Dear developers!
First of all, I’m sorry to have posted this in the wrong place - but I do not know how a regular end user like me could contact a Zoom developer in any other way. ![]()
The go-to way of installing apps on Linux is quickly becoming “Flathub”, an app store for Linux. There, users can find their favorite apps and install them. The apps are using the open-source “Flatpak” container format, which makes them a lot safer than running them natively as we used to do when your app was first created.
The problem is, that your Zoom app needs to have the Flatpak “devices=all” permission in order to detect webcam and microphone. Without granting this permission, the app starts but cannot be used since no cam/mic is detected. This seems to be a workaround from a couple of years ago, when Flatpak had no “portal” system. These portals enable the desktop to share a webcam and/or a microphone with a Flatpak app. This is much, much safer!
By having to use the “devices=all” permission, which really is more a workaround, the Zoom app is granted access to all devices on the user’s computer. This is a security disaster waiting to happen! I’m fairly positive that an attacker could abuse this in order to manipulate devices on the user’s system. Your app had several vulnerabilities in the past (on Windows and Linux alike) and I wanted to report this, in the hope that something can be done about it.
This attack surface could be easily avoided by making your Zoom app compatible with Flatpak’s “portals”. Then, users could specifically share their webcam/microphone with the Zoom app - instead of having to grant access to all devices.
I know that software development is expensive and I’m thankful that your company takes the time and effort to support us Linux users! I therefore hope that you can see the value in adapting the new portal system, as so many apps now have done. I hope you find a nerd in your company that gets some free time to implement this in order to make your app safer.
Thank you very much!
Sebastian
P.S.: This may be left here for discussion, or be deleted after forwarding this to a Zoom developer.