Hacker News new | past | comments | ask | show | jobs | submit login

[flagged]



How is that not the biggest scandal around this company, as opposed to intentional or not misinformation about end to end encryption (not that it doesn't count, but for this one, if it's real, the company should be brought up to public scrutiny).


Seriously - I never expected or need e2e in my video conferencing (I like transport encryption fine and always thought the lock meant that).

But this would be a huge issue if true.


What additional evidence can you provide? This is concerning to say the least.


I'm surprised this isn't a bigger story if it can be substantiated.

Can someone explain what the security trails site shows and how this confirms the allegations?


The presence of this subdomain does not necessarily prove what exactly _was_ behind this subdomain, but SecurityTrails shows that it did in fact exist during the period when Zoom has misconfigured their network and allowed their DNS records to leak from their internal network.

It additionally appears that there are many other obscene domain names that had leaked out, including f*ckmenumb.athena.ipa.zoom.us [1].

The issue of course is that to my knowledge there are no other historical DNS databases that corroborate the existence of this subdomain, it seems only SecurityTrails has this record.

Two additional notes:

1) The fact that calls are not E2E on Zoom makes the presence of this dashboard entirely possible from a purely technical standpoint. 2) Alex Stamos has been hired by Zoom, which I find interesting timing-wise..., perhaps I am missing context.

[1] https://twitter.com/TwelveSecurity/status/124714209506588672... [2] https://twitter.com/zoom_us/status/1247862458187841537


> if it can be substantiated

Key words, I see no actual proof of OPs claim...


pretty bold claim... when you say "showed" do you mean personally or that you reached out to him somehow with no evidence that he received information about this?


I don't see anything for that domain...


I do, in that link provided in an edit, after getting around google recaptcha (wow securitytrails.com has a shitty website...)

Edit: here's a screenshot: https://twitter.com/danehrlich11/status/1247206209876353025/...


Can you link? I couldn't find that on securitytrails





Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: