A new Zoom update hides meeting ID numbers in videoconference call title bars by default, preventing accidental dissemination of meeting IDs with screenshots
A new update to the Zoom client has been released that removes the meeting ID from the title bar when conducting meetings …
BleepingComputerLawrence Abrams
Context & Ripple Effects
This update is another step in Zoom's rapid security hardening during the April 2020 Zoombombing wave. Days earlier, Zoom made passwords and Waiting Rooms mandatory by default for calls joined via Meeting ID — a direct response to trolls joining unprotected meetings.
Hiding the meeting ID from the title bar closes a quieter leak in the same system: users screenshotting calls for work or social media were unknowingly publishing the credential that, combined with an ID-based join link, lets strangers walk in. It complements rather than replaces the password push.
First-order effects
Meeting participants who share screenshots no longer expose their meeting ID by default, removing the most common way IDs leak onto social media and forums.
Hosts and IT teams who relied on the visible ID for quick verbal or written handoffs lose that on-screen reference and must share IDs through invites instead.
Second-order effects
Fewer publicly posted IDs shrink the attack surface that tools like Zoom's later At-Risk Meeting Notifier scan for, nudging Zoombombing toward meetings whose links are shared deliberately rather than leaked incidentally.
Rival conferencing vendors face pressure to match default-on privacy settings, since Zoom's week-long run of fixes — from the LinkedIn data access removal to the Windows credential-stealing patch — reset user expectations for what ships enabled.
Third-order effects
If the pattern holds, video conferencing settles into a security-by-default posture where sensitive identifiers are hidden unless explicitly revealed, and platform trust becomes a competitive feature rather than an afterthought.
The episode also shows consumer scrutiny forcing enterprise-grade defaults on mass-market tools, a shift regulators and buyers may come to expect as standard.
The trend: Video conferencing platforms are flipping privacy and security controls from opt-in to default-on as pandemic-scale usage puts their defaults under public scrutiny.
Buried in this Zoom story: why you need to physically block your camera when not using it. Zoom isn't the only app intruders can use to remotely turn on your camera. https://www.nytimes.com/... https://twitter.com/...
@natematias
J. Nathan Matias on x
Yet another company waits to prioritize safety until people get hurt. And then builds an advisory council and makes some hasty hires to manage public disapproval. Witholding judgment until Zoom can transparently demonstrate progress. https://www.npr.org/...
@zoom_us
Zoom on x
We have officially formed our CISO Council and Advisory Board, including security leaders from across industries, and we've also announced that cybersecurity expert Alex Stamos has joined Zoom as an outside advisor [Blog Post] ... https://blog.zoom.us/...
@edbott
Ed Bott on x
I wish Alex Stamos only the best, but bolting security on is never an easy or productive move. https://twitter.com/...
@hypervisible
@hypervisible on x
Zoom CEO: “We were focusing on business enterprise customers...” “'However, we should have thought about ‘What if some end user started using Zoom’ for nonbusiness events...” “The risks, the misuse, we never thought about that.” ¯\_(ツ)_/¯ https://www.nytimes.com/...
@troyhunt
Troy Hunt on x
This is super cool, @alexstamos is the perfect person to help @zoom_us out at this time https://twitter.com/...
@zck
Zak Kukoff on x
This is a characteristically great move by @ericsyuan @zoom_us's full announcement on their plan to bolster privacy and security: https://blog.zoom.us/... https://twitter.com/...
@carnage4life
Dare Obasanjo on x
Zoom is adding @alexstamos as a security advisor which is huge news. He's one of the most thoughtful voices on cybersecurity today. I'm confident that as Zoom applies the same focus on security that they have on user experience, they'll come out ahead https://blog.zoom.us/...
@carnage4life
Dare Obasanjo on x
Many of Zoom's security woes are a consequence of trying to make the app idiot proof for users. Making it easy for any idiot to find the meeting ID means selfsame idiot can accidentally share it with the world via screenshots on Twitter. PMing ain't easy. https://www.bleepingcomp…
@kaepora
Nadim Kobeissi on x
What Stamos is calling a “fascinating security challenge” is here a system that literally shipped you a server-generated, static AES-ECB key and then used it to encrypt the entire call, calling it end-to-end encryption. Incidentally, WhatsApp has done this correctly for years. ht…
@cfarivar
Cyrus Farivar on x
Literally as I was finishing up this piece late last night I had to ask an Oakland kindergarten teacher to please remove the passwords to Zoom calls from a publicly-accessible website. https://www.nbcnews.com/...
@kaepora
Nadim Kobeissi on x
People who hire Stamos don't hire him for his security. They hire him for his social network and ability to spin AES-ECB into something plausible. Alex Stamos is the most successful charlatan in the history of information security. https://twitter.com/...
@gcluley
Graham Cluley on x
Zoom has called in Alex Stamos to help them work out their security and safety challenges. This is a very good sign https://medium.com/...
@patrickmoorhead
Patrick Moorhead on x
This is fine and nice, bit I think the BoD should hire an outside firm to investigate: -what happened -who authorized it -how did it happen -remove who authorized it -fix it Then the CISO council and advisory board makes more sense. Will these folks ever see the inner workings? h…
@karaswisher
Kara Swisher on x
Good move by @ericsyuan. @alexstamos is an irritant which is what is required. Signed, An irritant. https://twitter.com/...