Linux Zoom Client Proactively Reads X11 Clipboard
44 points by darleaf
44 points by darleaf
I don't understand why anyone ever installs the desktop clients of these applications. Especially Zoom considering their track record...
I’ve had various problems with the web client over the years, desktop is generally better and more consistent. I’ll probably be trying the web client again after this though
The desktop client implements various things around screen sharing that aren’t possible within a browser (and various other things that formerly weren’t possible though they may be now). That’s the specific reason why I’ve used the desktop client. (I used the web version until I started needing desktop-only functionality.)
Yes, we use controlling screen shares pretty extensively at work. Only Zoom and WebEx do it right; Teams invariably never works.
Generally speaking, I prefer an app to a web app because, with a firewall in place (say, Lulu or Little Snitch on macOS), I can see and block outbound connections selectively. For the browser, I let it connect to anything on port 443 because otherwise I would have to explicitly allow every site. Why would a web app be better?
For Zoom & co, I think that either way you must have a good degree of trust, and way too much. Unfortunately, you don't have much choice if your job requires using Zoom.
For the browser, I let it connect to anything on port 443 because otherwise I would have to explicitly allow every site.
You can definitely have more control using uBlock origin.
on firefox you definitely get the full control. i'm not sure if manifest v3 that chrome enforces is as robust.
On Firefox/Linux, it's unfortunately still pretty rare to get video HW encoding/decoding to work, so native clients are sometimes much easier on the battery. Spinning up chromium just for Zoom is probably a better option than installing their spyware though.
A dedicated window with the video of the person you speak with is what I miss the most when using in the browser.
Couldn't have happened with Wayland afaik?
I don't see why it couldn't. Wayland clipboard access is not that different from how it works in X11. It's difficult to do secure clipboard management without severely restricting how the user can initiate clipboard operations. In practice the best you can do is monitor access so hopefully you notice when something is snooping.
I know Wayland is at least different, though I have neither tested zoom there nor understand exactly how the clipboard functions. My assumption is zoom under xwayland will behave respective to other xwayland apps the same as it does on normal X11.
It’s my understanding that the main difference is on X11 any running app can just read anything on the clipboard whenever it wants, whereas on wayland only the focused app can see the clipboard. If there are further restrictions that that I’m unaware of them
The fact that Linux has horrible OS level control over what processes have access to the clipboard is dumb as hell.
What does that even mean? It's not like any other system has access control on the clipboard. It's always been a system-wide shared area. Do you expect a UAC-style splash screen confirmation every time something tries to access it, or...?
When the user explicitly requests a clipboard operation via ctrl-C, ctrl-V etc. then it should just work. But applications sneakily reading the clipboard without any user interaction? Yeah that should probably show a permission dialogue.
Yep iOS works pretty similarly to this. You either explicitly paste with a context menu, or you must press allow when there's a pop up
The "etc" does a lot of work here. What about menus? Context menus? Applications with custom GUI? Remote desktop access? Macros interacting with clipboard in vim? What even counts as "user interaction" in those cases?
Then there are more creative uses for the clipboard: for example image preview before pasting.
"app implements a requested feature useful for its users, news at 11": https://portal.nutanix.com/page/documents/kbs/details?targetId=kA0VO0000007sOf0AI
The poster says:
Regular readers might recall that around this time last year I caught Slack doing something similar, but only when focus entered the Slack window, and also, they had a configuration option to turn it off
This suggests that Zoom does not have an option to turn it off. This would mean that Zoom is always reading the clipboard, not only when "remote control" is turned on.
Anyone know of the web client does the same thing?
I'd be surprised if web apps have free access to the clipboard contents. (Perhaps wrong, but definitely surprised.)
I get "access clipboard" permission requests from outlook.office.com. I have blocked those, because I use a password manager. Blocking that permission doesn't seem to affect ^C/^V, so I wonder what it does affect.