Hacker News Reader

Comment by kelnos | Hacker News Reader

This is a really good point, and I actually sympathize with how difficult it is for Zoom to strike the right balance here.

If the only method of operation here were for people to invite others by copy/pasting a URL, and the invitees' only method of joining were to click on that link, then long UUIDs or such would be just fine.

But Zoom lets you dial in audio-only from a regular phone. You simply just cannot use "long random string" as an identifier if you're expecting someone to punch it into a telephone keypad. Even having an 9- to 11-digit meeting code plus say a 6-digit passcode would be a burden for some people, though it's really the only way to do that portion of it right.

Now, one thing I do not cut Zoom any slack for is having an API where you can request validity and status of any meeting ID, without any rate limits placed on it. That's Security 101 right there.

View on HN

I don't know if botnets are still a thing, but it used to be that any rate-limits needed to be multiplied by 10k for even a modest attacker, as being able to query from 10k unique nodes was a fairly trivial problem by renting a botnet.

Meet has a 10-letters ID for meetings over HTTP and a 9-numbers ID (like zoom) for phoning in. It sounds complicated but in practice every Meet invitation has a single-tap phone link that dials the correct number and input the conference ID after a pause, all encoded in the link. It works flawlessly and so it doesn’t matter if that number is different from the concernce URL you click on a computer.

You are assuming a cell phone that calls in. But lots of people dial in manually from an actual telephone.

Do you have any statistics on "actual phone" usage? I'd imagine it's very low these days.

> Even having an 9- to 11-digit meeting code plus say a 6-digit passcode would be a burden for some people, though it's really the only way to do that portion of it right.

Strong disagree; people can handle 10-digit phone numbers, they can handle an order 10-digit meeting ID.

Who memorizes phone numbers anymore? Just because you can doesnt mean you will if theres an easier alternate version, and a lot of the public doesnt care about security enough to not use to easier option

Who said anything about memorize? There is no universal dial-in number -- for dialling into a conference, you're provided with a phone number and a meeting code. People already can manage that much. If the meeting code needs to be 15 digits in order to neuter "zoombombing", that's not much of a hurdle or burden.

People didn’t really memorize 10 numbers that often anyway. Most people whose numbers you knew would be in a small set of area codes, or just one, and even the next three might only have a couple possibilities for most useful numbers, unless you lived in a very dense area.

If you have the same meeting every day, you will start memorising the numbers naturally.

Reply on news.ycombinator.com