←back to thread

796 points _Microft | 1 comments | | HN request time: 0.001s | source
Show context
manigandham ◴[] No.22738023[source]
1) If Zoom can do this then it's a MacOS security bug.

2) UX matters. Users don't care about the technical details, they want a smooth experience and that can be the difference between a billion-dollar business or a failed startup. And yes the desktop version is more stable than the web-based UI.

3) Malware is defined by what it does, not how it's installed.

replies(3): >>22738241 #>>22738342 #>>22741312 #
thaumasiotes ◴[] No.22741312[source]
> 3) Malware is defined by what it does, not how it's installed.

Well, from the tweet thread:

> If the App is already installed but the current user is not admin, they use a helper tool called "zoomAutenticationTool" [sic] and the AuthorizationExecuteWithPrivileges API to spawn a password prompt identifying as "System" (!!) to gain root (including a typo).

replies(2): >>22743374 #>>22744950 #
manigandham ◴[] No.22743374[source]
It's not malicious, and you have to give it permissions somehow to finish the install.

Dropbox (used to?) patch system files to integrate with Office better, and that wasn't considered malware either.

replies(2): >>22743442 #>>22744426 #
1. 9935c101ab17a66 ◴[] No.22744426{3}[source]
Malicious behaviour does not inherently make something malware. That said, The work arounds Dropbox used in the past should also be considered shady or malicious, and do not serve as a convincing defense in any way.

Yes, zoom does need the user’s password to complete the install in the scenario described. So why isn’t there a proper installer that behaves like installers on macOS should. Why do they ask for the users password on the behalf of ‘system’?

Oh, and zoom was just busted for sending user data to Facebook (regardless of whether or not you had a Facebook account and without disclosure AFAIK) so I reverse my previous statement. It is malware.