Thousands of Zoom videos public on the web - report

Popular video chat service Zoom is in trouble, with claims by the Washington Post overnight that thousands of its customers videos are viewable on the open web (scroll down for Zoom safety tips).

Many of the videos appear to have been recorded through Zoom's software and saved onto online storage space without a password, the Post said. But because Zoom names every video recording in an identical way, a simple online search can reveal a long stream of videos that anyone can download and watch.

The Post said many of the videos included intimate conversations and personal details that made it easy to identify participants. Other videos include nudity, such as one in which an aesthetician teaches students how to give a Brazilian wax.

Zoom videos are not recorded by default, though call hosts can choose to save them to Zoom servers or their own computers. There's no indication that live-streamed videos or videos saved onto Zoom's servers are publicly visible, the Post said.

But many participants in Zoom calls may be surprised to find their faces, voices and personal information exposed because a call host can record a large group call without participants' knowledge or consent.

Security expert Daniel Ayers told the Herald this morning that the incident was just the latest in a long line of questionable security practices by Zoom.

Earlier this week, Ayers highlighted the video chat giant's misleading end-to-end encryption claim - which it backed down from yesterday, with an apology - and its heavy concentration of R&D in China, according to the company's regulatory filings.

Ayers' opinion wasn't helped by another revelation today - that Zoom has routed some of its supposedly geo-fenced traffic through China.

The security expert says that, in his opinion, it is incongruous for our government to block Huawei while the Prime Minister and cabinet embrace Zoom for video conferencing.

A GCSB spokesman told the Herald the agency had advised that Zoom could be used for discussions up to restricted level (which sits below Secret and Top Secret).

The agency issued additional guidance for state servants on Friday, which was billed as "clarifying" earlier advice on the use of Zoom as the Bureau sticks by the product.

Ayers described the move as the GCSG "doubling down" on Zoom at a time when alternatives were available that do offer full encryption.

• Covid19.govt.nz: The Government's official Covid-19 advisory website

Prime Minister Jacinda Ardern said cabinet was cautious about what it discussed over Zoom, with some items left off the agenda if they were above the restricted level.

Ayers questioned why Zoom was ever chosen in the first place for the first virtual cabinet meeting, given the government's security manual calls for a product that supports full or end-to-end encryption for the discussion of restricted-level material.

Zoom safety tips

1. Don't record your Zoom chat. It's the easiest way to protect yourself.

2. If you do record a Zoom chat, re-name the file from the Zoom default. Call it something that doesn't indicate it's a Zoom video call.

3. Only upload a saved Zoom video to services, such as Dropbox, or YouTube, where you have a private account enabled.

4. Don't publicly share your Zoom Meeting ID. Send it directly to the people you want on the call. Set a password to join the meeting and only share it with those who need to know.

5. Make sure [screen sharing is set to host-only to prevent Zoom-bombing or other particpants from hijacking the meeting with random images.

6. Use the waiting room feature. It prevents new participants from joining the call until the host approves. That prevents another form of Zoom-bombing - unknown people crashing a meeting.

Zoom who?

The Covid-19 crisis has cast a spotlight on Zoom, a company founded nine years ago by its CEO Eric Yuan, now 50, after he defected from US company Cisco Systems and took about 40 engineers with him.

Yuan wanted to refine a concept he first dreamed up during the 1990s as a college student in China, when he dreaded the 10-hour train trips to see his then-girlfriend, now his wife.

Now Zoom is booming, just 11 months after it made its debut on the stock market. While the Standard & Poor's 500 index has fallen by 25 per cent since its record high on February 19, Zoom's stock has soared around 46 per cent as investors bet on its service becoming a mainstream staple in life after the coronavirus.