What the future holds for Zoom

[bitheerani90]

The developers have identified a number of threats for which they have not yet implemented effective countermeasures. One of them is external infiltration of meetings by people posing as invited users. Another is that E2EE protection does not prevent attackers from accessing iceland mobile database metadata, such as call duration, participant names, and IP addresses. We also cannot exclude certain vulnerabilities in the program from the list of risks; in theory, cybercriminals could embed malicious code into Zoom.

With these threats in mind, Zoom developers have listed the following goals:

· Prevent everyone except invited and approved participants from accessing events;
· Prevent any participant removed from an event from reconnecting to it;
· Prevent interference from those not admitted to the meeting;
· Allow well-intentioned participants to report abuse to the Zoom security team.

Road map
To achieve these goals, the developers have created a four-stage roadmap. Stage one has already been implemented. As we said, they have changed the conference encryption key management system so that it is stored only on users’ devices, as well as improved the means of protection against outsiders participating in the meetings.
In stage two , they plan to introduce user authentication that does not rely on Zoom servers, but is based on single sign-on (SSO) technology involving independent identity providers (IDPs).

As a result, a potential attacker would not be able to spoof a user’s identity, even if they gained control of the Zoom server. If someone joins an event pretending to be a guest but with a new public key, other people will be alerted to the potential threat.

Stage three will introduce the concept of a transparency tree , storing all identities in an authenticated and auditable data structure to ensure all users have a consistent view of any identity and detect imposter attacks. Zoom’s intent is to strengthen the platform’s protection against man-in-the-middle attacks.

Finally, in the fourth stage , developers plan to make identity verification easier when a user logs in from a new device. To link a new gadget, the user will need to confirm its legitimacy, for example by scanning a QR code on the screen of a trusted phone or computer. This will prevent an attacker from linking a device to someone else's account.

Security without sacrifice
When implementing additional security mechanisms, it is important to consider how they will affect regular users. Zoom developers are also considering this aspect. For example, one proposed innovation is the use of personal device clouds. This technology will simplify the process of adding new gadgets to an account, while also helping to protect it.

For example, if you normally use a computer for Zoom calls, but then download and log in on your smartphone, the next time you open Zoom on your computer, you’ll see that a new gadget has joined. If you approve, both devices will be connected to a single cloud, and other meeting participants will know it’s you and not an intruder.

The device cloud also lets you check which gadgets are connected to your account and revoke the trusted status of any of them. In addition, the developers plan to add an option to switch to E2EE in the middle of a meeting and several other useful features.