Re:‘War Dialing’ tool exposes Zoom’s password problems
by shiado on Thursday April 02, 2020 @03:16PM
(#22762531)
It's an incredibly simple thing to screw up. I wonder where else they use low entropy random strings. I wonder if their password reset functionality can be brute forced too. Another problem is where they put rate limiting as it seems probable based on this article there are holes.
[ Parent
| on HN ]
Re:‘War Dialing’ tool exposes Zoom’s password problems
by andor on Thursday April 02, 2020 @03:21PM
(#22762601)
Real engineering is about compromises.
In this case, relatively short numeric meeting ids allow users to dial in via plain old phone lines. If my meeting guests had to enter a UUID via their phone keypad, they would probably skip the meeting instead.
Re:‘War Dialing’ tool exposes Zoom’s password problems
by shiado on Thursday April 02, 2020 @03:35PM
(#22762795)
That actually makes sense I didn't know you could dial in with a phone.
Re:‘War Dialing’ tool exposes Zoom’s password problems
by _6fmb on Thursday April 02, 2020 @03:30PM
(#22762732)
Every time I read about a Zoom "screwup" I see a feature that's UX centric. It's pretty cool tbh.
Re:‘War Dialing’ tool exposes Zoom’s password problems
by JadeNB on Thursday April 02, 2020 @07:29PM
(#22764955)
> Every time I read about a Zoom "screwup" I see a feature that's UX centric. It's pretty cool tbh.
Like dialing Facebook even if you're not a Facebook user (https://news.ycombinator.com/item?id=22693792)?
Re:‘War Dialing’ tool exposes Zoom’s password problems
by jlmorton on Thursday April 02, 2020 @03:34PM
(#22762781)
I mean, this is intentional. They even allow you to set your meeting ID to a well-known number, like your company's published phone number.
If you want to join the all-hands meetings of a company I used to work for, you only need to go their website and lookup their primary phone number. That's the Zoom meeting ID.