7 ms·
Naive question. I'm forced to use Zoom by my University, so I run it from a dedicated user (on Linux). That's fairly safe, right?
by fouuler 5y ago
Naive question. I'm forced to use Zoom by my University, so I run it from a dedicated user (on Linux). That's fairly safe, right?
- capableweb 5y ago"Safe" in security is always relative. Safe from a military hacking attack? Probably never. Safe from random scriptkiddies? Yeah, probably even if you don't run Zoom with a separate user, as long as you got the rest of your shit together. Safe from people buying/using 0days? Seems so, since this issue was never actually disclosed (yet) so it's not really a 0day, so it'll be harder to for people to exploit. You'd need to understand who/what are your threats to understand if you're "safe" or not.
- fouuler 5y agoWhat I mean is: am I safe from those who have a Zoom 0day, if Zoom is running on a separate user; assuming they do not also have a Linux 0day.
- thinkharderdev 5y agoDepends on a lot of things. If the 0day is an RCE they would need another privilege escalation exploit. How easy that would be depends a lot on how your system is setup. But the short answer is probably not. Unless you are running Qubes or something, if someone can exploit an RCE then they can probably own your system.
- fouuler 5y agoI'd be really interested in a longer answer. I'm running Void Linux. What would exactly would Qubes add in this respect?
- stjohnswarts 5y agoNo, as this discussion points out you should use the browser version if at all possible. The snap version would also offer a little bit more sandboxing probably if you're willing to edit the config for how much access it has to your system.