Re:Microsoft Teams: 1 feature, 4 vulnerabilities
by jdmichal on Wednesday December 22, 2021 @08:22AM
(#29648954)
The IP leak one is really interesting to me. Considering the quip regarding the fact that centralized servers are performing the link preview operation because it's not using E2E encryption... But if it was, and the client machine was generating the preview, then wouldn't that force exposure of the client's IP to the remote server?
Re:Microsoft Teams: 1 feature, 4 vulnerabilities
by cjbprime on Wednesday December 22, 2021 @09:53AM
(#29650091)
Yes, these are the tradeoffs between client side and server side link previews. (If the sending client does it, they could lie; if the receiving client does it it's a privacy leak and attack surface increase; if the server does it then it sees private data.)
Re:Microsoft Teams: 1 feature, 4 vulnerabilities
by watwut on Wednesday December 22, 2021 @08:09AM
(#29648797)
I did not seen micropenis nor Gates jokes on HN.
Re:Microsoft Teams: 1 feature, 4 vulnerabilities
by blahblah12 on Wednesday December 22, 2021 @08:19AM
(#29648931)
Comments were deleted.
For example, it’s not clear to me why an IP address leak is considered problematic. And breaking chat or crashing on reload seems more akin to a bug a la iMessage link bugs like https://www.theverge.com/2018/1/18/16904774/ios-iphone-bug-c.... That type of issue should be fixed, but it’s not a vulnerability that’s meaningfully exploitable for either remote code execution, stealing client credentials, or stealing client data.