News for hackers. Stuff that matters.

A comment on Vulnerability in the Mac Zoom client allows malicious websites to enable camera. Parent comment

Re:Vulnerability in the Mac Zoom client allows malicious web... by m0dest on Tuesday July 09, 2019 @05:57AM (#20390279)
Universal Links are better than their localhost webserver insanity, but don't really solve this. A malicious website can still redirect you to a zoom.us URL that will instantly join the meeting without confirmation.

The underlying problem is that they want a URL to join a conference call hosted by any random user and share your audio/video without confirmation. And it's simply not safe to trigger that kind of action from a URL.

[ Parent | on HN ]
Re:Vulnerability in the Mac Zoom client allows malicious web... by filleokus on Tuesday July 09, 2019 @07:18AM (#20390670)
Yes, I agree that's the underlying problem. Regardless of how the URL is opened it shouldn't behave that way.

However, I do think that Universal Links doesn't work with redirects, consider: https://bit.ly/30oxOdO vs https://twitter.com/ycombinator (tap using Safari on iOS with Twitter installed).

EDIT: Turns out I was misinformed...

[ Parent | on HN ]