Re: [irsg] Meetecho for interims?

[Toerless Eckert <[e-mail]>]

Carsten:

What specifically are the technical risks for which you would not have joined
a ZVC meeting, such as one of the IETF108 side meetings that used zoom ?
(or for that matter of course future interims, which this thread is about)

If the reason is fear of unknown undetected security risk due to lack of
trust into the security diligence of ZVC, would using the RTCweb browser
client instead of the native client resolve this issue ?

IMHO:

If we want future interims like past interims to be publically announced
without participant auhentication, i think zoombombing would be a risk
for any platform we choose: meetecho, webex, zoom, BBB, whatever.

Given how an interim is meant to be public and i hope recorded, there
is no risk of undesired recording by third party either (as in: please go ahaead).

Leaves as the biggest risk AFAIK the problem of clients creating backdoors,
and i would hope that w3c/ietf work on browser client platform security
would be sufficient.

Of course, we could argue that we would like authentication for all IETF
activities to also overcome zoombombing risks, but then it would be really
nice to extend the cover of authentication if not also tooling to what
is currently called inofficial side meetings.

Cheers
    Toerless

P.S.: This is not meant to imply preference for any specific platform.

On Sat, Aug 01, 2020 at 06:09:59PM +0200, Carsten Bormann wrote:
> OK, this is getting a bit off-topic???  Apologies.
> 
> >>>>> 
> >>>>> At least, with Webex, I can be reasonably sure about the absence of criminal intent of the operator.
> >>>> 
> >>>> That is a very serious allegation that you are making without evidence.
> >>>> 
> >>>> -Jim
> >>>> 
> >>> 
> >>> I was just thinking the same thing.
> >> 
> >> Actually, it is a statement of fact: I feel way more secure with software from Cisco than with software from Zoom Video Communications (ZVC), because I have good reason not to be certain about ZVC???s corporate intent.  I didn???t know there would be an expectation that I would embellish this simple fact with formal indictment papers.
> > 
> > Thats not what you wrote and I think you know the difference (hence the rest of the email)!
> 
> Right, I wrote that *with Webex* I can be reasonably sure of the absence of criminal intent of the operator.
> 
> > Incompetent sure,  but how does this show criminal intent?
> 
> I???m not a lawyer, so I cannot answer that question.
> 
> But declaring that intentionally installing malware on my computer (that makes it vulnerable to first and third party attacks) is exactly what this company does, is *something*.
> I can report that it (and the time I now had to waste cleaning up my computer) destroyed any trust I might have had in this company to heed basic corporate responsibility ??? this incident was no longer grossly negligent, this was intentional.  Hence my statement of uncertainty about what they will do in the future.
> 
> > Srsly if I had a ??? for every ass-backwards handling of a vulnerability I???ve come across ... but to each her own , thx for the details!
> 
> I continue to see a difference between badly handling a wide open backdoor and a statement that installing such backdoors is just the way the company intends to do business.
> 
> We have grown such a deep distrust of software vendors that we may think the behavior we have seen here may be just the way it is.  Not so.  And we have to stop simply ignoring such behavior, or worse, becoming apologetic of it.
> 
> Grüße, Carsten

-- 
---
[e-mail]