Zoom's message to its customers on security issues

After the recent discovery of gaps security In the Zoom app, the company posted an official response to its customers on the issue:  

To our users around the world,

Whether you are a global company that needs to maintain its business, a local government service working for the orderly mode of her community, a teacher who teaches her students remotely or a friend who wants to share a happy moment in quarantine, you all manage unique challenges that are the result of this global health crisis. During this period of social isolation, we at Zoom feel incredibly privileged to be able to help you stay connected to those you need.

We also feel a huge responsibility. The use of Zoom has skyrocketed overnight - far exceeding what we expected when we first announced our desire to help in late February. This includes over 90.000 schools in 20 countries that have accepted our offer to help children continue their distance education. As of the end of December last year, the maximum number of daily participants, both free and paid videoconferencing, held at Zoom was about 10 million. In March of this year, we reached more than 200 million daily participants in teleconferences. We work around the clock to ensure that all our users - young and old, young and old - can communicate and accomplish their mission.

In recent weeks, support for this influx users it was a huge business and our only focus. We have tried to provide you with seamless service and the same user-friendly experience that Zoom has made the teleconferencing platform of your choice, for businesses around the world, while ensuring its security. platform and privacy. However, we acknowledge that we have not met the expectations of the community - and our own - regarding the protection of privacy and privacy. security. That is why we are deeply saddened and want to share what we are doing about it.

Initially, our platform was built primarily for business clients - large institutions with full IT support, from the largest financial services companies worldwide to leading telecommunications providers, government agencies, universities, healthcare and telemedicine organizations. Thousands of businesses around the world have conducted exhaustive user, network and data center security reviews and opted for Zoom.

However, we did not design the product with the prediction that, in a few weeks, every person in the world would suddenly be working, studying and communicating from home. We now have a much broader whole users utilizing our product in a variety of unexpected ways, presenting us with challenges we didn't anticipate when the platform was designed.

These new, mostly consumer cases, have helped us discover unforeseen issues on our platform. Dedicated journalists and security researchers also helped identify issues. We appreciate the scrutiny and questions we receive - about how the service operates, our infrastructure and capacity, and about privacy and security policies. These are the questions that will make Zoom better, both as a company and for all users.

What have we done?

With the increased number of users, part of the challenge is to ensure that we provide the right training, tools and support to help them understand the features of their accounts and the best way to use the platform.

We offer training seminars as well as free interactive daily seminars for users. We have precautionarily promoted many of these resources to help users become familiar with Zoom.

Here are some steps you can take to begin the process of preparation for customer support.

We listen to our users' community to help us develop our approach.

We have also worked hard to actively and quickly address specific issues and questions raised.

On March 20, we posted a blog post to help users deal with harassment (or so-called "Zoombombing") on platform by clarifying the safeguards that can prevent it, such as waiting rooms, passwords, restricting screen sharing.

On March 27, we took action to remove the Facebook SDK from its client program iOS and we redesigned it to prevent users from collecting unnecessary device information.

On March 29, we updated our privacy policy to be clearer and more transparent about the data we collect and how we use it - explicitly stating that we do not sell our user data, we have never sold user data before and there is no intent to sell user data.

To train users:

• A guide was created for administrators on how to create a virtual classroom.
• We've set out a guide on how to better secure virtual classrooms.
• We have set a special privacy policy for K-12.
• We have changed the settings for the trained users registered in the K-12 program, so that the virtual waiting rooms are activated by default.
• We changed the settings for the trainees who participated in the K-12 program, so that the teachers by default are the only ones who can share content in the classroom.

April 1:

• We have published a blog to clarify the facts surrounding encryption on our platform - acknowledging and apologizing for the confusion.
• The participant's interest tracking feature has been permanently removed.
• We have released corrections for both Mac-related issues raised by Patrick Wardle.
• We have published a code update on the issue of UNC connection.
• We permanently deleted the LinkedIn Sales Navigator application after recognizing unnecessary data disclosure from the operation.

You can see Zoom's detailed announcement to its customers here.