[arkadiyt]

> Starting April 5th, it will require passwords to enter calls via Meeting ID

A meeting id with a password is semantically the same as a longer meeting id (or a meeting id with a character space larger than just digits). I wish they'd do that instead (make meeting ids longer) so I could continue to enter my company meetings with only a link but not have to worry about getting wardialed.

[mjlee]

You will be able to enter with only a link, the url looks like:

https://tenant.zoom.us/j/123123123?pwd=QlR0cXZkYXBDS0txYzJRR...

The password is an encoded version of the password set by the host.

[joe5150]

meeting IDs need to be numbers to make it easy to join meetings by phone. no particular reason they can't be longer though.

[bowmessage]

Except the search space is much, much, larger.

[godelski]

Don't we want the search space larger? That way it is harder to wardial? YouTube has 11 characters composed of [a-Z] and [0-9]. (26*2+10)^11 is a pretty big number. There's no reason it couldn't be longer.

[lmz]

It would also make it harder to dial by phone, if you need to do so.

[bowmessage]

Yep, exactly, I think it's beneficial and the right move.

[Dylan16807]

What is larger than what?

With the most straightforward way for "meeting id with a password" and "longer meeting id" to be the same, both methods provide the exact same expansion in search space compared to the previous implementation, and they have the exact same search space as each other.

(That method being: concatenate shortid and password to get longid)

[CPLX]

Here’s an ignorant question. I see this comment all the time, that an ID and PIN is exactly the same as a longer ID, but is it actually true?

I get the logic of it, but in a practical sense doesn’t it have the potential to be different? For example, if you have to enter a correct ID, wait, and then get prompted for a password, couldn’t that potentially slow down an attacker?

Alternately, couldn’t a bunch of correct meeting ID’s followed by incorrect PINs present an opportunity to flag the ID as under attack, or give a prompt to a host that would spur inquiry, or something?

Perhaps I’m wrong about this but it seems like there are some non trivial differences between the two.

[catalogia]

There is no reason you couldn't implement rate limiting under the "longer ID" scheme.

[CPLX]

Sure, but your rate limit would be for all conferences.

The idea being by separating the conference number and PIN number you could limit the ability to attack a specific user ID more easily.

[Dylan16807]

So we have to look at what "attacking a specific ID" even means.

With separate room numbers and PINs, it means you know the room number but not the PIN. Simple enough.

But in the long-id scenario, that means you have part of the ID, but not all of the ID. That's pretty unlikely to happen. Instead, situations where someone would have leaked the room number will take one of two routes: either the person leaks the longer ID, and there is no attacking necessary, or the person realizes that the secret code needs to be secret, and nothing is leaked at all. Either way, attacks on a specific conference ID no longer happen.

[detaro]

you can put the password in the link.