,
4 tweets,
3 min read
Read on Twitter
@johannh Let's be quite clear here:
Zoom intentionally created a vulnerability to work around a security improvement in Safari. This was done to save the user a single click.
Zoom intentionally created a vulnerability to work around a security improvement in Safari. This was done to save the user a single click.
@johannh Also note that because Zoom decided that requiring a single click from the user is unacceptable, the vulnerability that they chose to create as a workaround also means that receiving a simple email can result in your camera and microphone being turned on. Neat.
@johannh And on the Windows side of things, both Internet Explorer and Edge also launch Zoom without prompting (albeit not apparently via a process listening on localhost). Chrome and Firefox behave sanely in that the user is prompted before a 3rd-party application is launched.
@johannh Why do Edge and IE not prompt before launching Zoom, one might ask.
Good question. The installer for Zoom explicitly sets the WarnOnOpen registry value to 0 for the zoommtg protocol. Edge and IE both obey this registry directive, and happily launch the associated app w/o warn.
Good question. The installer for Zoom explicitly sets the WarnOnOpen registry value to 0 for the zoommtg protocol. Edge and IE both obey this registry directive, and happily launch the associated app w/o warn.
