Hello everyone!
I’d like to ask for your help to understand something I’ve been discussing with some colleagues.
Searching for info about the “pwd” parameter in meeting URLs, I found the following forum entry:
where a community advocate answered “releasing the method for hashing the password could allow attackers to bypass a unique join URL and enter a meeting directly, without being invited”
My question is:
What’s the real reason to obfuscate (encrypting or hashing it) the pwd?
As I see it, if an attacker somehow obtains the URL, she/he CAN enter a meeting directly, without being invited.
Welcome to the Zoom Developer Forum! I’m sorry for not getting back to you sooner – I am happy to help! This is a great question. When you attacker, can you share what kind of attack? Also, I should note there are many ways one can prevent a malicious user from joining the meeting. Here is some great resource on this topic:
Okta Authentication for E2EE brings identity management right into your meeting
Zoom a Leader in 2022 Gartner® Magic Quadrant™ for UCaaS, Worldwide