Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom’s Use of Facebook’s SDK in iOS Client

blog.zoom.us

Post reply on HN
Print view View original

81–90 of 272 posts

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#81

Post by kyawzazaw »

JMTQp8lwXL wrote: post #58
intopieces wrote: post #55

Earlier quoted context omitted.

>Getting mad at Zoom for using the Facebook SDK is missing the point. It's really hard to believe this point given that... getting mad seems to have worked.

Doesn't scale. We can't have 1,000,000 front page "App X uses Y SDK" posts. People will stop caring. Nobody's made a post of that flavor in awhile, and Zoom got caught in the crossfire. Honestly, if anything it shields other apps. People have a limited capacity for repeatedly addressing the same thing.

I think it doesn't always have to scale. Zoom is a huge player right now and in great usage across all industries, countries and users.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#82

Post by JMTQp8lwXL »

kyawzazaw wrote: post #81
JMTQp8lwXL wrote: post #58

Earlier quoted context omitted.

Doesn't scale. We can't have 1,000,000 front page "App X uses Y SDK" posts. People will stop caring. Nobody's made a post of that flavor in awhile, and Zoom got caught in the crossfire. Honestly, if anything it shields other apps. People have a limited capacity for repeatedly addressing the same thing.

I think it doesn't always have to scale. Zoom is a huge player right now and in great usage across all industries, countries and users.

That's a great point. The 80-20 rule likely applies here. Of all instances of beaconing events, the bulk of those events originate from a small number of popular apps.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#83

Post by bscphil »

aaronbrager wrote: post #52
mikenew wrote: post #45

So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting ma…

You can pretty easily see all the traffic on your own phone. You can even do it on device https://apps.apple.com/us/app/charles-proxy/id1134218562

Does this work with apps that do their own TLS using their own pinned certs? I don't see how it could. Surely that's a lot of high profile apps these days.

If this app works without root, it must be possible to apps on iPhone to add their own certificates to the system, which are then trusted by other applications - that would already be pretty alarming. I think Android still requires certificates to be manually imported by the user. Maybe this app points you to instructions on how to do this, but the description makes it sound very automatic.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#84

Post by fiddlerwoaroof »

kelnos wrote: post #78
banana_giraffe wrote: post #38

Earlier quoted context omitted.

Between this and the HTTP server, it feels like Zoom of old that wrote the app was more willing to make the user experience vs user privacy trade off in favor of user experience. Now you need to log in via Facebook with a separate browser window, and thanks to the HTTP change, you need to click on a browser dialog to launch a meeting from a link. So, they've either changed their policy to err more towards the privacy…

I think it's more likely that the developers responsible for the HTTP server just didn't know much about local security, and Zoom doesn't have a good security review process (where actual infosec professionals are involved). That doesn't absolve them of responsibility, of course, but I really don't think it was malice or an intentional desire to ignore privacy concerns.

The HTTP server was a great idea: the problem wasn’t the server but the bug in the server.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#85

Post by fiddlerwoaroof »

kelnos wrote: post #79
gfodor wrote: post #28

Earlier quoted context omitted.

I guess this is another under-recognized benefit of developing for the web - when doing so, you're staring at the Network tab all day, trying to grok what's going on over the wire and to whom. I don't remember doing this nearly as much on native.

Yeah, that's the thing. I do very little web development, but I inevitably find myself in the Network tab of dev tools debugging something. I do around as little mobile (Android) development, and I'm not even really sure how I'd watch network traffic coming from an Android app. (I'm sure it's possible, but I imagine it requires explicit setup, possibly with some third-party software and/or the assistance of a laptop.…

If you have a router running something like openwrt (or from a vendor that uses openwrt and lets you get a root shell on the router) you can just use tcpdump on the router with a filter to pick the host you want to monitor.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#86

Post by saagarjha »

bscphil wrote: post #83
aaronbrager wrote: post #52

Earlier quoted context omitted.

You can pretty easily see all the traffic on your own phone. You can even do it on device https://apps.apple.com/us/app/charles-proxy/id1134218562

Does this work with apps that do their own TLS using their own pinned certs? I don't see how it could. Surely that's a lot of high profile apps these days. If this app works without root, it must be possible to apps on iPhone to add their own certificates to the system, which are then trusted by other applications - that would already be pretty alarming. I think Android still requires certificates to be manually impo…

No, you’d need to jailbreak or modify the application for that.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#87

Post by saagarjha »

mikenew wrote: post #45

So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting ma…

> Getting mad at Zoom for using the Facebook SDK is missing the point. They and a million others are always going to be doing this. Get mad at Apple for not letting you wireshark your own iPhone.

There’s plenty of anger to go around. Get mad all all three: Facebook for making an SDK that tracks you, Zoom for integrating it, and Apple for letting it through unencumbered.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#88

Post by saagarjha »

kelnos wrote: post #75
nh2 wrote: post #56

Earlier quoted context omitted.

> I don't think these companies are sharing data with Facebook intentionally. That would imply they are incompetent and negligent. Would one not expect large companies like LG to have internal security and privacy reviews of the software they publish, and know very well what they are doing? > What justification Their core business.

> That would imply they are incompetent and negligent. Not really. Product Manager: I want to be able to support Facebook login for our app. Developer: OK... [googles for how to do that] ... We can use the FB SDK for that. PM: Cool, let's do that. Dev: [implements it] Nobody really does much more due diligence than that most of the time. I suppose you could argue that's negligent, but if that's the case, then pretty…

> I suppose you could argue that's negligent, but if that's the case, then pretty much every company that has an app with login functionality is probably in that boat.

I think every company that does this is negligent. Audit your dependencies, people!

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#89

Post by saagarjha »

fiddlerwoaroof wrote: post #84
kelnos wrote: post #78

Earlier quoted context omitted.

I think it's more likely that the developers responsible for the HTTP server just didn't know much about local security, and Zoom doesn't have a good security review process (where actual infosec professionals are involved). That doesn't absolve them of responsibility, of course, but I really don't think it was malice or an intentional desire to ignore privacy concerns.

The HTTP server was a great idea: the problem wasn’t the server but the bug in the server.

The “bug” where it would basically act like persistent malware, or the bug where it would act like persistent malware but also allow attackers remote access to your machine?

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#90

Post by saagarjha »

diebeforei485 wrote: post #44
noahtallen wrote: post #23

Earlier quoted context omitted.

> we decided to remove the Facebook SDK in our iOS client and have reconfigured the feature so that users will still be able to log in with Facebook via their browser. Since they removed the Facebook SDK entirely, whatever mechanism Facebook used to collect the info doesn’t exist any more. Instead of being able to collect the data at all times, wouldn’t FB only have a vector to do so through web login? At that point,…

On recent versions of iOS, in-app browsers do not share data with the Safari browser. How effective would browser fingerprinting be? Everyone with the same device, same language/locale and same timezone should have the same browser fingerprint, I thought.

> On recent versions of iOS, in-app browsers do not share data with the Safari browser.

Specifically, SFSafariViewController does not share cookies or other data with Safari anymore. Some bad actors got caught with their hands in the cookie jar, literally, and out that sharing went.

Post reply on HN