Zoom and security of files

[Kissanminttu]

Hi,

I was "forced" to download Zoom-programm (for distance communication) on my laptop because of my studies.
I have read that Zoom has several security problems. Do I have to protect my files with password if so, how can I do that?
I'm using Mint Cinnamon.

How can i use Zoom safety? I don't want to share any of my personal data or files with zoom. Do i have to fear spies?

[smurphos]

If these articles are accurate (the register isn't always in my experience) it's not a great app privacy wise...

https://www.theregister.co.uk/2020/04/0 ... spotlight/

https://www.theregister.co.uk/2020/03/2 ... m_privacy/

[Colson P]

You are right, Zoom is not the best application privacy-wise, but you do have a solution. You can "sandbox" Zoom so it can't access anything outside the files it needs to run. To do this you can install and use Firejail, as specified in the article here:
https://www.linux.com/topic/desktop/lo ... firejail/
Once you run through the instructions in this article, you can open a terminal and run

Code: Select all

firejail zoom

This launches Zoom in a container.

[kukamuumuka]

You can make password-protected packages following way: Right mouse click above file or folder -> compress -> select zip and set password

PS. You cannot use ääkkösiä in the password.

[Kissanminttu]

I read that Firejail has caused many problems, is it so?

If i protect my files with password, is it possible that someone has already get on my files and sees the password i choose?
I have already used the zoom about the month and how can i be sure that some spies are not already messing up on my mint? # Foilhat

[kukamuumuka]

zip-passwords can crack, but who wants to use CPU time and energy for that?

I do not belive that someone would be intrested in students files.

[Kissanminttu]

But if somebody is already on my computer and sees what i write?

[Colson P]

After some research I found Firejail does have problems as well.

Here are some other options you have for increasing your security:

• -Install another Linux onto a USB stick, install Zoom onto that stick, and remove permissions from the USB stick so it can't access the personal files on your HDD.

• -provide as little information as possible to your account

• -use Docker to contain Zoom (somewhat like firejail), although that requires an AWS & Docker Hub account:
  https://docker-curriculum.com/
  

• -install a Linux virtual machine using Oracle VirtualBox and run Zoom in the VM. (my recommendation)

[kukamuumuka]

But if somebody is already on my computer and sees what i write?

In that case there is nothing to do ... or maybe you give her/him + 16.0 eyeglasses.

[karlchen]

Oh, I see that there is an ongoing discussion on "Zoom" and "security concerns" already.
Triggered by the current hype about "Zoom", which seems to become a new "must have", irrespective of its security issues of various kinds, and triggered by something, which my wife had come across in the media, I had been going to suggest that everybody, who considers using "Zoom", may want to do a Google search on zoom security concerns e.g. and perhaps revise their decision.
zoom security concerns

[lsemmens]

Thanks Karl, I have passed that on to the IT department of our Church who are running Zoom meetings across all campuses.

[thx-1138]

...note 1: "Zoom is BAD!" all over the net (right after it's usage skyrocketed due to lockdown).
And what are the usual 'more-or-less alternatives'? Let's see...
Skype for Business, Microsoft Teams, and Google Hangouts. Ahhhh...
Excellent choices all of them, may i add. Food for thought probably.

...note 2: "In March 2019, Zoom filed to go public on the NASDAQ; on April 18, 2019, the company went public,
with shares up more than 72%, with an Initial public offering of US$36 a share.
The company was valued at just under US$16 billion by the end of its IPO."

"Zoom's closed source software is claimed to be compliant with FedRAMP, HIPAA, PIPEDA and PHIPA, and the GDPR."

"Zoom claims to use Advanced Encryption Standard 256-bit (AES 256) encryption."

Right. All info straight from Wikipedia.
You find me a single reputable cryptographer who will even dare suggesting,
that 'insert-whatever-closed-src' product that can't be audited for it's crypto implementation can ever be...'secure'.

As in, not even sure what you're all discussing here in the first place.
It's (theoritically) as much...'secure' as it's usual 'more-or-less alternatives'.
Practically, remains to be seen: who knows, maybe one day, by leeching data right & left,
Zoom might reach the (in trillion$...) company value (...and political contacts/influence) of MS & Alphabet ...

Do i have to fear spies?

I dunno. Do you?

[Moem]

...note 1: "Zoom is BAD!" all over the net (right after it's usage skyrocketed due to lockdown).
And what are the usual 'more-or-less alternatives'? Let's see...
Skype for Business, Microsoft Teams, and Google Hangouts. Ahhhh...

A decent opensource alternative is Jitsi.

[thx-1138]

Yes, i've read (not in much detail to be honest) about Jitsi, but i didn't mentioned it also because:
1) i didn't wanted to possibly turn it here into a more generic 'free software vs open src vs closed src etc' discussion,
as it's not up to being an ethical / ideological discussion in the first place when it comes to cryptography:
it's all "show me the math & the code", else, it's either snake-oil, backdoor, or both.
The rest of the hype / current 'anti-Zoom' campaign i find to be semi-irrelevant mambo jambo,
and 'business as usual' / games within the industry between different players.
2) because OP said he was forced 'because of his/her studies',
so not really up to him/her to choose using something else.

To not sound overtly negative, well, life's just a long series of compromises
(on the bright side, eventually we die, hence the world gets a relief from our annoying presence...)
So, in the meanwhile, and to get on with it by the end of the day,
i'd personally simply try using / configuring it with Firejail as it was already mentioned earlier.
Video performance will suffer lots under Vbox (but hey, you could give it a try).
As for Docker / pulling remote images & running not cli but X apps under such,
besides being kinda of a pita to pull it off & error-prone, i'd expect:
a) very severe latency / dropouts for 'realtime' video streaming...
b) some pretty complicated issues that could likely defeat the whole purpose in the first place,
unless someone knows exactly what he/she is doing (ie. what's the point of pulling a remote container,
if you'll eventually forward / give it access to your...local 0:0 display? This would need quite a bit of reading / research).

[Fred Barclay]

I read that Firejail has caused many problems, is it so?

Hi Kissanminttu,
I'm one of the primary Firejail devs -- if there's anything I can do to help you run Zoom in firejail feel free to ask or PM me!

We've closed several issues with Zoom recently -- as far as I know there are no remaining issues but I don't use Zoom on Linux myself...
https://github.com/netblue30/firejail/i ... s%3Aclosed

Cheers!
Fred

[ZakGordon]

Does zoom run through a browser? Or is it it's own independant software?

If it runs via a browser you could install Brave and run the Tor tab on that then run Zoom over that?

If Zoom does not work that way, then well i'm not sure what else to do other than pay close attention to Zoom's own settings (a bit like you have to when using Windows 10 and wanting to protect your privacy as Windows 10 default settings is not private!).

[trytip]

never used zoom, i will tell you after i experience it in linux or win10. my family just asked to have a zoom meeting so we can all chat since some of us are in different states. but i highly doubt it's any more less secure than skype or others. will revisit this thread after i actually install it and use it myself

[Colson P]

Zoom can be used through a web browser or installed onto your OS. I like the idea of just using Zoom through your web browser through Brave. Brave is an awesome and very secure web browser (using it to type this reply now!). The rewards system is really cool, especially how it uploads zero tracking data to a server to display ads.

To install Brave, run these commands:

Code: Select all

curl -s https://brave-browser-apt-release.s3.brave.com/brave-core.asc | sudo apt-key --keyring /etc/apt/trusted.gpg.d/brave-browser-release.gpg add -

sudo sh -c 'echo "deb [arch=amd64] https://brave-browser-apt-release.s3.brave.com bionic main" >> /etc/apt/sources.list.d/brave.list'

sudo apt update

sudo apt install brave-browser brave-keyring

[lsemmens]

Interestingly enough I'm in a zoom meeting as I type. After the comments above, I passed the comments on to our IT dept. They've now added a password to joining the zoom meeting.

[wallyUSA]

We are thinking about using Zoom for our Lifelong Learners Institute (LLI). I have been testing for the past 2 days. A few negative news articles this week but most say you can avoid problems with two simple steps. The Host person should make Guests use a password and each Guest should have to wait in the 'waiting room' until admitted by the Host.

HTH

UPDATE: And a plus - Zoom is cross platform: M/S, MAC & Linux!