Subject: webex meeting pirates, best current protection ?

From: Toerless Eckert <[email-masked]>
Date: Wed, 9 Jan 2019 16:14:21 +0100

Sorry if i missed a memo.

Whats the best current recommendation against this piracy agaisnt IETF
webex meetings wheeby seemingly people "on the Internet" use published
IETF webex meetings by entering at the end of meetings to then continue
using it as a free multiparty conference ?

Another WG chairs siad that his understanding was that we should
not publish Webex dial-in information anymore publically, but that would
of course be sad if that was the best recommendation possible.

I was hoping more for something like webex having fixed a problem and
there being an explicit method to shut down a webex conference by
the host leaving or something more explicit, but i am not sure that
actually exists.

Cheers
    Toerless

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 9 Jan 2019 16:19:39 +0100

> using it as a free multiparty conference ?

How is that of value with all the other free-of-charge conference services out there?

(Can a host close a meeting?  I thought I’m doing that at the end of meetings I chair.)

> of course be sad if that was the best recommendation possible.

Keeping the access information a secret is not workable.

> the host leaving or something more explicit, but i am not sure that

See above.

Grüße, Carsten

---

From: "Ciavaglia, Laurent (Nokia - FR/Paris-Saclay)" <[email-masked]>
Date: Wed, 9 Jan 2019 15:32:49 +0000

In Webex, you can "leave" or "end" a meeting.
To completely stop a meeting, you need to "end" it. If you only leave it, then, other participants can go on.
So, one recommendation could be to ask the last person chairing the session to effectively "end" it.

Does it address the issue raised?

HTH, Laurent.

> -----Original Message-----
> From: WGChairs <[email-masked]> On Behalf Of Carsten Bormann
> Sent: Wednesday, January 9, 2019 16:20
> To: Toerless Eckert <[email-masked]>
> Cc: [email-masked]
> Subject: Re: webex meeting pirates, best current protection ?
>

---

From: Michael Richardson <[email-masked]>
Date: Wed, 09 Jan 2019 10:44:12 -0500

Carsten Bormann <[email-masked]> wrote:
    >> IETF webex meetings by entering at the end of meetings to then
    >> continue using it as a free multiparty conference ?

    > How is that of value with all the other free-of-charge conference

I think, because there are access numbers which are local calls
which permit them to connect callers together with high fidelity.

    > (Can a host close a meeting?  I thought I'm doing that at the end of
    > meetings I chair.)

Yes, one of the options the host can do at the end of the meeting is
not to just leave the meeting, but to actually close it.

However, this becomes a problem if nobody actually uses the meeting.
It is convenient to set a recurring webex meeting so we have the same code
each week, but then since we can't cancel meetings in a series, we
simply do not use the extra reservations that we don't use.

====

The real root cause here is that we are receiving a freebie at the IETF,
and it comes without any support agreement.

For many years it did not run across all the platforms we care about (and
webex still gives errors to many who are on working platforms about their
platform being wrong), and we haven't actually figured out what we want.
There is a cost to freebies.

(My preference would be to extend meetecho to support virtual interims...)

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Toerless Eckert <[email-masked]>
Date: Wed, 9 Jan 2019 17:37:28 +0100

> not to just leave the meeting, but to actually close it.

Ok. Don't just hit the "X" to leave,b ut the "end meeting" from the
pulldown menu when you're the host. We can do that.

> simply do not use the extra reservations that we don't use.

Hmm.. need to check if there is a problem. I thought you can only start
using audio/sharing in a meeting once a host has joined anyhow, so
worst case a skipped meeting can just be used by intruders to hang
out see each other and maybe chat. But will have to check again.

> and it comes without any support agreement.

I never paid for webex, so i have no idea what a paid for support
agreement would improve. Past experiene with the industry at large
tells me that you have to be a big spending customer if you need 
a feature improvement not required by the mayority of customers, and
i can easily see how publically posted webex meetings without real
password protection is not something the normal (paying) webex
customer uses, but maybe it actually does work well enough already.

> There is a cost to freebies.

I have not tried to use webex in a browser yet, but isn't that also
just another WebRTC application , aka: non-support of linux shouldn't
be an issue anymore that webex has to bother with but its now just
the linux browser ?

> (My preference would be to extend meetecho to support virtual interims...)

You get what you pay for...

Cheers
    Toerless

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 9 Jan 2019 18:03:43 +0100

> pulldown menu when you're the host. We can do that.

I don’t have an “X”, but if I try to close the WebEx window, WebEx asks me whether I want to end the meeting (just saw that again in the CoRE meeting).  So, apparently, I’m ending meetings already.
> out see each other and maybe chat. But will have to check again.

I usually specify “anyone with an account can be host”, but that still requires an account.

(Re “support”: I just had another weird audio problem that required me to dial-in from iOS in addition to the instance I already had on macOS.  Unfortunately, Jitsi isn’t much better, and people have problems presenting there.  BTW, anyone who knows about it can use the IETF jitsi, as with meet.jit.si as well.)

Grüße, Carsten

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 9 Jan 2019 18:05:36 +0100

> which permit them to connect callers together with high fidelity.

I thought we (ietf.webex.com) don’t have them (except for the US number, which should come at essentially zero cost.)

Grüße, Carsten

---

From: Dave Lawrence <[email-masked]>
Date: Wed, 9 Jan 2019 12:55:43 -0500

> simply do not use the extra reservations that we don't use.

Would this be solved by ensuring the host (or someone) joins then just
immediately ends it?

Admittedly it's a bit of extra work to keep track of which is kind of
annoying, but if it's happening at a regular time at least it'd be
easy to track to do.

---

From: "Mankamana Mishra (mankamis)" <[email-masked]>
Date: Wed, 9 Jan 2019 17:57:35 +0000

i think its only host who can end the meeting. not any one else. 

> On Jan 9, 2019, at 9:55 AM, Dave Lawrence <[email-masked]> wrote:
>

---

From: Michael Richardson <[email-masked]>
Date: Wed, 09 Jan 2019 13:55:55 -0500

Toerless Eckert <[email-masked]> wrote:
    >> The real root cause here is that we are receiving a freebie at the
    >> IETF, and it comes without any support agreement.

    > agreement would improve. Past experiene with the industry at large

We'd write an RFP, and in the RFP it would specify what platforms we expect
support for.

    >> For many years it did not run across all the platforms we care about
    >> (and webex still gives errors to many who are on working platforms
    >> about their platform being wrong), and we haven't actually figured out
    >> what we want.  There is a cost to freebies.

    > be an issue anymore that webex has to bother with but its now just the
    > linux browser ?

Nice theory.
1) Many host mode functions are only available in the "Desktop" Java
   version.  It has improved over time.

2) The Java version actually runs on many platforms, but audio never
   works, and it gets confused when it can't find word.

3) Uploading slides to webex does not work for any webrtc partiticants,
   as it relies on Word to display them.

4) If you login to ietf.webex.com (such as the host might do) it will always
   force to you use the Desktop Java, and then tell you that your browser
   is not compatible, when in fact, the webrtc version would work just
   fine.
   (There are other ways to get to this failure state, I haven't discovered
   them all)

   So, many participants wind up stuck here, and conclude that the IETF
   does not welcome them.

Bug reports on these kinds of things (particularly 4, which is clearly a
mistake), go into /dev/null.

---

From: Michael Richardson <[email-masked]>
Date: Wed, 09 Jan 2019 13:57:17 -0500

Carsten Bormann <[email-masked]> wrote:
    >> I think, because there are access numbers which are local calls which
    >> permit them to connect callers together with high fidelity.

    > I thought we (ietf.webex.com) don’t have them (except for the US
    > number, which should come at essentially zero cost.)

It might be that the attackers fail as a result, but as I think it's all
google-search->script driven, they don't know this.

---

From: Michael Richardson <[email-masked]>
Date: Wed, 09 Jan 2019 13:55:26 -0500

Nice theory.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [