Zoom’s 90-day plan to bolster key privacy and security initiatives

Re:Zoom’s 90-day plan to bolster key privacy and security in... by tachion on Wednesday April 08, 2020 @12:20PM (#22814294)

How is that not the biggest scandal around this company, as opposed to intentional or not misinformation about end to end encryption (not that it doesn't count, but for this one, if it's real, the company should be brought up to public scrutiny).

[ Parent | on HN ]

Re:Zoom’s 90-day plan to bolster key privacy and security in... by thoraway1010 on Wednesday April 08, 2020 @01:36PM (#22815108)

Seriously - I never expected or need e2e in my video conferencing (I like transport encryption fine and always thought the lock meant that).

But this would be a huge issue if true.

[ Parent | on HN ]

Re:Zoom’s 90-day plan to bolster key privacy and security in... by julian88888888 on Thursday April 09, 2020 @05:59PM (#22827637)

What additional evidence can you provide? This is concerning to say the least.

[ Parent | on HN ]

Re:Zoom’s 90-day plan to bolster key privacy and security in... by gundmc on Wednesday April 08, 2020 @01:28PM (#22815023)

I'm surprised this isn't a bigger story if it can be substantiated.

Can someone explain what the security trails site shows and how this confirms the allegations?

[ Parent | on HN ]

Re:Zoom’s 90-day plan to bolster key privacy and security in... by 1337_d00dZ on Wednesday April 08, 2020 @01:49PM (#22815235)

The presence of this subdomain does not necessarily prove what exactly _was_ behind this subdomain, but SecurityTrails shows that it did in fact exist during the period when Zoom has misconfigured their network and allowed their DNS records to leak from their internal network.

It additionally appears that there are many other obscene domain names that had leaked out, including f*ckmenumb.athena.ipa.zoom.us [1].

The issue of course is that to my knowledge there are no other historical DNS databases that corroborate the existence of this subdomain, it seems only SecurityTrails has this record.

Two additional notes:

1) The fact that calls are not E2E on Zoom makes the presence of this dashboard entirely possible from a purely technical standpoint. 2) Alex Stamos has been hired by Zoom, which I find interesting timing-wise..., perhaps I am missing context.

[1] https://twitter.com/TwelveSecurity/status/124714209506588672... [2] https://twitter.com/zoom_us/status/1247862458187841537

[ Parent | on HN ]

Re:Zoom’s 90-day plan to bolster key privacy and security in... by bwat49 on Thursday April 09, 2020 @03:59PM (#22826549)

> if it can be substantiated

Key words, I see no actual proof of OPs claim...

[ Parent | on HN ]

Re:Zoom’s 90-day plan to bolster key privacy and security in... by cityzen on Wednesday April 08, 2020 @01:46PM (#22815199)

pretty bold claim... when you say "showed" do you mean personally or that you reached out to him somehow with no evidence that he received information about this?

[ Parent | on HN ]

Re:Zoom’s 90-day plan to bolster key privacy and security in... by londons_explore on Wednesday April 08, 2020 @12:15PM (#22814252)

I don't see anything for that domain...

[ Parent | on HN ]

Re:Zoom’s 90-day plan to bolster key privacy and security in... by catalogia on Wednesday April 08, 2020 @12:48PM (#22814629)

I do, in that link provided in an edit, after getting around google recaptcha (wow securitytrails.com has a shitty website...)

Edit: here's a screenshot: https://twitter.com/danehrlich11/status/1247206209876353025/...

[ Parent | on HN ]

Re:Zoom’s 90-day plan to bolster key privacy and security in... by x0x0 on Wednesday April 08, 2020 @12:15PM (#22814253)

Can you link? I couldn't find that on securitytrails

[ Parent | on HN ]

Re:Zoom’s 90-day plan to bolster key privacy and security in... by rshnotsecure on Wednesday April 08, 2020 @12:32PM (#22814448)

https://securitytrails.com/domain/pussy4all.dashboard-produc...

[ Parent | on HN ]