Re:Zoom Windows client could allow credentials to be leaked ...
by jeroenhd on Saturday April 04, 2020 @04:29AM
(#22776986)
Why not? It makes business sense for a conferencing tool to be able to link to files on a mounted drive ("can you tell me where the project notes are?" "sure, they're over at \\projects\jabberwocky\notes.docx").
Every chat application turns HTTP strings into links and I don't believe it's the application developer's fault to assume that a simple link will cause code execution or leak credentials. That's a bad API design by Microsoft to the point where it's a vulnerability.
If someone told you that on iOS a link starting with HTTP would cause the device to send your Apple password to a random server, would you think that's normal and therefore developers should know better? Why would it be any different with any other kind of link? Wouldn't you expect the OS not to fail catastrophically when a user clicks a link like that?
Every chat application turns HTTP strings into links and I don't believe it's the application developer's fault to assume that a simple link will cause code execution or leak credentials. That's a bad API design by Microsoft to the point where it's a vulnerability.
If someone told you that on iOS a link starting with HTTP would cause the device to send your Apple password to a random server, would you think that's normal and therefore developers should know better? Why would it be any different with any other kind of link? Wouldn't you expect the OS not to fail catastrophically when a user clicks a link like that?