Hacker News Reader

If those accounts belong to an org with SSO enabled and mediocre security, that’s a win for the crooks.

Huh? It's not like Zoom offers an SSO solution. The value of the accounts is two-fold:

1) Looking for Zoom premium accounts, there is actually a pretty good trade in stolen accounts on the dark web. Folks will pay a dollar for example for one of these accounts.

2) This is the more likely one—looking for people who use one shared password across multiple valuable logins.

SSO is offered at the "Business" plan level. So I guess the question would be how many of the stolen accounts were for users at a lower plan level but were also controlled by espionage-worthy companies.

You can authenticate with Zoom using your existing SSO solution, not the other way around. When using SSO the Zoom account wouldn't have a password at all.

Exactly. I'm surprised there are accounts from large companies that must have some sort of SSO with MFA solution. Are they not using it with Zoom? That's a no brainer

>2) This is the more likely one—looking for people who use one shared password across multiple valuable logins.

This is my point.

Reply on news.ycombinator.com