Hacker News new | ask | show | jobs
by fouuler 1891 days ago
Naive question. I'm forced to use Zoom by my University, so I run it from a dedicated user (on Linux). That's fairly safe, right?
2 comments

"Safe" in security is always relative. Safe from a military hacking attack? Probably never. Safe from random scriptkiddies? Yeah, probably even if you don't run Zoom with a separate user, as long as you got the rest of your shit together. Safe from people buying/using 0days? Seems so, since this issue was never actually disclosed (yet) so it's not really a 0day, so it'll be harder to for people to exploit.

You'd need to understand who/what are your threats to understand if you're "safe" or not.

What I mean is: am I safe from those who have a Zoom 0day, if Zoom is running on a separate user; assuming they do not also have a Linux 0day.
Depends on a lot of things. If the 0day is an RCE they would need another privilege escalation exploit. How easy that would be depends a lot on how your system is setup.

But the short answer is probably not. Unless you are running Qubes or something, if someone can exploit an RCE then they can probably own your system.

I'd be really interested in a longer answer. I'm running Void Linux. What would exactly would Qubes add in this respect?
No, as this discussion points out you should use the browser version if at all possible. The snap version would also offer a little bit more sandboxing probably if you're willing to edit the config for how much access it has to your system.