Zoom links published on social media and across the wider web can be found by the bad guys.

While we don’t know for sure how they find them, they likely “crawl the web” finding links, dates and times.

For this reason, the first and most important rule of Zoom security is:

Never use your Zoom personal meeting ID.

Your Zoom personal meeting ID is a persistent room ID, that can be used for instant meetings.

If you use Zoom for work, that means anyone could barge in at anytime. Bad news.

The secure choice is to use an automatically generated (random) ID when scheduling your Zoom event.

The second and equally important rule of Zoom security is:

Always include a password.

It actually doesn’t matter how secure the password is. Zoom, by default, will provide a 6 digit number. You can change that to any other number, like 007, or to a word, like “balance,” if you like.

Just don’t get too creative in case it creates friction when people join.

Most people won’t need to enter the Zoom meeting ID and password – they’ll just click on a long link that looks something like this:

https://zoom.us/j/98211193335?pwd=Y0xxjelRoTkVW8bTNSOVhoY1NFUC8yUT09

The password is encrypted in that link. Why even have a password then? Well – it prevents those bad guys from just running through random numbers trying to find an event in progress, and joining without a password.

Some folks are adding spaces or [remove me] from links in an attempt to protect them in public forums.

It might work, might not. But it certainly creates friction for less tech-savvy attendees.

The bad guys’ web scrapers are looking for Zoom references, especially links. That may or may not happen on the web or social media. We don’t know, we can only guess.

Do not use the word Zoom in your title/event description, or a visible zoom.us join link, in any public forum.

In Toronto, we are now using contradance.link, which is powered by a custom URL shortening service called Rebrandly. Our link is contradance.link/TVC, and we have set up similar links for other online dances to disguise Zoom links. It’s simple but effective.

Pluses:

• We can use the same link for every dance, and just update the destination.
• Very low friction for entry – it’s even easier to use than a Zoom link!
• We are able to see stats on the link (how many clicks), which gives us a sense of total attendance for the dance.

Minuses:

• A very tech savvy person could figure out the Zoom link with the right technology. This is very minor, given that the URL is not even a known URL shortening service.
• You’ll need to ask me to update your URL. (I’m happy to do so.)

If you’d like to get set up on contradance.link for your virtual dance, just contact me here.

Previously, I recommended a password-protected link service, such as protectyourlinks.com. It is still a viable option, but we found it didn’t allow us to change the link when needed.

ProtectYourLinks.com works like this: your Zoom link is converted into a password protected or challenge link like this: try me!

Pluses:

• While other URL shortners are not secure, password-protected ones are.
• Very low friction for entry.

Minuses:

• Password/challenge question is light friction for your attendees.
• The website interface is very basic, and note that the password is case-sensitive.
• If you need to update your link, you’re out of luck.

Because of the case sensitivity – include a note in your “description” such as “Balance and _____. Enter the answer in lower case.”

Or make your answer a number, like “This dance is scheduled for June __, 2020. Enter the number only.”

The password doesn’t have to be fancy. The whole thing is just a deterrent and it is deterring Zoom link collecting robots, not people.

Bonus points: make the password the same as your Zoom event password. That way there is no confusion!

Toronto Virtual Dance abandoned this method in favour of using our own URL shortening service, contradance.link.

The next aspect of security for your event is where – and how – you publish the link to your event.

If your Zoom link is only sent out privately, or is password protected – you have a lower risk of having a problem.

If your Zoom link is published anywhere public in its raw form – it is very important you take strong security precautions for the event itself.

Here’s a run down of different publishing/promotional options – and pluses and minuses of each.

Click on each option to expand the description.

OK, you’re promoting your event. Now you want to make sure the event is secure.

There are several things you can do to increase security. Of course, each has trade-offs.

One of the options we tried in Toronto (requiring sign-in) is very effective at preventing the bad guys from attending our dance – but it also prevented lots of good folk from attending, too. We’ve decided that’s not worth it.

There is one setting that is an absolute must:

Disable screen-sharing for all participants other than the host.

Please, please, please do that. That is the option that, if exploited, is the most disruptive.

Here’s how to set it in advance. You must already have an account with Zoom.

1. Visit Zoom.us in a web browser.
2. Click the Login option in the top right corner, and then login with your Zoom credentials.
3. Select “Settings” in the left hand menu.

   

4. Select In Meeting (Basic), and scroll down until you find Screen Share

   .

5. Click Save. This will now be your default option for all meetings.

The only people who need the screen sharing functionality in Zoom during a contra dance are the callers, if they are sharing recorded music through Zoom.

Make the callers co-hosts, and you’re set.

Okay, now that you have that critical setting in place, here are the other settings available, along with discussion and recommendation.

Click on each option to expand the description.

Your settings are set. Your music is set. Your callers are set.

It’s showtime.

It won’t take much during the event to keep things safe if you’ve been diligent ahead of time. You can focus on having fun.

Here’s a few things to consider during the event itself.

Zoom recently introduced a security button, to put the most important security controls in one place.

Here is the rundown for each:

The following tasks which are helpful to have volunteers handle during the dance, to ensure the dance is safe and secure. Some of them can be done by the same person, depending on your settings.

1. Waiting room monitoring: Assign someone to admit people from the waiting room in-between tunes. This is probably the person who will also remove participants if necessary.
2. Mute/Unmute: If you are unmuting people mid-dance, such as between tunes, have someone other than the caller do this and be ready with the controls in case there is a problem.
3. Monitoring chat: Watch to ensure there isn’t anything inappropriate happening in the chat window, and be the point of contact if there is something inappropriate in a private chat.
4. Scanning for inappropriate images/names: If you haven’t disabled rename, profile images, and/or virtual backgrounds, scan through and ensure nothing inappropriate has shown up.

The stricter your settings, the less volunteers have to do.

It is recommended that security volunteers use Zoom’s Speaker View, rather than Gallery View, as it allows you to quickly identify people who are speaking and mute and/or kick them out if necessary.