Zoom security doubtful

(Posting here as the Security forum seems to be almost moribund and this looks important)

A few days ago I read on a mainstream news site that the Cabinet was having virtual meetings using this software, yet the software is far from secure. Now we have further worrying information about it.

For instance it appears that data may be routing through China, including encryption and decryption keys, and 700 of the development team are in three companies in mainland China.

I did a quick search on these forums and see it is in use by some members, so posting to warn them and anybody else considering it in case they aren't aware of this.

I've been invited to join a group of friends on it for drinks but have refused because I'm deeply security paranoid.

That's as well as being deeply antisocial

By default all traffic to and from China is blocked by my firewall. I wonder if it would even work. It probably would if Zoom's explanation is correct.

Zoom has recently disabled web client access so users must now install an app to use the service - something which opens up even more potential security problems.

Edited by caffn8me (Sat 04-Apr-20 08:32:51)

I wonder how Zoom security compares to Cisco Jabber or Webex

In reply to a post by dect:

I wonder how Zoom security compares to Cisco Jabber or Webex

You might find this interesting:
https://www.schneier.com/blog/archives/2020/04/secur...

In reply to a post by caffn8me:

Zoom has recently disabled web client access so users must now install an app to use the service - something which opens up even more potential security problems.

I've used the Zoom web client a few times and indeed clicking on it now throws up "403 Forbidden".

Perhaps this is because the data sent via a browser was not secured sufficiently relative to the app (I'm giving Zoom the benefit of the doubt...).

A few days ago there was a picture on the BBC news of the cabinet using it!

AIUI the security depends on how you use it. You can configure it so that only the originator of a session can allow others to join. Even then the joiners have to know a 10 digit meeting ID.

In reply to a post by caffn8me:

By default all traffic to and from China is blocked by my firewall. I wonder if it would even work. It probably would if Zoom's explanation is correct.

I suppose you refuse to order a Chinese take away as well.

In reply to a post by jchamier:

You might find this interesting:
https://www.schneier.com/blog/archives/2020/04/secur...

Many thanks, its an interesting article.

I have used the Cisco products many times over many years but don't think I will be wanting to using Zoom anytime soon.

Edited by deleted (Sat 04-Apr-20 11:30:50)

In reply to a post by dect:

I have used the Cisco products many times over many years but don't think I will be wanting to using Zoom anytime soon.

My employer uses Cisco Webex (they bought them) exclusively, it seems to work very well. I am thankful I have good upstream bandwidth and VM in this area is not oversubscribed.

In reply to a post by Andrue:

In reply to a post by caffn8me:

By default all traffic to and from China is blocked by my firewall. I wonder if it would even work. It probably would if Zoom's explanation is correct.

I suppose you refuse to order a Chinese take away as well.

Well, I wouldn't order one from China (it'd be cold by the time it arrived).

The other difference is I don't have Chinese restaurants trying to break in all the time whereas with Chinese computers it's a constant and coordinated onslaught.