- ttf - lists.iana.org

Zoom Security
by Lutz Donnerhacke April 17, 2020

April 17, 2020

I've been quite during the latest discussions of Zoom insecurity, because I do not consider the issues to be that serious. Most of the issues were social engineering, insecure credential handling by clients, misconfiguration by users etc. pp. Zoom has respond in an appropriate way, so I'm fine this those. But now the zoom client is inspected professionally, and it shakes my grounds. Please have a look at https://dev.io/posts/zoomzoo/ Horrible is the wrong word. Lutz Donnerhacke

2 1

Infogram comparison of conference tools by DIPLO
by Glenn McKnight April 15, 2020

April 15, 2020

https://infogram.com/survey-of-online-platforms-1h984wd5yjxd2p3 Glenn McKnight ICANN NOMCOM 2019-2021 mcknight.glenn(a)gmail.com Curator for Internet Governance Hub Blog www.internetgovernancehub.blog <http://www.internetgovernancehub.blog> http://toronto.ieee.ca/ IEEE Toronto SIGHT Chair glenn.mcknight(a)ieee.org skype gmcknight twitter gmcknight 289-830 6259 .

2 1

Zoom Product Updates: New Security Toolbar Icon for Hosts, Meeting ID No Longer Displayed - Zoom Blog
by Alfredo Calderón April 12, 2020

April 12, 2020

4 3

Fwd: Zoom Meetings Security Enhancements - Coming April 5th
by Olivier MJ Crépin-Leblond April 3, 2020

April 3, 2020

FYI --- there's been a lot of Press in the past 48H about security problems regarding Zoom. A quick fix for defaults looks likely from Monday. Kindest regards, Olivier -------- Forwarded Message -------- Subject: Zoom Meetings Security Enhancements - Coming April 5th Date: Fri, 03 Apr 2020 13:25:56 -0600 From: Zoom Video Communications <support(a)zoom.us> To: ocl(a)gih.com We’re always striving to continue to deliver you a secure virtual meeting environment. Based on feedback from our community, we’ve chosen to enable passwords on your meetings and turn on Waiting Rooms by default starting April 5th, as additional security enhancements to protect your privacy. Header Logo <http://click.zoom.us/e/84442/2020-04-03/bjwp6h/1500135842?h=dzrpS3nK9bJPPQ8…> Sign In <http://click.zoom.us/e/84442/signin/bjwp6k/1500135842?h=dzrpS3nK9bJPPQ8kNS3…> Dear Valued Customer, We’re always striving to deliver you a secure virtual meeting environment. *S**tarting April 5th, *we’ve chosen to enable passwords on your meetings and turn on Waiting Rooms by default as additional security enhancements to protect your privacy. *Meeting Passwords Enabled “On”* Going forward, your previously scheduled meetings (including those scheduled via your Personal Meeting ID) will have passwords enabled. If your attendees are*joining via a meeting link, there will be no change to their joining experience.* For attendees who join meetings by manually entering a Meeting ID, they will need to enter a password to access the meeting. For attendees joining manually, *we highly recommend re-sharing the updated meeting invitation <http://click.zoom.us/e/84442/fhZk1tUtto8/bjwp6m/1500135842?h=dzrpS3nK9bJPPQ…>*<http://click.zoom.us/e/84442/fhZk1tUtto8/bjwp6m/1500135842?h=dzrpS3nK9bJPPQ…>*before your workweek begins.* Here’s how you can do that: Log in to your account, visit your *Meetings <http://click.zoom.us/e/84442/meeting/bjwp5t/1500135842?h=dzrpS3nK9bJPPQ8kNS…>* tab, select your upcoming meeting by name, and copy the new meeting invitation to share with your attendees. For step-by-step instructions, please watch this *2-minute video <http://click.zoom.us/e/84442/t6W3XZ2KAqo/bjwp5w/1500135842?h=dzrpS3nK9bJPPQ…>*or *read this FAQ <http://click.zoom.us/e/84442/hc-en-us-articles-360041408732/bjwp5y/15001358…>*. For meetings scheduled moving forward, the meeting password can be found in the invitation. For instant meetings, the password will be displayed in the Zoom client. The password can also be found in the meeting join URL. *Virtual Waiting Room Turned on by Default* Going forward, the*virtual waiting room feature *will be automatically turned on by default. The *Waiting Room <http://click.zoom.us/e/84442/cles-115000332726-Waiting-Room/bjwp63/15001358…>* is just like it sounds: It’s a virtual staging area that prevents people from joining a meeting until the host is ready. *How do I admit participants into my meeting? * It’s simple. As the host, once you’ve joined, you’ll begin to see the number of participants in your waiting room within the *Manage Participants* icon. Select*Manage Participants *to view the full list of participants*, *then,**you’ll have the option to admit individually by selecting the blue *Admit *button or all at once with the *Admit All* option on the top right-hand side of your screen. For step-by-step instructions, please watch this *2-minute video <http://click.zoom.us/e/84442/ySas2Rgi6yA/bjwp61/1500135842?h=dzrpS3nK9bJPPQ…>*. Check out these resources to learn *How to Manage Your Waiting Room* <http://click.zoom.us/e/84442/cles-115000332726-Waiting-Room/bjwp63/15001358…>**and***Secure Your Meetings with Virtual Waiting Rooms <http://click.zoom.us/e/84442/r-meetings-zoom-waiting-rooms-/bjwp65/15001358…>.* For more information on how to leverage passwords and Waiting Rooms to secure your meetings, please visit our *Knowledge Center <http://click.zoom.us/e/84442/hc-en-us-articles-360041408732/bjwp5y/15001358…>*, attend a *daily live demo <http://click.zoom.us/e/84442/ebinar-register-weeklylivedemo/bjwp67/15001358…>*, or visit our *Blog <http://click.zoom.us/e/84442/2020-04-03/bjwp69/1500135842?h=dzrpS3nK9bJPPQ8…>*. Please reach out to our Support Team if you have any questions at *support(a)zoom.us <mailto:support@zoom.us>.* Thank You! Team Zoom Twitter <http://click.zoom.us/e/84442/zoom-us/bjwp6c/1500135842?h=dzrpS3nK9bJPPQ8kNS…> LinkedIn <http://click.zoom.us/e/84442/oom-video-communications-inc--/bjwp6f/15001358…> Pinterest <http://click.zoom.us/e/84442/2020-04-03/bjwp69/1500135842?h=dzrpS3nK9bJPPQ8…> +1.888.799.9666 <tel:1-888-799-9666> © 2020 Zoom - All Rights Reserved Visit zoom.us <http://click.zoom.us/e/84442/2020-04-03/bjwp6h/1500135842?h=dzrpS3nK9bJPPQ8…> 55 Almaden Blvd San Jose, CA 95113 <http://click.zoom.us/e/84442/38m23d37-33285414d-121-8949083/bjwp6p/15001358…>

2 1

Krebs on Security : ‘War Dialing’ Tool Exposes Zoom’s Password Problems
by Dev Anand Teelucksingh April 3, 2020

April 3, 2020

As the Coronavirus pandemic continues to force people to work from home, countless companies are now holding daily meetings using videoconferencing services from *Zoom*. But without the protection of a password, there’s a decent chance your next Zoom meeting could be “Zoom bombed” — attended or disrupted by someone who doesn’t belong. And according to data gathered by a new automated Zoom meeting discovery tool dubbed “*zWarDial*,” a crazy number of meetings at major corporations are not being protected by a password. https://krebsonsecurity.com/2020/04/war-dialing-tool-exposes-zooms-password… Also https://www.zdnet.com/article/the-internet-is-now-rife-with-places-where-yo… The internet is rife with online communities where users can go and share Zoom conference codes and request that pranksters connect and hurl insults, play pornographic material, or make death threats against other participants -- in a practice called Zoom-bombing or a Zoom raid.

1 0

The Intercept : Zoom Meetings Aren’t End-to-End Encrypted, Despite Misleading Marketing
by Dev Anand Teelucksingh April 1, 2020

April 1, 2020

Zoom, the video conferencing service whose use has spiked amid the Covid-19 pandemic, claims to implement end-to-end encryption, widely understood as the most private form of internet communication, protecting conversations from all outside parties. In fact, Zoom is using its own definition of the term, one that lets Zoom itself access unencrypted video and audio from meetings. https://theintercept.com/2020/03/31/zoom-meeting-encryption/

3 4

Fwd: [uknof] [uknot] Videoconferencing
by Olivier MJ Crépin-Leblond March 27, 2020

March 27, 2020

FYI - first time I hear of this conferencing system. -------- Forwarded Message -------- Subject: Re: [uknof] [uknot] Videoconferencing Date: 26 Mar 2020 18:15:06 -0400 From: LeeQ @ BitBahn.io <leeq(a)bitbahn.io> To: Ray Bellis <ray(a)bellis.me.uk>, uknof(a)lists.uknof.org.uk <uknof(a)lists.uknof.org.uk> Ray, Have you seen Jitsi? We have it running on a public server. Https://public.huddle.zone <Https://public.huddle.zone> It is a mixture of XMPP and WebRTC. Regards Lee

4 3

Language services at ICANN 67
by Dev Anand Teelucksingh March 23, 2020

March 23, 2020

Gives a overview of the technical challenges of providing simultaneous interpretation using Zoom https://www.icann.org/news/blog/language-services-at-icann67

5 7

Zoom participant limits
by Olivier MJ Crépin-Leblond March 20, 2020

March 20, 2020

Dear colleagues, during the ICANN meeting we saw full Zoom meeting rooms limited at 300 people and Webinar rooms assumed to be higher than that perhaps thousands of people. Are the limits technical limits, or are they they imposed by the subscriptions that ICANN got? I note the pricing which appears to point out that more than 300 people are possible for a full Zoom room? https://zoom.us/pricing Kindest regards, Olivier

5 7

Re: [technology taskforce] [At-Large] Google Developers : Humans can't read URLs. How can we fix it? - HTTP 203
by Dev Anand Teelucksingh Feb. 12, 2020

Feb. 12, 2020

Dr. Alejandro Pisanty Baruch <apisan(a)unam.mx> wrote: "is this just one more iteration of "domain names will cease to be relevant soon" or is it a move or trend that will definitely undermine their importance and therefore also change the markets?" I think no, this is not an iteration about domain names becoming irrelevant. The discussion focused on how to ensure browser users can identify what domain they are visiting so IMO, it strengthens the use of domain names by having users trust the domain they are visiting. The challenge as I see it is with the prevalence of many new TLDs, the risk of phishing and malware attacks are higher where bad persons try to trick persons to either: - go to bad persons' website(s) at domains pretending to be another organisation/service in order to get user login credentials to such organisations/services or - open links to malware files and become infected. So typically, bad persons would use typos that look similiar to the legitimate domain or add a few characters before or after the 2nd level domain So for example.com, there could be exannple.com , examp1e.com, eexamples.com and examples.com . With more TLDs and wider use of ccTLDs, bad persons could also do things like examples.xyz, examp1e.tv and so on. With longer URLs, one can mask the legitimate domain as a third or fourth level subdomain of a bad persons' domain. Very long URLs like this are more difficult to parse and read on a mobile phone. Content Management Systems for websites over the years unfortunately generate long URLs that do work to direct persons to websites but are obscure for persons to parse. So an example of a bad URL : https://community.icann.org.can.work/display/atlarge/2020-01-27+At-Large+Te… Persons glancing at this URL would see icann.org and may think everything is fine and go ahead and click on the URL when its not. Nearly all browser vendors are using the Public Suffix List at https://publicsuffix.org/ which started as a Mozilla Initiative. >From the Public Suffix List website, a "public suffix" is one under which Internet users can (or historically could) directly register names. Tracking this is important to ensure that a website can't set cookies that other websites can read or modify under the same domain. What the episode showed was that Mozilla Firefox (at least on the desktop) highlights the part of the domain that is the public suffix by making it slightly bolder than the rest of the URL. It is however to me, very, very subtle and I wish that Mozilla (and other browsers) make the public suffix part more bold or even a slightly bigger font size to alert users as to the true domain being viewed. Some mobile browsers are showing only the domain and not the rest of the URL and allow for the full URL can be viewed and edited when you tap on the URL bar which also helps. Kind Regards, Dev Anand Teelucksingh On Sun, Feb 9, 2020 at 3:23 PM Dr. Alejandro Pisanty Baruch <apisan(a)unam.mx> wrote: > Dev, > > thanks a lot for sending this. While at first it may seem off-topic, it > cuts deeply into very relevant questions for us: is this just one more > iteration of "domain names will cease to be relevant soon" or is it a move > or trend that will definitely undermine their importance and therefore also > change the markets? If it proceeds, what balances of power will appear that > we don't face now? One example: will the companies that operate search or > that provide browsers (or both!) earn new powers? This is already being > discussed elsewhere. What are the views that are relevant for ICANN > Internet users At Large, and other stakeholders? > > Yours, > > Alejandro Pisanty > > > - - - - - - - - - - - - - - - - - - - - - - - - - - - > Dr. Alejandro Pisanty > Facultad de Química UNAM > Av. Universidad 3000, 04510 Mexico DF Mexico > > > > +52-1-5541444475 FROM ABROAD > > +525541444475 DESDE MÉXICO SMS +525541444475 > Blog: http://pisanty.blogspot.com > LinkedIn: http://www.linkedin.com/in/pisanty > Unete al grupo UNAM en LinkedIn, > http://www.linkedin.com/e/gis/22285/4A106C0C8614 > Twitter: http://twitter.com/apisanty > ---->> Unete a ISOC Mexico, http://www.isoc.org > . . . . . . . . . . . . . . . . > ------------------------------ > *Desde:* At-Large [at-large-bounces(a)atlarge-lists.icann.org] en nombre de > Dev Anand Teelucksingh [devtee(a)gmail.com] > *Enviado el:* viernes, 07 de febrero de 2020 11:21 > *Hasta:* At-Large Worldwide > *Asunto:* [At-Large] Google Developers : Humans can't read URLs. How can > we fix it? - HTTP 203 > > "In this episode, Jake makes the case that URLs are impossible for humans > to interpret, especially when it comes to security. What are browsers doing > today to overcome that? And, is there a better way" > > Watch the 20 min episode : > https://youtu.be/0-wB1VY3Nrc > > Dev Anand >

4 3