Avoiding "Zoom bombing" in virtual conferences and seminars With travel restricted by the COVID-19 pandemic, many academics are organizing online seminars and conferences as a substitute for regular in-person university seminars, colloquia, and research conferences.  

In real life, seminars are usually open to anyone who wants to drop in, and every attendee can be seen and heard and may ask questions.  So an obvious approach is to organize the event using video meeting software such as Zoom, and simply post the link on a public website so that any interested person can participate.  However, this also opens the event to "Zoom bombers", random people who just want to disrupt the proceedings with annoying or offensive video / audio / text chat - such abuse has unfortunately become very common in public Zoom meetings.

What best practices exist to keep such an event as open as possible to legitimate participants, and let them interact with each other and the speaker in a reasonable way, while reducing the risk of disruption and abuse?

What are the pros and cons of these strategies?

Strategies could be general, or involve specific features of certain software.

Some strategies I've thought of, and their drawbacks:


Create a password for the meeting.  Then the question is, to whom should the organizer give the password?  If they only give it to people they know, it excludes people who might be interested but whom they happen not to know.  If they distribute it to large mailing lists of interested academics, it raises the chance that it will fall into the wrong hands.
Offer to share the password by email upon request.  This requires extra time from the organizer to respond to those emails, and to manually verify the credentials of each requester.
Require a nominal registration fee, as real-life conferences often do.  This requires setting up an online payment system, which can be a lot of work, and may exclude people who are only casually interested, or who don't have funding, or who work in less wealthy parts of the world.  It may also involve the organizer in a lot of bureaucracy with their university as to how the fees will be managed and spent.
Use a "waiting room" feature, where participants must be approved immediately before joining.  However, as far as I know, the host only sees the participant's name.  If they see an unfamiliar name, how can they tell whether it is a troll, or a legitimate researcher whom they just happen not to know?  Conversely, I don't think there is anything to stop a troll from masquerading under the name of a famous academic.


I am wondering if people have thought of better solutions, that are specifically appropriate to academia.  Such strategies might take advantage of specific features of the academic community, e.g. to authenticate genuine researchers (.edu addresses? accounts on preprint servers? ORCid IDs?).  Answers could also address the pros and cons of such strategies as they apply to academia in particular, and how well they fit with people's existing expectations for academic conferences.
How about using something other than Zoom? Other softwares support features that can help with this. Moreover there are some serious security and privacy concerns about Zoom (see e.g. this statement by the FBI and this investigation by the NY attorney general; Bruce Schneier has written an overview of the concerns here).

In our department we use BigBlueButton (website, Wikipedia) for our classrooms and seminars. It's a completely open-source and free web conferencing system. There are a few services out there that host servers but they're completely overloaded at the moment. I'd say your best bet would be to get your IT services to host a server for your department. With BBB by default new users don't have their webcams activated, and you can prevent them from doing so. You can even prevent them from using their microphone and require them to virtually "raise their hand" before a moderator allows them to speak. That should cut down a lot of the abuse. You can also set up the service so that an account is required before accessing the meeting. Unless the abuser is very dedicated, they probably won't bother creating dozens of accounts to continue bothering people after being kicked out, I hope.

Also, something obvious: many abusers are specifically targeting Zoom and going into random Zoom meetings. Unless you've somehow attracted abusers who are specifically targeting you, if you use something else (especially something hosted by your own department), you probably won't have any problems.

Note: I'm only recommending BBB because that's what we use at our department, but there are other services out there. I know another department has set up something called "Panopto" for example, and another something called "Classilio" - you'll have to look that up, I don't know much about it. For informal meetings we use Jitsi but it doesn't seem adequate for hosting a seminar. But in any case, if a software doesn't meet your requirements, you should definitely look into switching to something else, especially with the privacy concerns...