{"id":"https://openalex.org/W4416178269","doi":"https://doi.org/10.1109/secdev66745.2025.00012","title":"A First Look at Privacy Compliance of Zoom Apps","display_name":"A First Look at Privacy Compliance of Zoom Apps","publication_year":2025,"publication_date":"2025-10-14","ids":{"openalex":"https://openalex.org/W4416178269","doi":"https://doi.org/10.1109/secdev66745.2025.00012"},"language":null,"primary_location":{"id":"doi:10.1109/secdev66745.2025.00012","is_oa":false,"landing_page_url":"https://doi.org/10.1109/secdev66745.2025.00012","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE Secure Development Conference (SecDev)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5078750596","display_name":"Andrew York","orcid":null},"institutions":[{"id":"https://openalex.org/I8078737","display_name":"Clemson University","ror":"https://ror.org/037s24f05","country_code":"US","type":"education","lineage":["https://openalex.org/I8078737"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Andrew York","raw_affiliation_strings":["School of Computing, Clemson University,Clemson,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computing, Clemson University,Clemson,USA","institution_ids":["https://openalex.org/I8078737"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5082422207","display_name":"Mohammed Aldeen","orcid":"https://orcid.org/0000-0001-7603-0765"},"institutions":[{"id":"https://openalex.org/I8078737","display_name":"Clemson University","ror":"https://ror.org/037s24f05","country_code":"US","type":"education","lineage":["https://openalex.org/I8078737"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Mohammed Aldeen","raw_affiliation_strings":["School of Computing, Clemson University,Clemson,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computing, Clemson University,Clemson,USA","institution_ids":["https://openalex.org/I8078737"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5007247586","display_name":"Jingwen Yan","orcid":"https://orcid.org/0009-0003-5193-2107"},"institutions":[{"id":"https://openalex.org/I8078737","display_name":"Clemson University","ror":"https://ror.org/037s24f05","country_code":"US","type":"education","lineage":["https://openalex.org/I8078737"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jingwen Yan","raw_affiliation_strings":["School of Computing, Clemson University,Clemson,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computing, Clemson University,Clemson,USA","institution_ids":["https://openalex.org/I8078737"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120445825","display_name":"Pranav Silimkhan","orcid":null},"institutions":[{"id":"https://openalex.org/I183452621","display_name":"Viasat (United States)","ror":"https://ror.org/039pwme76","country_code":"US","type":"company","lineage":["https://openalex.org/I183452621"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Pranav Silimkhan","raw_affiliation_strings":["Viasat Inc.,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Viasat Inc.,USA","institution_ids":["https://openalex.org/I183452621"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5028044541","display_name":"Song Liao","orcid":"https://orcid.org/0000-0002-5264-7573"},"institutions":[{"id":"https://openalex.org/I12315562","display_name":"Texas Tech University","ror":"https://ror.org/0405mnx93","country_code":"US","type":"education","lineage":["https://openalex.org/I12315562"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Song Liao","raw_affiliation_strings":["Texas Tech University,Department of Computer Science,Lubbock,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Texas Tech University,Department of Computer Science,Lubbock,USA","institution_ids":["https://openalex.org/I12315562"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5085340429","display_name":"Mert D. Pes\u00e9","orcid":"https://orcid.org/0000-0001-9192-5823"},"institutions":[{"id":"https://openalex.org/I8078737","display_name":"Clemson University","ror":"https://ror.org/037s24f05","country_code":"US","type":"education","lineage":["https://openalex.org/I8078737"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Mert D. Pes\u00e9","raw_affiliation_strings":["School of Computing, Clemson University,Clemson,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computing, Clemson University,Clemson,USA","institution_ids":["https://openalex.org/I8078737"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101995085","display_name":"Long Cheng","orcid":"https://orcid.org/0009-0004-4819-5406"},"institutions":[{"id":"https://openalex.org/I8078737","display_name":"Clemson University","ror":"https://ror.org/037s24f05","country_code":"US","type":"education","lineage":["https://openalex.org/I8078737"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Long Cheng","raw_affiliation_strings":["School of Computing, Clemson University,Clemson,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computing, Clemson University,Clemson,USA","institution_ids":["https://openalex.org/I8078737"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.41398806,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"5","last_page":"15"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.5210000276565552,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.5210000276565552,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11045","display_name":"Privacy, Security, and Data Protection","score":0.2766000032424927,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T11800","display_name":"User Authentication and Security Systems","score":0.033900000154972076,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/zoom","display_name":"Zoom","score":0.8402000069618225},{"id":"https://openalex.org/keywords/metadata","display_name":"Metadata","score":0.5839999914169312},{"id":"https://openalex.org/keywords/authentication","display_name":"Authentication (law)","score":0.5716999769210815},{"id":"https://openalex.org/keywords/information-privacy","display_name":"Information privacy","score":0.4952000081539154},{"id":"https://openalex.org/keywords/privacy-policy","display_name":"Privacy policy","score":0.48010000586509705},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.38999998569488525},{"id":"https://openalex.org/keywords/privacy-law","display_name":"Privacy law","score":0.3878999948501587},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.3864000141620636}],"concepts":[{"id":"https://openalex.org/C124913957","wikidata":"https://www.wikidata.org/wiki/Q1232548","display_name":"Zoom","level":3,"score":0.8402000069618225},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7595000267028809},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.671500027179718},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.5839999914169312},{"id":"https://openalex.org/C148417208","wikidata":"https://www.wikidata.org/wiki/Q4825882","display_name":"Authentication (law)","level":2,"score":0.5716999769210815},{"id":"https://openalex.org/C123201435","wikidata":"https://www.wikidata.org/wiki/Q456632","display_name":"Information privacy","level":2,"score":0.4952000081539154},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.48809999227523804},{"id":"https://openalex.org/C102938260","wikidata":"https://www.wikidata.org/wiki/Q1999831","display_name":"Privacy policy","level":3,"score":0.48010000586509705},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.43320000171661377},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.38999998569488525},{"id":"https://openalex.org/C141972696","wikidata":"https://www.wikidata.org/wiki/Q1247836","display_name":"Privacy law","level":4,"score":0.3878999948501587},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.3864000141620636},{"id":"https://openalex.org/C22561748","wikidata":"https://www.wikidata.org/wiki/Q854954","display_name":"Videoconferencing","level":2,"score":0.37869998812675476},{"id":"https://openalex.org/C2781460075","wikidata":"https://www.wikidata.org/wiki/Q1399332","display_name":"Compliance (psychology)","level":2,"score":0.34049999713897705},{"id":"https://openalex.org/C2779965156","wikidata":"https://www.wikidata.org/wiki/Q5227350","display_name":"Data sharing","level":3,"score":0.3059000074863434},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.28040000796318054},{"id":"https://openalex.org/C184356942","wikidata":"https://www.wikidata.org/wiki/Q830382","display_name":"Best practice","level":2,"score":0.27230000495910645},{"id":"https://openalex.org/C509729295","wikidata":"https://www.wikidata.org/wiki/Q7246032","display_name":"Privacy software","level":3,"score":0.2711000144481659},{"id":"https://openalex.org/C2988145974","wikidata":"https://www.wikidata.org/wiki/Q620615","display_name":"Mobile apps","level":2,"score":0.2671999931335449},{"id":"https://openalex.org/C69360830","wikidata":"https://www.wikidata.org/wiki/Q1172237","display_name":"Data Protection Act 1998","level":2,"score":0.26109999418258667},{"id":"https://openalex.org/C4924752","wikidata":"https://www.wikidata.org/wiki/Q184148","display_name":"Plug-in","level":2,"score":0.26080000400543213},{"id":"https://openalex.org/C71745522","wikidata":"https://www.wikidata.org/wiki/Q2476929","display_name":"Confidentiality","level":2,"score":0.2597000002861023},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.25290000438690186}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/secdev66745.2025.00012","is_oa":false,"landing_page_url":"https://doi.org/10.1109/secdev66745.2025.00012","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE Secure Development Conference (SecDev)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1952746327","display_name":null,"funder_award_id":"2523814,2448205,2239605,2228616","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Video":[0],"conferencing":[1,39],"applications":[2,21,64],"are":[3],"extensively":[4],"utilized":[5],"in":[6,102],"various":[7],"day-to-day":[8],"activities.":[9],"Since":[10],"the":[11,14,17,35,57,84,109,131,140,191],"onset":[12],"of":[13,19,34,83,99,136,147,172],"COVID-19":[15],"pandemic,":[16],"usage":[18,82],"such":[20],"has":[22],"experienced":[23],"a":[24,48,169],"significant":[25],"surge.":[26],"Among":[27],"these,":[28],"Zoom":[29,43,85,89,103,141,186],"stands":[30],"out":[31],"as":[32],"one":[33],"most":[36],"popular":[37],"video":[38],"platforms.":[40],"In":[41,92,181],"2021,":[42],"unveiled":[44],"its":[45,68],"apps":[46,71,105,138,187],"marketplace,":[47],"groundbreaking":[49],"initiative":[50],"aimed":[51],"at":[52],"empowering":[53],"developers":[54],"to":[55,66,75,176,201,213],"augment":[56],"platform's":[58],"functionality":[59],"by":[60,106],"introducing":[61],"their":[62,81,116,163],"own":[63],"tailored":[65],"enhance":[67],"capabilities.":[69],"These":[70],"extend":[72],"third-party":[73],"access":[74,214],"data":[76,124,179],"about":[77],"Zoom's":[78],"users":[79],"and":[80,115,126,133,208,219],"platform,":[86],"potentially":[87],"sacrificing":[88],"users'":[90],"privacy.":[91],"this":[93],"paper,":[94],"we":[95,129,166,183,227],"conduct":[96],"comprehensive":[97],"analysis":[98],"privacy":[100,117,127,134,151,225],"compliance":[101],"marketplace":[104],"systematically":[107],"examining":[108],"alignment":[110],"between":[111],"apps'":[112,123],"granted":[113,210],"permissions":[114],"policy":[118],"disclosures.":[119],"To":[120],"identify":[121],"these":[122,148,173],"practices":[125,226],"concerns,":[128],"collected":[130],"metadata":[132],"policies":[135,174],"2,733":[137],"on":[139],"marketplace.":[142],"We":[143],"found":[144,167],"that":[145,161,168,185],"87%":[146],"had":[149],"reachable":[150],"policies.":[152],"Of":[153],"those":[154],"policies,":[155],"only$\\mathbf{1":[156],"4}":[157],"\\boldsymbol{\\%}$had":[158],"logical":[159],"contradictions":[160],"reduced":[162],"clarity.":[164],"However,":[165],"staggering":[170],"99.7%":[171],"failed":[175],"disclose":[177],"all":[178],"practices.":[180],"addition,":[182],"demonstrated":[184],"can":[188],"run":[189],"inside":[190],"client":[192],"application":[193],"without":[194],"valid":[195],"authentication":[196],"with":[197],"Zoom,":[198],"enabling":[199],"attackers":[200],"modify":[202],"app":[203],"code":[204],"after":[205],"being":[206],"approved":[207],"exploit":[209],"OAuth":[211],"scopes":[212],"contact":[215],"information,":[216],"meeting":[217],"data,":[218],"user":[220],"account":[221],"details":[222],"beyond":[223],"disclosed":[224],"identified.":[228]},"counts_by_year":[],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-11-13T00:00:00"}