never had any issues. I think the problem comes when people don't consider security when setting it up. Maybe some better training might be in order.

[Old_pie]

Been using Zoom for business for about 5 years now and never had any issues. I think the problem comes when people don't consider security when setting it up. Maybe some better training might be in order.

What you mean to say is that you don't know if you've had any issues,

eg https://www.zdnet.com/article/make-s...ese-10-things/

Though I imagine that the Chinese might be less interested in what you're up to than what the British or other Governments are up to in the same way as you might be less concerned in having a Huawei phone compared to an enterprise running Huawei routers.

Zoom is, and has been for a while, insecure and not just because users haven't put in passwords. It is fundamentally insecure and the issues have only recently come to the fore with the increased popularity due to the current situation and they are (being forced) fixing it.

[The_Don_ORiordan]

Like anything done in the cloud it has to be sensibly secured.

This is what happens when a piece of software becomes popular. It becomes a bigger target.

Zoom has become very popular very quickly.

[Old_pie]

Like anything done in the cloud it has to be sensibly secured.

This is what happens when a piece of software becomes popular. It becomes a bigger target.

Zoom has become very popular very quickly.

You can't sensibly secure something when the 'leak' is in the middle on their servers. It is not fully end-to-end encryption, that is the main security issue that they are trying to address.

[SwalePie]

What you mean to say is that you don't know if you've had any issues,

eg https://www.zdnet.com/article/make-s...ese-10-things/

Though I imagine that the Chinese might be less interested in what you're up to than what the British or other Governments are up to in the same way as you might be less concerned in having a Huawei phone compared to an enterprise running Huawei routers.

Zoom is, and has been for a while, insecure and not just because users haven't put in passwords. It is fundamentally insecure and the issues have only recently come to the fore with the increased popularity due to the current situation and they are (being forced) fixing it.

True. Although we have used it extensively for such a long time, we also only rarely have more than 500 in a meeting, perhaps only once or twice a week, so maybe that's partly why we've not knowingly experienced issues (to date!). Also, perhaps interestingly, we have never used the dubious 'email invitation' method that many have mentioned as a potential security issue. I wonder if that's partly why we've not (knowingly) experienced issues? You seem clued up on these things, what do you think? Personally I think it's simply because we haven't yet been targeted. I know Zoom are working on a redesign right now and they've done well to keep it reliable under the heavy traffic since the virus situation made it so popular so here's hoping it comes to be more secure soon.

[magpie_mania]

What you mean to say is that you don't know if you've had any issues,

eg https://www.zdnet.com/article/make-s...ese-10-things/

Though I imagine that the Chinese might be less interested in what you're up to than what the British or other Governments are up to in the same way as you might be less concerned in having a Huawei phone compared to an enterprise running Huawei routers.

Zoom is, and has been for a while, insecure and not just because users haven't put in passwords. It is fundamentally insecure and the issues have only recently come to the fore with the increased popularity due to the current situation and they are (being forced) fixing it.

'It is fundamentally insecure .....'

What are the issues that are likely to arise from it? We have been using it quite a lot lately and I am wondering what problems you feel we may encounter.

[SwalePie]

'It is fundamentally insecure .....'

What are the issues that are likely to arise from it? We have been using it quite a lot lately and I am wondering what problems you feel we may encounter.

There's a decent article about that here...

https://www.fastcompany.com/90488717/can-you-trust-zoom

[Old_pie]

'It is fundamentally insecure .....'

What are the issues that are likely to arise from it? We have been using it quite a lot lately and I am wondering what problems you feel we may encounter.

Fully secure systems have end-to-end encryption. An example of this is actually WhatsApp where when you send a message, have a conversation or video no-one in the middle, the servers, the ISP, can listen in.

Zoom claimed secure encryption then had to admit that it is encrypted to their servers where, if I have understood it all correctly from the links and previous reports I have read, it is decrypted, then re-encrypted to the other party. The weakness is that anyone with access to their servers, either wittingly or otherwise, can see what is going on.

Now likely for Swale's company, and for you, it doesn't matter. The Chinese government for instance would not be interested in what you are talking about. But when it comes to government and policy well it sort of does matter doesn't it.

My point to Swale was just because he's not aware of any problems doesn't mean there haven't been any. His, and your, Zoom sessions could be being analysed and your secrets used against you.

This is somewhat different to the Zoombombing that's been going on where for instance the schoolkids in Singapore were Zoombombed by flashers. There's an army of people trying to hack into anything and if you have weak passwords and procedures they may well invite themselves into your sessions, and if they did it quietly you wouldn't know, would you?

Read the links I sent. If the Indian Government are concerned then so should the British Government be, you're probably ok because no-one really cares.

[The_Don_ORiordan]

You can't sensibly secure something when the 'leak' is in the middle on their servers. It is not fully end-to-end encryption, that is the main security issue that they are trying to address.

I never said sensibly secured by the user.

I said sensibly secured.