Hacker News Reader

Comment by Razengan | Hacker News Reader

Zoom is associated with malware in my mind. Is it the same app/service that was infamous on here for a while?

You’re probably thinking of a security vulnerability in their Mac client due to a poor design choice that they were negligent in fixing expediently.

Still, I don’t think this classifies the app as malware—the behavior was not added with malicious intent.

https://medium.com/bugbountywriteup/zoom-zero-day-4-million-...

That definitely counts as malware. Intent is irrelevant. Same with Google's Keystone and Dropbox storing admin passwords.

If you have higher access to my system than you led me to believe, you are malware.

So Google is associated w/ malware in your mind? And Dropbox? You seemed to be saying Zoom is primarily associated w/ malware for you. If so, you feel the same as the other two brands/companies?

If I uninstall Chrome, will it reinstall itself by keeping a daemon running?

Apparently Keystone did/does something like that.

How is it not malware that after you uninstall software that there is a backdoor that will allow them to reinstall it?

Yep, same Zoom.

https://www.theregister.co.uk/2019/07/11/apple_removes_zooms...

Zoom is great. It did have a bad news cycle because they had installed a url handler that let folks initiate meetings with video sharing just by getting them to click a link. That news cycle got that behavior removed and now there's a confirmation screen before you go into a meeting after clicking a link.

Zoom has been pretty consistently terrific for us. I'm at a distributed company so we live in it and it's very reliable and makes it easy to see the faces of _everyone_ on the call with you.

Wasn't there another unrelated MacOS issue where their client was un-uninstallable? It would perpetually install itself. I may be mixing them up with someone else. That might be what the parent was talking about, though, since that's particularly malware-esque.

Why yes, yes there was.

https://www.theregister.co.uk/2019/07/11/apple_removes_zooms...

This is the same issue. The component in question was responsible for the URL handling, and it was also responsible for reinstalling the Zoom client app if it was not present when a link was clicked.

I had the same mental association and my first thought looking at this feature was: "What sort of misguided, insecure feature did they come up with this time?"

I'm not saying this feature is misguided because I know very little about it, but I am echoing that this too was my first impression however founded or unfounded it may be.

I realize that a company like this is stuck between a rock and a hard place when it comes to balancing growth and convenience and security, but it's very important to understand that when you lose trust by features that seem to be impetuously designed, people are going to start look at new features with suspicion.

It might be in Zoom's best interest to put out a write-up that targets IT people and explains the technology a little more in depth for forums like this one. Automagic demos are nice, but we also want to know how the security and other use cases were considered. Gain our trust, and we'll be bigger cheer leaders than your average users.

Yes. It was deliberate and not a bug, the only problem in the company's mind was that they got caught. They have features they wish to deliver, and will exploit any weakness in your system to do so.

Reply on news.ycombinator.com