1
$\begingroup$

We all are using zoom application for joining/hosting meetings in this corona virus period. As we create a meeting, a new id, password and a url is generated. Some real examples follow-

Id: 83500199576 Pwd: 0Wnim6 URL: us02web.zoom.us/j/83500199576?pwd=NVhJV0ExejMwcDQ2MV0wUlFxdnBWZz09

Id: 86043075733 Pwd: 1ubfpn URL: us02web.zoom.us/j/86043075733?pwd=S0h3aXhxY2hkVHU1MnVwRHAyNUlPdz09

Firstly it is trivial that the first bit of the url is the id itself, but i cant make out anything about the ?pwd= bit. Perhaps it is hashed but I don't know much about it.

If this relation is found out it would make life much easier. It also doesn't violate any privacy stuff since the user can join a meeting either he has id-pwd or the url or both.

I found this thread on the official zoom website but it doesn't help much.

I assure you that the zoom stuff given above is not working now and was created and terminated just for this question. If you want more examples, you can also do this.

$\endgroup$
  • $\begingroup$ The pwd field in the two examples is apparently 16 bytes double-encoded with base64, or more precisely some variant thereof in at least the second decoding layer (since there's one ] in the first example after the first Base64 decoding). In big-endian hex the first would be E57216035CF7D29E3AD7eD1142ABE956 with the lower case e possibly an f, and the second 287C22C6A721753BB9DAEA43A76E483B. I'm pessimistic about getting a much deeper understanding from more examples. Oh, and that's off-topic, which is why this is not an answer. $\endgroup$ – fgrieu May 28 at 13:03
  • $\begingroup$ @fgrieu thank you for the reply, firstly i am very very new to hash topic so I didn't understand what you said, i'll read more about the topic and then should be able to understand. Also is the question off topic or your comment $\endgroup$ – Pj30 May 28 at 13:39
  • $\begingroup$ The question is off-topic, because we do not analyze ciphertext. That's why my comment is not made an answer. To better understand what I said, study base64. For experiments, feed S0h3aXhxY2hkVHU1MnVwRHAyNUlPdz09 that follows = in the second example there, then the outcome (including the two ending ==) there. [reposted with corrected URL]. $\endgroup$ – fgrieu May 28 at 14:26