Waiting for E2EE

You may be wondering, “When will Zoom deploy E2EE?”

I’d bet my house that you’ll see it sooner rather than later.

As I did my research and wrote this book, two events in particular stood out that helped me read the tea leaves.

On May 7, 2020, Zoom announced that it had acquired Keybase, the maker of a niche chat tool lets its users easily and securely share messages and files. Critically, Keybase offered its users end-to-end encryption or E2EE. The timely Keybase acquisition marked the first one in Zoom’s storied nine-year history. (To read more about it, visit bit.ly/zfd-acq.)

In a related strategic move, consider what Zoom did on May 22, 2020. On that day, the company published its cryptographic design for peer review on the über-popular code repository GitHub. Put simply, Zoom’s management wants other techies, advocacy groups, customers, and academics to do the following:

• Identify any potential flaws in its proposed security framework.
• Suggest improvements.

Trust me: Rare is the company that does such a thing. (See bit.ly/zfd-crypt for more information about this topic.)

Protecting your devices and communications

Even when Zoom builds E2EE into its offerings, you can and should increase your security by doing one critical, simple, but oft-neglected thing.

Drumroll… .

I’m talking about regularly using a virtual private network (VPN) on all your devices. They are downright essential when connecting to public Wi-Fi networks at coffee shops, airports, bookstores, and gyms. VPN providers accomplish this task by rerouting all of their users’ Internet traffic through their own secure servers.

Ignore using a VPN at your own peril.

For years I’ve happily paid for a single Encrypt.me subscription. I’ve used it to secure communications on my laptop, tablet, and smartphone. (For more information, visit bit.ly/zfd-enc.)

Locating your version of Meetings & Chat

With rare exception, you should always use Zoom’s most current version. Fine, but how can you tell? Follow these steps to find out:

1. Go to the Zoom desktop client and select the zoom.us menu.

2. From the drop-down menu, choose About Zoom.

   Zoom displays the version number in a new window. For example, as of this writing, I am running the latest version of Zoom: 5.0.5.

3. Click on the white Done button to return to Zoom.

When you follow these steps, Zoom tells you if you are using the current version. If so, then you are gold.

Updating your software

Unless someone in your IT department explicitly tells you otherwise, update all Zoom tools to their most recent versions on a regular basis. Failure to do so robs you of new features. More important, lagging behind puts you, your colleagues, and even your entire organization at risk.

To update to the latest version of Meetings & Chat, follow these steps:

1. Go to the Zoom desktop client and choose the zoom.us menu.

2. From the drop-down menu, choose Check for Updates.

   Zoom informs you that you’re either

   • Running its latest version; or
   • An updated version is available.

   Assuming that the latter is true, continue following these directions.

3. Click on the blue Update button.

   Zoom begins its update process while a green progress bar steadily moves from left to right at the bottom of the screen.

4. Click on the white Install button.

   Zoom displays a wizard similar to Figure 9-2.

   

5. Click on Continue.

   Depending on your computer’s settings, you may need to specify whether you’re installing Zoom for all user accounts or for only your own user account.

6. Click on Continue again.
7. (Optional) Change the folder in which you want to install the new version of the Zoom desktop client.

8. (Optional) Depending on your computer’s settings, enter your computer’s master password.

   Don’t confuse this password with your Zoom one.

9. Click on Install Software.

   Zoom completes the upgrade process.

10. When finished, Zoom reverts to the desktop client’s user interface.

At the risk of stating the obvious, updating your Zoom desktop client does not do the same for your tablet and smartphone apps, much less Zoom Rooms (discussed in Chapter 12). You’ll have to separately update those apps if you use them.

Dealing with forced upgrades

Despite the myriad reasons to upgrade their software and the ease of doing so, far too many organizations and individuals invariably forget to stay current — or actively resist doing so.

In response, software vendors occasionally compel people to upgrade to more current versions. Failing to move to a contemporary version may render the program inoperable. More bluntly, the old version stops functioning altogether.

The reasons for forced upgrades vary, but the usual suspects include when a company:

• Forgoes supporting a legacy technology
• Introduces key enhancements to its products
• Patches a critical security flaw
• Responds to new regulatory requirements

Again, Zoom plays by the same rules as most software vendors. For example, on April 27, 2020, Zoom released version 5.0 of Meetings & Chat. It included a slew of new security features, most notably enhanced encryption. (Read the release notes at bit.ly/zfd-new5.) At that point, the clock started ticking on its predecessors, specifically version 4.6.

As the nearby sidebar describes, running outdated software poses significant risks to all concerned.

Activating 2FA at the organizational level

To activate 2FA for users under your organization’s Zoom account, follow these directions:

1. In the Zoom web portal, under the Admin header, click on Advanced.
2. Click on Security.
3. Slide the Sign in with Two-Factor Authentication toggle button to the right so that it turns blue.

4. Select the checkbox to the left of the option that you want to enable throughout your organization.

   Zoom provides three options:

   • All users in your account: This self-explanatory option is also the most powerful. If you click on it, then also click on the blue Save button. If you select this option, then the next two are moot.
   • Users with specific roles: Zoom lists its three default roles, plus any custom ones that you created. (See Chapter 3 for more detail on user roles.) By selecting desired roles here, you are requiring the members with these roles to set up 2FA.
   • Users belonging to specific groups: Zoom lists the user groups that you have created. (See Chapter 3 for more information on this topic.) If you select a user group here, then you force all of its members to set up 2FA.

Congratulations. You have now required some, or even all, members in your organization to turn on 2FA. This move is wise. Still, specific users must activate it based upon your selection(s) in Step 6 in the preceding list.

Say that your organization did not enable 2FA for all employees when it rolled out Zoom. It’s best to let them know that you’ve done so. As usual, a little common sense and communication typically minimizes user confusion and help desk calls.

Zoom’s 2FA works only when users access the web portal — not the desktop client. I suspect that Zoom will address this limitation in the near future.

Turning on 2FA for yourself

Your account admin or owner has enabled 2FA for your user group or even the entire organization. Now it’s time for individual users to set it up for their specific Zoom accounts. Pick up your smartphone, get your popcorn ready, and follow these steps to secure your Zoom account with 2FA:

1. (Optional) Open a web browser, go to https://zoom.us, and make sure that you’ve signed out of your Zoom web portal.

2. Sign back in to your Zoom web portal.

   Zoom displays a screen that walks you through the 2FA process.

3. Open the Google Authenticator app on your smartphone.

   If you have not downloaded and installed this app, then do both.

   Although the precise steps may vary, you can also use the Microsoft Authenticator, FreeOTP, and Authy mobile apps.

4. In the Google Authenticator app, click on the blue plus icon in the top right-hand corner of the screen.

   You’re indicating that you want to add 2FA for another site, app, or service.

5. Press Scan barcode with your finger.
6. Point your phone at your computer until it recognizes the QR code.

7. In the Google Authenticator app, click on the blue plus icon in the top right-hand corner of the screen.

   As Figure 9-3 displays, a six-digit verification code appears in your smartphone’s Google Authenticator app.

   Note the timer in the lower right-hand corner of Figure 9-3. If it expires, then the Google Authenticator app automatically generates another six-digit code and resets the clock.

   

8. Returning to the Zoom web portal, enter the six-digit code from the app under the Enter the verification code header.
9. Click on the blue Continue button.

You may already be using 2FA for other services, such as Twitter, Facebook, LinkedIn, and Gmail. If not, then you really should. For those of you who are curious about how 2FA works, the nearby sidebar provides a detailed example.

Remaining vigilant, even with 2FA enabled

Yes, activating 2FA adds some friction to Zoom’s sign-in process, but the juice is well worth the squeeze. You’ll considerably reduce the odds that someone hacks your Zoom account.

Note my phrasing in the preceding sentence: Reduce the odds. Lest you think that 2FA negates the possibility that hackers will be able to gain access to your account, be warned. Bad actors are devilishly clever.

Among the tools that hackers routinely employ in their attempts to circumvent 2FA is the SIM swap. (SIM stands for subscriber identification module.) They call phone carriers pretending to be you, often using data readily available on the Dark Web. Equipped with your mother’s maiden name, the make of your first car, your social security number, or just about anything else you can imagine, they call AT&T and Verizon. They are often able to convince call center reps to switch your phone number over a SIM card that they own and control.

Chapter 6 provides covers the reports that Zoom owners and admins can run. In some cases, those reports can help identify suspicious account activity.

Setting a password for an individual upcoming meeting

George and Jerry are planning a meeting to discuss an idea for a TV show about nothing. It’s all very hush-hush. As the meeting’s host, Jerry should follow these directions to password-protect the meeting:

1. In the Zoom web portal and click on Meetings.
2. Click on the blue Schedule a New Meeting button.

3. Enter the information about your meeting.

   Chapter 4 covers this topic in considerable depth.

4. Select the Meeting Password checkbox and enter a password.
5. Click on the blue Save button at the bottom of the screen.

Setting other password-related options for your Zoom account

Zoom allows people to use passwords in a variety of significant ways.

The availability of these features hinges upon your role and your organization’s Zoom plan. For example, if your company subscribes to Zoom’s Enterprise or Education plan, then an administrator may have locked some of the options in this section. As such, you may be unable to change them.

Follow these directions to invoke other password-related options:

1. In the Zoom web portal, under the Personal header, click on Settings.

2. Slide the toggle button next to the password options that you want to enable.

   Zoom provides the following password-related options:

   • Require a password when scheduling new meetings: Generates a password when you schedule a meeting. Participants will need to enter the password to join the meeting. Note that this option excludes meetings held via users’ Personal Meeting IDs (PMIs).
   • Require a password for instant meetings: Generates a password for your instant meetings.
   • Require a password for Personal Meeting ID (PMI): Enable this option only for meetings with the Join Before Host activated or for all meetings using the PMI. Regardless of the one that you select, you’ll need to enter a password.
   • Embed password in meeting link for one-click join: Appends a code to the end of the invitation’s URL that eliminates the need for attendees to use a password.
   • Require password for participants joining by phone: Requires participants to enter a numeric password. If you created an alphanumeric meeting password, Zoom provides callers with a numeric version of it.

   Zoom confirms that you have successfully changed that option.

Applying different security options to different user groups

Chapter 3 details the benefits of creating and populating user groups — a valuable feature for customers on premium Zoom plans. User groups allow organizations to easily apply, change, restrict, and lock a variety of different settings to different users. Customizing users’ security settings represents possibly the best application of user groups, as the following example illustrates.

Ricky, Shelley, Blake, George, and Dave sell residential real estate for Premiere Properties in Chicago, Illinois. (I’m alluding to the exceptional 1992 film Glengarry Glen Ross here.) When these five realtors hold Zoom meetings with their prospects, they sometimes forget to enable certain securing settings. Their inattention to detail rankles John, their nominal boss and the company’s Zoom account owner. For example, they schedule meetings without requiring user authentication. John wants to lock down their settings such that they can’t forget to do these important things.

John starts by creating a new user group called Realtors. He then places the five of them in it. Finally, he follows the following directions to customize the new group’s security settings:

1. In the Zoom web portal, under the Admin header, click on User Management.
2. Click on Group Management.
3. Click on the name of the user group whose settings you want to change.

4. Under the Meeting tab, slide the toggle button next to the option(s) that you want to enable.

   For example, some of the choices include requiring members of the group

   • Use their PMIs when starting instant meetings or scheduling meetings
   • Use a password when holding meetings via their PMIs
   • Restrict their meetings’ participants to authenticated users

   Depending on the option that you select or enable, Zoom may prompt you with a confirmation window asking you to confirm your choice. Alternatively, Zoom may display a message in green at the top of the screen that reads, “Your settings have been updated.”

   Zoom confirms your selection with an email similar to the one displayed in Figure 9-6.

Here’s an example of this new security setting in action. John enables the Use a password when holding meetings via their PMIs setting for the Realtors user group. John notifies the group of this change in the #Announcements channel, but Shelley ignores it. He attempts to schedule a meeting with his prospects Bruce and Harriet Nyborg, once again without setting a meeting password.

Shelley now has no choice but to use a password when he schedules a meeting. It’s a required field. As Figure 9-7 shows, Zoom won’t let Shelley uncheck the Password box. In other words, John has disabled all realtors’ ability to hold password-free meetings.

Requiring more complex meeting and webinar passwords

Generally speaking, people leave themselves susceptible to hackers in all sorts of ways. As but one example, the collective inability to understand — never mind follow — basic password protocols never ceases to amaze security experts. (Check out bit.ly/zfd-worst for a list of the 100 worst passwords from 2018. I’m sure that you can guess at least a few of them.) To nudge people in the right direction, many companies compel their users to create complex account passwords that include numbers, symbols, and/or minimum-length requirements.

Zoom allows account owners and admins do the very same thing. That is, they can force members in their organization to create more intricate passwords for meetings and webinars in two ways:

• Mandate a minimum password length.
• Require all passwords to contain letters, numbers, and/or special characters.

To require members on your account to use strong passwords, follow these directions:

1. In the Zoom web portal, under the Admin header, click on Account Management.
2. Click on Account Settings.
3. Click on Schedule Meeting.

4. Select the Meeting password requirement options that you want to turn on.

   Your options here include

   • Establishing a minimum password length (Zoom’s current maximum is ten characters)
   • Including at least one letter
   • Including at least one number
   • Including at least one special character or symbol
   • Only allowing a numeric password

5. After making your selections, click on the blue Save button.

   Zoom confirms that it has successfully updated your settings.

Keeping your PMI private

Again, as Chapter 4 discusses, you wouldn’t give a stranger a key to your home. The same principles apply to your PMI. Giving it to your spouse or mother is benign. Sharing it on social media is a recipe for disaster.

Using waiting rooms

Yes, Zoom lets users with sufficient permissions disable waiting rooms for their meetings — and possibly for others employees in the organization. I’d advise against it, however, especially on a permanent basis. Visit bit.ly/zfd-diswr for directions on how to effectively make your meetings less secure.

Preventing removed meetings participants from rejoining

John is acting like a putz during the company Zoom meeting, a fact not lost on the other participants. You have warned him a few times to knock it off, but he’s incorrigible. As host, you finally boot him from the meeting. Everyone applauds.

By default, Zoom prevents John from jumping back in, even if he retained the host’s PMI or the meeting’s ID and password.

Again, depending on your formal Zoom role, you can change this setting. Still, I’d leave it as is. What’s more, if you’re a Zoom account owner or admin, then you may want to lock this setting such that non-administrative members cannot change it for themselves.

To do so, follow these directions:

1. In the Zoom web portal, under the Admin header, click on Account Management.
2. Click on Account Settings.
3. Click on In Meeting (Basic).
4. Slide the Allow removed participants to rejoin toggle button to the left to turn it off.

5. Click on the gray lock icon to the right of the toggle button.

   Zoom displays a message asking you to confirm your decision.

6. Click on the blue Lock button.

   Zoom confirms that it has successfully updated your settings.

Limiting who can control the main meeting screen

As Chapter 4 explains, Meetings & Chat offers a bevy of powerful screen-sharing features. If you want to dial back those options a bit, you certainly can. For example, say that you’d like to prevent participants from sharing their screens. Just follow these directions:

1. Launch the Zoom desktop client.
2. Start your meeting.
3. Mouse over the bottom of the screen so that Zoom displays a menu.
4. Click the up arrowhead (^) next to Share Screen.
5. Select Advanced Sharing Options from the pop-up menu.
6. Underneath Who can share?, select the Only Host checkbox.
7. Close the screen and return to your meeting by clicking on the red circle in the top left-hand corner of the screen.

Exhibiting a healthy skepticism

Say that your son is a sophomore at a small northeastern university in a different part of the country. You and your spouse eagerly await your weekly Zoom call with him every Sunday afternoon at 4 p.m. You shared your PMI with him a year ago and thought nothing of it.

On Saturday, you receive an email from an unrecognized sender who purports to be your son. Still, something about the situation just rubs you the wrong way. This individual asks you to provide your PMI because he lost it.

What do you do?

Maybe nothing untoward is really taking place here. Maybe not. In this case, I would call your son or send him a text message explaining the situation. Based upon his response, your next step should be clear: Provide the PMI or report the email as the phishing attack that it appears to be.

Phishing perhaps represents bad actors’ most effective means of obtaining sensitive information from their targets. They are often able to acquire others’ credentials and other pieces of vital information by fraudulently posing as friends and loved ones.

Always err on the side of safety. If that means making it a tad more time-consuming for participants to join your Zoom meetings, then so be it. To quote a famous Russian proverb, “Trust, but verify.”

Keeping privacy in mind during Zoom meetings

Regularly using your brain doesn’t just make it harder for hackers to wreak havoc; it can protect you from putting your foot in your mouth in front of others. Remember that meeting hosts can easily generate chat logs, subject to a few disclaimers. They just need to follow a few simple steps:

1. Launch the Zoom desktop client.
2. Start your meeting.
3. Mouse over the bottom of your screen to invoke Zoom’s in-meeting menu.
4. Click on the Chat icon.
5. In the lower right-hand corner, click the ellipsis icon.
6. From the prompt, click on Save Chat.

For example, Michael Bluth is hosting a meeting with his brothers Gob and Buster. During the meeting, at any point Michael can produce a chat log file because:

• He’s the meeting host.
• Michael has enabled participants’ ability to chat.

About five minutes into the meeting, Michael does this very thing. Zoom dutifully saves a simple text file to the default location on his computer. This file includes the following data from the meeting:

• All participants’ public chat messages
• Any private chat messages that Michael exchanged with Gob and Buster
• Any private chat messages that Gob and Buster exchanged with Michael

Michael’s log file looks something like Figure 9-8.

Note that Zoom omits from these log files all private messages that participants exchanged with each other during the meeting that excluded Michael. In other words, Michael won’t know that Gob sent Buster a message calling him a chicken and Buster agreed with his brother.

Against this backdrop, keep the following privacy-related facts in mind as you use Meetings & Chat:

• Unless a host actively hits the Record button during a meeting, Zoom does not store video, audio, or chat content. That is, Zoom records nothing by default.
• When the host begins recording, Zoom provides both video and audio notifications to all meeting participants. If participating on a recorded meeting makes you uncomfortable, then you can always tell the host as much. You can also exit the meeting.

• Think of each Zoom meeting as a quasi-private forum. If you want to slam your boss or mock your colleagues mid-meeting, then have at it. Zoom can’t stop you from exercising poor judgment. No tool can. Just remember that meeting participants are likely to notice inappropriate actions. When they do, prepare to suffer the consequences. In this way, Zoom is just like Slack, Microsoft Teams, email, and any other contemporary communications tool.

  Whether you’re the host or not, think carefully about what you disclose both publicly and privately. There’s no guarantee that those messages from Zoom meetings will ultimately stay private. Say that you privately chat with colleagues, partners, customers, or other meeting participants. Someone could easily take screenshots of those private messages with a third-party tool and release them after or even during the meeting.

For more information on Zoom’s privacy policy, see bit.ly/zfd-priv.