Please do not use Zoom — Oliver Lorton

Zoom is a video call/conference software that has become very popular of late. The prime minister has been seen using it, my family have asked to use it, colleagues want to use it; however, I will not, and I encourage you not to as well.

All software developers have a responsibility to protect their users' data, audio, and video leaking from systems they have designed. They also have a responsibility to ensure that the systems that they run on are not open to being attacked or compromised. Zoom have repeatedly shown that they do not care about doing this. I do not really understand why though, other than the privacy/security issues, they have usable and popular software. They could be very, very successful in the long term. I suspect, but have no evidence, that management team or product owners are not listening to the development team; or possibly, the development team is incompetent. Either way, something is very wrong at Zoom.

Here are a few examples of their behaviour:

Last summer - a security researcher pointed out that malicious websites could activate the user's webcam without the user's permission. Zoom would not agree that this was a security issue, instead claiming it was required to improve usability. Essentially, saying that usability is more important than security. Eventually, Apple had to step in an fix the vulnerability themselves.
After pointing out the above issue, the security researcher had to decline the bug bounty payout because they wanted him to sign an NDA.
This month - a security researcher has disclosed that Macs are vulnerable to webcam and mic takeover again.
Zoom has been sending users activity to Facebook without their knowledge, whether they have a Facebook account, or not. This feature/bug has now been removed, but not before the New York AG has started an investigation.
When installing Zoom on a Mac Zoom circumvents the standard installation process to install their software. I believe that this is a flaw in the Apple installation system, and not really Zoom's responsibility; however, they choose to bypass it when they do not need to. Apple does need to take a look at this, they should be able to prevent Zoom from doing this.
If you Windows users thought that only Macs were vulnerable to Zooms half-arsed approach to security, then you should be aware that the Zoom Windows client is vulnerable to UNC path injection.

I would love to go into the many issues with Zoom in more detail, but since I do not have time today, I think I'll leave you a list of other articles I have been reading on Zoom.

These are in no particular order …