Zoom will require passwords to enter calls via Meeting ID and will turn on Waiting Rooms by default to prevent trolls from disrupting calls, starting April 5
Zoom is making some drastic changes to prevent rampant abuse as trolls attack publicly shared video calls.
Context & Ripple Effects
Two weeks after the New York Times documented the rise of Zoombombing — trolls hijacking public Zoom calls via screen-sharing to push graphic content — Zoom is changing its defaults rather than leaving protection opt-in. From April 5, every call joined by Meeting ID needs a password and Waiting Rooms are on by default, so hosts screen entrants before they reach the call.
The move reads as the first installment of a security sprint: days later Zoom shipped a 5.0 update focused exclusively on security and privacy, and by November it had added an At-Risk Meeting Notifier that scans the web for posted meeting links. The throughline is Zoom retrofitting trust onto a product built for frictionless one-click joining.
First-order effects
- Hosts of open meetings now face a new gatekeeping step — approving attendees through Waiting Rooms and distributing passwords — while trolls can no longer walk into a Meeting ID-only call uninvited.
Second-order effects
- Meeting ID exposure becomes the next attack surface, which is why Zoom followed within days by hiding IDs from call title bars by default so screenshots don't leak them.
Third-order effects
- If the pattern holds, videoconferencing defaults converge toward security-first configuration — passwords, screening, link monitoring — trading some of the one-click ease that made Zoom ubiquitous during the shift to remote work.
The trend: Videoconferencing platforms are shifting from frictionless-by-default to secured-by-default, with Zoom's password, Waiting Room, and link-scanning rollout marking the pivot point.