The Meeting and Webinar platforms offer similar features and functionality but have some key differences.
Meetings are designed to be a collaborative event with all participants being able to screen share, turn on their video and audio, and see who else is in attendance.
Webinars are designed so that the host and any designated panelists can share their video, audio and screen. Webinars allow view-only attendees. They have the ability to interact via Q&A, Chat, and answering polling questions. The host can also unmute the attendees. Attendees in webinars, can not rename themselves as well.
For more information about Zoom Meetings and Webinars, read this blog on Meeting and Webinar comparison.
A new form of trolling in which a participant uses Zoom’s screensharing feature to interrupt and disrupt meetings and classes.
Students, staff, and faculty who are impacted by protected class (like race, sex, gender, religion, or national origin) misconduct during Zoom or other videoconferencing sessions should be referred to dos@chapman.edu (students) or joycechen@chapman.edu (staff and faculty) for supportive resources and reporting options.
Below are some simple tips and tricks for preventing unauthorized users from accessing Zoom meetings.
When you schedule a meeting, a Meeting ID link is generated. If you are going to share your Meeting ID link (especially on social media), we strongly recommend using the default “Generate Automatically” option, which creates a random link to your meeting. If you switch to the “Personal Meeting ID” option, anyone seeing that link can take note of it and use it to pop in and out of your meetings at any time in the future.
When you lock a Zoom Meeting that’s already started, no new participants can join, even if they have the meeting ID and password (if you have required one).
For more information Host meeting controls, see Host and Co-Host Controls in a Meeting (VIDEO)
During a call
Just like it sounds, the Waiting Room is a virtual staging area that stops your guests from joining until you’re ready for them.
Meeting hosts can customize Waiting Room settings for additional control, and you can even personalize the message people see when they hit the Waiting Room so they know they’re in the right spot. This message is really a great spot to post any rules/guidelines for your event, like who it’s intended for.
Zoom has an in-meeting chat for everyone, or participants can message each other privately. Restrict participants’ ability to chat amongst one another while your event is going on and cut back on distractions. This is really to prevent anyone from getting unwanted messages during the meeting.
This concern primarily stems from news coverage of how the in-meeting chat could be used to obtain the hash of a user's credentials from a Windows computer.
Update: On April 2, 2020, Zoom has updated their client software to address this issue. Users must have the latest version to receive this fix. Original information has been kept below.
First, the credential hash is not the username and password of a user in plain text. Instead, it is an encrypted form of that information. Second, while there are techniques to reverse the encryption of such hashes, password complexity and length mitigate this by increasing the amount of time required.
There are techniques where a stolen hash could be used as-is against other systems and grant access. This is commonly called Passing-the-Hash. Attacks of this nature tend to be very targeted and are not often a concern for our users.
Zoom has not yet released a public statement, but they have responded to news agencies and acknowledged that they are working to address this issue.
We have two key recommendations to mitigate the risk of this attack method:
This concern primarily stems from news coverage of how a macOS computer with Zoom installed could have its camera and microphone enabled without knowledge of the user.
The security researcher that identified this vulnerability shares that it requires the device to already be compromised in some fashion. The attacker must either have physical access to the macOS computer or have remote access through some other means.
Zoom has not yet released a public statement.
We recommend users ensure their devices are physically safe and not compromised with malicious software to mitigate this attack method.
This concern primarily stems from news coverage of a since removed feature.
Prior to a change on March 27, personal data about a device was being shared with Facebook. Zoom was using a common software development kit (SDK) from Facebook to enable login functionality using a Facebook account. That Facebook SDK included default data collection.
As a direct result from the public concern, Zoom investigated the situation and recognized the issue. They opted to re-engineer their application to no longer leverage the Facebook SDK. They do still allow for Facebook accounts to be used, but the device data is no longer shared and no data is shared if Facebook login is not used.
Zoom released a public statement on their blog.
This concern primarily stems from news coverage of how Zoom describes their security for meetings and webinars.
Update: On April 3, 2020, a research group at the University of Toronto identified a vulnerability in Zoom's approach to technology. Original information has been kept below and a new FAQ item has been added.
In documentation, as well as their applications, Zoom makes references to "end-to-end encryption" (also known as "E2E encryption"). As with many aspects of technology, commonly understood terms or phrases can also have highly specific technical requirements to be valid. Many felt that Zoom's description was disingenuous when comparing the technical specifications of E2E encryption with the approach Zoom takes to encryption.Zoom does enlist encryption in many ways and some do in fact achieve the end-to-end (Zoom app to Zoom app) encryption.
Zoom released a public statement on their blog about this.
See: The Facts Around Zoom and Encryption for Meeting/Webinars
This concern primarily stems from news coverage of the privacy policy Zoom had published on their website.
In general, users should always be aware of the privacy policies for services they access. However, University members should also be aware that when we license a service such as Zoom, we enter into a contractual agreement that provides additional protections to data and privacy beyond those public policies. While Zoom already does not sell or share data from meetings, they also cannot use other data that we have provided them.
"We are in the process of writing a few awareness articles on our data security practices and procedures. These will include details about the steps we take to analyze and assess third-parties when they will receive University data." (Zoom's Privacy Policy)
Zoom released a public statement on their blog about this.
This concern primarily stems from an assessment conducted by The Citizen Lab, a research entity at the University of Toronto.
Update: On April 3, 2020, Zoom released a statement responding to these findings. They indicated that there is now geo-fencing to prevent communication with Chinese servers. They also state that they are working with experts to implement best practices for their approach to encryption. A copy of the statement has been added below.
The research that was conducted by members at The Citizen Lab, examined the encryption technology that the Zoom service uses. In their findings, the researchers identified a method in which they could possibly compromise the encryption that secures the audio and video of Zoom meetings. They also shared that the encryption keys that are created by Zoom for each session can come from servers located in China.
The technical steps to compromise the encryption of Zoom requires a specific skill set and access to a network where a meeting session is occurring.
At this time, the University continues to recommend Zoom as an acceptable tool to deliver University instruction. The University is continuing to monitor this issue, will closely follow Zoom’s response, and provide updates as information becomes available.
Out of an abundance of caution, the Information Security Office has issued specific recommendations regarding use of Zoom to specific University departments/units to protect communications that may be at risk due to this vulnerability. If you have questions please contact the Information Security Office for additional information.
Citizen Lab: Moving Fast & Roll Your Own Crypto
Zoom: Response to Research From University of Toronto's Citizen Lab