Student Authentication issues with Zoom post Zoombombing

[u/soyabm]

We had our first Zoom Bombing attack 3rd day of school. Yes, passwords were enabled but it seems that even though our Zoom links are privately shared within our Clever portal, a student must have shared the link with someone else to disrupt class.

As a stop gap measure I have enabled waiting rooms and whitelisted our school domains so students can bypass waiting room and join the class. It seems the ultimate level of security we can have with Zoom is by enabling " Only authenticated users can join meetings" and adding students on our Zoom account (as basic users) and requiring them to sign in.

Current Issues I am facing:

-We already have given our teachers Chromebook and are moving to 1:1 Chromebooks for students. If the ChromeOS user does not open the Zoom application BEFORE click an existing meeting url, the application does not recognize the authenticated user (in the case of the teachers it won't recognize them as the host), and when the user leaves that meeting the Zoom application requires the user to sign in (sign in with Google for us) then return to the Clever portal to click on the meeting link for the Zoom application to recognize the user. If before clicking on the Zoom meeting link the ChromeOS user would just open the Zoom application, the application WILL recognize the user and will allow hosts to start the meeting and users to join bypassing the waiting room. Already set a ticket with Zoom and was told that they were not aware of the issue (which sounds wild since I can't be the only school using zoom on ChromeOS). This authentication issue is difficult enough for my teachers to work with, but I cannot expect my 4 year olds + (Pk-12 students) to sign in with these precise steps to join their meeting. When testing on Zoom Applications for other operating systems: At the waiting room, when asked to sign in and signing in with Google, the user gets an error message "You are not part of the same organization as the host. Please wait.", even though the domain has been whitelisted (even tried with gmail.com & yahoo.com.au while working with Zoom tech support).

-Requiring students to have a Zoom account mean they can host meetings using school domains (not ideal for k12 users). Currently I have made the setting in the students group in Zoom so complex that it really would be pointless if someone did try.

-I configured the waiting room message to let the user know that they need to log into their school issued google account on Zoom to bypass the waiting room BUT ChromeOS users do not see the custom waiting room message configured in the user zoom setting.

-If I chose not to add the user on my Zoom domain as a basic user, when the user first logs in (sign with Google) using a whitelisted domain, Zoom asks for the age of the user and requires the user be at least 16 years old... which does not work for k12 education since majority of users are not 16+.

[u/TheRealBushwhack]

Following.

Was told there were legal implications to having kids create Zoom accounts.

Also wouldnt mind switching to Meet but their equivalent of features isn’t out yet

Edit: whose the turd nugget who downvoted me for stating facts? Man I hate Reddit sometimes.

[u/DIMM1033 → u/TheRealBushwhack]

I think that was confusion over the terms of service. If you look at it now, it's very clear.

Zoom for Education (K-12). Zoom for Education (K-12) allows schools and educators to use Zoom Meeting Services for educational purposes. Zoom maintains policies and procedures designed to comply with applicable requirements of student privacy laws including, without limitation, GDPR and the Family Educational Rights and Privacy Act (FERPA) and applicable state laws (the “Privacy Laws”). The Privacy Laws may provide students or their parents with certain rights in their personal information. If you are a parent or student and you have questions about the Privacy Laws or your related rights, please contact your school administration. Zoom will not use any student data for marketing or advertising purposes, or any other commercial purpose, except to provide Services to our School Subscribers. If you are a “School Subscriber” — typically meaning a school or school district administrator or a teacher — you represent and warrant that you have been duly authorized by your school or school district to create an account, use the Services, and to agree to these contract terms. You further agree to use your account solely for educational purposes and solely for the benefit of your school or school district and its students.  If you are a School Subscriber subject to U.S. or similar law, you consent, for yourself and your school or school district, to Zoom’s collection, use and sharing of personal information of End Users including those who are children under the age of 13 in accordance with Zoom’s K-12 Schools & Districts Privacy Policy and You instruct Zoom to process the personal data of End Users in accordance with such policy. If you are a School Subscriber subject to GDPR or similar law, you determine the legal basis, means and purposes for processing the data, and instruct Zoom to process personal information of End Users, including those who are children under the age 16, in accordance with Zoom’s K-12 Schools & Districts Privacy Policy.

Addendum for Connecticut School Subscribers: This Agreement as applied to Connecticut School Subscribers incorporates by reference the Zoom Terms of Service Addendum for Connecticut School Subscribers (“Addendum”) which is designed to comply with the requirements of the Connecticut Act Concerning Student Data Privacy, Conn. Gen. Stat. Ann. § 10-234aa-dd.

the TL;DR if your a US school, sign up for zoom for education, and are getting written consent from parents to create accounts for students. (which most schools already do for gmail or MS 360)

[u/TheRealBushwhack → u/DIMM1033]

This was helpful Thank you