Hacker News Reader

Comment by Spooky23 | Hacker News Reader

I'm not a fan of Zoom... But the pile-on of grief is ridiculous.

The "war dialing" issue is a great example. Webex has had the exact same "flaw" for a decade, with the exact same solution - set a meeting password. Other solutions like Google Meet or Skype have the "lobby" approach.

View on HN

Fun fact - perhaps not widely known and perhaps why it shares a similar philosophy as Webex:

Zoom was founded in 2011 by Eric Yuan, a lead engineer from Cisco Systems and its collaboration business unit WebEx.[1] [1] https://en.wikipedia.org/wiki/Zoom_Video_Communications#Hist...

I've always wondered about spinoff startups like this from larger companies: aren't there usually non competes that would prevent them starting them?

They're not usually infinite. My father waited one out for three years, then went back into the industry for a rival firm and put his old boss out of business.

They're generally not enforceable in California, provided you're not making use of any protected IP or what not.

https://casetext.com/statute/california-codes/california-bus...

Isn't it easily fixed by making IDs slightly higher entropy, and also rate limiting retries? Something like a Youtube ID which is 11-char in Base62, which is short enough but has so much entropy that even know with billions of videos, entering a random ID will most likely not work.

You should also always have some reasonable rate limit of any sort of API query, if someone is querying rooms at 10qps or more, there's clearly something wrong.

I wouldn't be shy about betting the reason they haven't done this is because they don't want the ids to be longer/have a larger character set than they have to be, because they'd take longer/be more error prone to type/say out loud. Lowest possible friction: the reason for most of their flaws thus far.

A phone number is already 10 digits. As long as you put proper break characters between the groupings it's not hard to read IMO.

They could also just generate 4 words and string them together as the password. Considerably more entropy than 10 digital and easier to communicate too.

English-specific tho

Not hard to do it for any language. And they're cheap to make.

    Your memorable phrase is 'correct horse battery staple'.
    
    <copy>     <generate new phrase in $LANG>

Its not often that people without a common language have zoom meetings anyway

You need the ability to enter the code on a numeric keypad when dialing in from an office phone. Compatibility with "ancient" enterprise practices is also important.

Ah, that makes a lot of sense. I'd never considered that!

Why not a word-based code for most people, and a numerical one for places that need them (can be enabled/disabled in the tenant), and only allows for phone connections?

This is exactly what jitsi does

Using american-english dictionary from aspell [1] and filtering for lines that only contain lower case letters [2] gives you 77649 words. For four words that gives approx 64 bits of entropy [3].

[1] Probably available on a Linux system at /usr/share/dict/american-english

[2] '^[a-z]+$'

[3] log_2(77649^4)

Kind of like the what3words approach to GIS

[1] https://what3words.com/about-us/

Agreed.

I will add: security and convenience are always polar opposites.

The most successful companies are typically the ones that can get away with being as convenient as possible for the longest.

I would disagree about "always" polar opposites. For example SSO/iDP like Okta add a ton of security but also makes it easier while more secure for employees to log in to their multitude of company apps.

I think the catch is that people only notice when they're opposites. If making something more secure also improved the usability (or didn't harm it), then things would (generally) be done the better way. It's only when there's tension or compromises to be made between the requirements that we actually see it, and start to think that they're opposites - because in those cases it is.

An excellent point, and I’m hoping some examples come up to show that convenience and security actually can be in the same direction.

While I agree that things like SSO can be more secure and more convenient for the user, that doesn’t actually make them more convenient overall. In your example it’s mainly the fact that Okta has abstracted away the complexity so that businesses don’t see it.

I’m open to being proven wrong, and as eythian implied, I may in fact be subconsciously cherry-picking times where security and convenience were opposites and missing times where they were not, but even with that awareness no counter examples are coming to mind.

Zoom meeting ids have to be enterable in the phone bridge

speech recognition's probably good enough if you pick your dictionary well

Across a range of accents and such, I'd be surprised.

IMO, when it comes to security, the fact that other people have made the same mistake makes a design flaw more egregious, not less.

That is absolutely not an information security norm. Most security mistakes fall into common patterns.

It’s not an egregious flaw, any more than the telephone numbering system is. It’s a design decision to improve usability that is generating a lot of noise during an extraordinary period.

Usability is the zoom priority, and the reason why people who already own more secure, no cost, solutions like Teams, Skype or Google Meet buy Zoom.

Knowing someone's phone number very obviously doesn't grant you direct access to autojoin their calls with people. At _best_ you can attempt to tell if they're currently in a call or not by calling them, but even that is far from reliable (e.g. in places where voicemail isn't as much of a thing do not disturb is sometimes implemented by pretending to be busy or switched off)

People often forgot that its a Security-Usabilty scale, with perfect security on one side and perfect usability on the other. An unplugged computer is perfectly secure, while a computer wide open is perfectly usable. But neither is usually preferable.

As with most things, its a trade off.

Zoom in fact also allows you to enable a "waiting room" for all meetings owned by your account.

It's not always ideal though. I've organized meetings with 10+ people, want able to attend the meeting and now nobody can join the session.

I'm not sure about this, but there is a way to make someone a co-host who could then presumably make those decisions?

Reply on news.ycombinator.com