Vulnerability in the Mac Zoom client allows malicious websites to enable camera
> This vulnerability leverages the amazingly simple Zoom feature where you can just send anyone a meeting link (for example <a href="https://zoom.us/j/492468757" rel="nofollow">https://zoom.us/j/492468757</a>) and when they open that link in their browser their Zoom client is magically opened on their local machine. I was curious about how this amazing bit of functionality was implemented and how it had been implemented securely. Come to find out, it really hadn’t been implemented securely. Nor can I figure out a good way to do this that doesn’t require an additional bit of user interaction to be secure.<p>Does anybody understand (and have a moment to explain) why the author says this is difficult to do securely? macOS has a simple facility for handling custom URL schemes, so my impulse would be to have `<a href="https://zoom.us/j/492468757`" rel="nofollow">https://zoom.us/j/492468757`</a> do a server-side redirect to a URL like, say, `zoomus://492468757`, which would launch Zoom locally using the OS's built-in services. This wouldn't require a third-party daemon of any sort, and would just be a regular application that the user could trivially uninstall.<p>Is there a security hole there that I'm missing? Or have I misunderstood the author's point?