Trying to help my town public meetings avoid random internet jerks joining the Zoom and spamming racist stuff.

How do these kids usually find public Zoom meetings to harass?

Trying random IDs?

Searching/scraping the web for Zoom links?

What do other places do with public Zoom meetings to minimize this?

Lots of suggestions for the Zoom Webinars product (instead of Meetings), which looks great, except it says it's made for 500+ attendees and costs a LOT more money… for reference, our town meetings usually have a remote audience of about 20 people.

@marcoarment Seems an URL Shortener would only obscure the meeting password by one step.

A public link is a public link- I suppose a url shortener could allow analytics of who clicked on it (it’s own privacy issue?)

@marcoarment I could be wrong because Zoom is confusing, but I think requiring pre-registration is an option even for normal (non-webinar) meetings: https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0065026 (at least this is true of my enterprise account)

It is no silver bullet, but at least you can check for suspicious email addresses ahead of time.

@marcoarment faced similar issue running an in person conference with <50 remote attendees. Webinar wasn’t a viable option. After a zoombombing episode on the first day, I created a new meeting — once meeting is active, in “security” panel on host client app, I enabled every restriction. This has to be repeated every time a meeting is started, because Zoom 🤷🏻‍♂️

@marcoarment Webinar is really the only way to have admin controls. I ran this for our association during COVID and it worked well enough.

It was also a low enough bar that our older members were able to join (Florida).

@marcoarment

I help run Zoom for our Sunday church services with about 50 or 60 Zoom attendees. We use the waiting room feature. Anyone not recognized can maybe have a few questions asked. As someone else mentioned, we also turn on most of the restrictions (don’t allow people to unmute themselves, no whiteboard or screen sharing, etc). During open comment time, people can raise their virtual hand and the host can unmute them, and be quick with the mute button if the speaker is an ass.

@marcoarment We just use the waiting room feature, and people we do now know, we ask a simple local question: what is the nickname of the bartender at the Sunrise Pub? If they don’t know the answer, they can usually explain why. For us, that’s good enough to keep script kiddies away…
@marcoarment I made a simple site for a similar purpose (assuming they are scraping the zoom links). It just puts the redirect behind a Cloudflare turnstile captcha https://linkguard.net
LinkGuard

Protect your links from being viewed by bots.

@marcoarment our town uses you tube for live meeting broadcasts and VOD.
@marcoarment I think you can stream Google Meet meetings on YouTube and it might do something similar to Zoom Webinars?
@marcoarment I can set you up with an Adobe Connect account if you’d like. It enables you to manage participants and permissions.
@marcoarment Might be overkill, but you could set up a Janus webrtc server to do the broadcast…
@marcoarment Link on site but password in email?

@marcoarment wondered this myself. We tried to mitigate it a little for iOS Dev Happy Hour by making people register in order to get the link. Only helps a little.

The strangest interaction ever was when one of the jerks who had been screaming and making random noises avoided getting kicked out (we can have well over 100 people so it can be hard to spot them if they only make the noise for a second). He ended up listening to one of our speakers, and apologized because he enjoyed the talk. 😵‍💫😵‍💫

@MuseumShuffle @marcoarment sorry Chris that was me it was good talk
@marcoarment turn on waiting room. That gives you some minimum control if you boot them they can’t immediately rejoin.

@marcoarment It’s the embedded password in the link, people crawl the web and mine other sources for zoom links and then join for fun.

Some tips!
1. New zoom link every month instead of reusing the old link (if a password leaks once, you’re hosed)
2. Do not include the password in the link. It’s slightly less convenient, but when the link leaks you’re still ok
3. If possible, only allow invitees in without the waiting room and make others be admitted (requires a human to let them in)

@marcoarment the main way, AIUI, is looking for Zoom links with the password in them. Could well be mitigated with just a custom URL redirect!
@SamTheGeek That's the first idea I had: just use a link shortener.

@marcoarment it’ll only help if the true link never leaks! But if you’re rotating passwords it should be fine.

It’s not just your problem: https://krebsonsecurity.com/2023/10/dont-let-zombie-zoom-links-drag-you-down/

Don’t Let Zombie Zoom Links Drag You Down – Krebs on Security

@marcoarment Do they change the meeting id? My library’s zoom stuff is the same id every time. They even tell you to bookmark it.
@marcoarment Setting up a waiting room means someone has to manage who comes in, but it’s worked well for a similar use I’ve had.
@ismh I'll have to check with them to see if that's allowed. NY Open Meetings Law is quite something to deal with.
@marcoarment Ah yeah I didn't have anything like that deal with.
@marcoarment most govts require open meetings, so you have to make the link public, but that doesn't mean everyone is unmuted. We allow everyone to enter & listen, but they must raise their virtual hand to speak. They can still disrupt, but can be quickly silenced.

@ismh @marcoarment this is how we managed my daughter’s birthday over Zoom back when lockdown first started.

Shared the link to her school friends on FB then monitored the waiting room to allow legit folks into the party

@marcoarment a few things worked for us at the start of the Zoom era for “open” meetings:
- attendees must preregister using either Zoom itself or another product like Eventbrite
- mail registrants the meeting ID (unique for every meeting open to the public) and the
- unique password for every meeting (that is open to the public)
- only allow verified Zoom accounts to join the meeting

Never had an issue since. Preregistration is not a forté of Zoom Bombers

@marcoarment if they aren’t already doing it, I suggest setting up the meeting as a webinar. You have to do it from the zoom website, but it doesn’t allow a free for all with comments, and the host has more control over who can participate.
@marcoarment possibly they are related or associated with people with valid invites.... internal threats
@marcoarment You can put a pin for the room I believe? Could be emailed out to participants beforehand?

@marcoarment I have done lots of managing of large Zoom meetings, but never used the webinar product because the person paying never could front the cost.

I would make sure that the waiting room is enabled so that people need to be admitted. (Not sure if that works in this case since the person managing it might not know the names of attendees, or they might not have their name in Zoom.)

You can also restrict people from unmuting themselves without permission.

@marcoarment The meeting link should be able to support a password in the query string. Just avoid publishing the password on the open web, instead just sharing with folks who need it via email or private forums.
For an extra layer of security you can add a waiting room, but then someone will need to approve attendance.
Charlottesville City Council suspends virtual public comments after racist remarks at meeting

The Charlottesville City Council has decided to suspend virtual public comments during public meetings after anonymous callers zoomed into a council meeting earlier this month and made racist remarks

The Washington Post
@marcoarment (I send these only as a "you're not alone” not, unfortunately, with suggestions of fixes)

@caseyliss @marcoarment I don’t see how you can avoid this with anything publicly accessible.

This is no different than being able to just attend these in person and doing it.

The difference is that they don’t have the guts to do that.

@maddox @caseyliss @marcoarment Part of the problem is that it actually is quite different:

For someone to do this in “real life” they’d at least have to show up to Marco’s small town. Presumably most trolls wouldn’t actually have the means to do that (both time and money).

The internet lowers the barrier, it’s globally accessible.

@caseyliss No, not Char … Nevermind.

@davidr I have zero tolerance for this.

Charlottesville is an AMAZING city, which is VERY liberal. I lived there for four years. Just because a bunch of fucking racist chodes descended on Charlottesville does not make it a racist supercenter.

I get you're just trying to crack wise, but, no. Not having it.

@caseyliss I hear you, and certainly didn’t mean a personal attack on someone I deeply respect, Casey. I still have many questions, though, including where were the Charlottesville police, and why were so few arrested? You don’t have to respond, I just wanted you to know where I was coming from.

@davidr I wish I knew. It was handled very poorly. But in the defense of CPD, I don’t think we realized how awful Trump and his minions were yet.

I’m sorry for popping off, but this really chaps my ass. I know you didn’t mean anything by it — I’d have probably made the same joke. But I hate to see a city I love dragged thru the mud.

(I say this as a Hokie; Charlottesville is the home of our rivals!!)

🍻

@marcoarment Scope out Vimeo for public meetings, we use this for large corporate meetings (where Teams/Zoom doesn't make sense). https://vimeo.com/blog/post/streaming-council-meetings/
Streaming council meetings: what you need to know

Ready to live stream local government? Get the 411 on streaming council meetings, hearings, and other events for constituents.

Vimeo Blog
@marcoarment bizarrely, in our local WordPress group last night, the Zoom host said preventing people change names can help. I honestly don't see how, but he briefly unlocked it so one of our participants could change their name from "iPhone" then immediately re-locked it again.
@marcoarment You have to set it up so that the host accepts participants. This way you can control who’s coming or not. Also - a password as an alternative
@marcoarment Virginia has similar open meeting laws to NY from what I see. You might look at the stuff that VCOG has published about all the online meeting stuff that’s been done here over the pandemic. https://www.opengovva.org/blogs/megan-rhyne And maybe look to see if there’s a similar group that can offer guidance on what limits you can impose.
@marcoarment the one setting that seemed to make the difference was to require logged in zoom users.
@marcoarment waiting room: don’t let them in

@marcoarment

When COVID hit I had find a solution to this for the school board district I worked at. And very quickly.

My solution was 2 different meeting rooms. One for the board members and staff only. This 1 fed a YouTube live stream…

@marcoarment

2nd room was for public input. Folks had to pre register. (How they got the join link) Moderated by staff, who cued folks up by pinning the desired speaker and overriding guest audio & video permissions.

Another Staff person routed the output of this 2nd meeting into the 1st. A dedicated computer screen sharing meeting 2 (full screen) as a video feed into 1. This staff person also had control of gate keeping the signal from 2 into 1. Only enabling it when it was called for…

@marcoarment

Now of course my department was in video production and we had a broadcast control room and all the necessary toys and staff to make magic happen. But with enough consumer/ prosumer gear, staff and spare computers one can make this work.

@marcoarment Maybe worth reaching out to Zoom to ask if they’d give a steep discount for public meetings.

Another more involved and harder for you and users option is to use an open source conference app like Jitsi https://jitsi.org/jitsi-meet/ that actually works fairly well in Chrome and I think they have apps to support mobile.

Not as familiar to users as Zoom but it may give you wide ability to control the meeting and be less expensive.

About Jitsi Meet | Free Video Conferencing Solutions

What is Jitsi Meet? Jitsi Meet offers free, secure and open-source video conferencing. Start using Jitsi Meet today, and deploy videoconferencing solutions.

Jitsi
@marcoarment waiting room helps. But it exposes different problems. So many people try to login with the name “iPhone”. Many users have no idea how to change their zoom name.
@marcoarment
I’m on the Architecture Committee for my HOAMCO. We manage with a combination of settings:
1) waiting room - the staff member who is “hosting” the meeting lets people in and can boot people, if necessary
2) we ask residents to configure their Zoom display name to include their property address - though many do not.
3) only the committee members are unmuted - others raise their hand to speak
4) unique meeting ID emailed out to the community and posted on the HOA website in advance.
@marcoarment
I wonder if Jitsi Meet has the same problem, or there is security in relative obscurity. Because Jitsi is almost exactly like Zoom.
* But they don't have the history of dodgy behavior.
* Free versions can create meetings with no time limit.