Zoom videoconferencing seems to be the de facto means of group communication for the current remote work environment — my calendar shows a Zoom conference every day this week related to non-profit work that I do (after all, Zoom has a “free version”). But while Zoom may be great for its original intended use, recent security flaws mitigate against attorneys and others operating in secure/confidential environments using it for professional and commercial purposes.

First there was a flaw related to meeting room codes (which with default settings could allow others to enter a Zoom meeting). Then a flaw enabling remote camera access to Zoom meetings (which spawned the term and hashtag “Zoombombing”). Then privacy concerns surfaced over the “recording feature” for meetings and sharing information with third parties (specifically Facebook). And most recently, flaws allowing remote code execution and capture and replay of security tokens have been documented (creating the potential to hijack credentials to access network resources and install malware) — which is further exacerbated in a remote work environment, due to the reduced outbound network monitoring that might otherwise detect such an intrusion.

It has also been reported that Zoom’s Company Directory feature leaks email addresses and photos, and that the video conferencing app does not use end-to-end encryption to protect calls from interception. And most concerning for any environment where confidentiality is critical is the recent disclosure that Zoom uses servers located in China to distribute encryption keys — a fact that should make use of the application by lawyers, journalists, healthcare providers, or any corporation where strong privacy and confidentiality is required anathema. Even the FBI has issued a warning about use and vulnerabilities of the application and CNET reported two new vulnerabilities today allowing third parties to access and download video of prior Zoom meetings.

Zoom is a great application and I have really enjoyed using it to connect informally with real people in their real living spaces during this period of forced isolation. But even good tools and good intentions can combine into disastrous consequences — as evidenced by my recent attempt to use a wooden spoon and cordless drill as a kitchen mixer and a hilarious SNL skit demonstrating how to use Crayola markers to substitute for makeup. The bottom line — Zoom has yet to prove itself the “industrial strength” application needed for high-security/confidential communications and until that occurs “use with caution” is the appropriate label for this much beloved app. And if Zoom is the required app for any conference, share a few security tips with the host that will help assure that your online meeting occurs without incident.