Zoom’s Use of Facebook’s SDK in iOS Client • Hacker News Board

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#151

Post by youngtaff » Sat, Mar 28, 2020, 9:32 AM UTC

bscphil wrote: post #83

aaronbrager wrote: post #52

Earlier quoted context omitted.

You can pretty easily see all the traffic on your own phone. You can even do it on device https://apps.apple.com/us/app/charles-proxy/id1134218562

Does this work with apps that do their own TLS using their own pinned certs? I don't see how it could. Surely that's a lot of high profile apps these days. If this app works without root, it must be possible to apps on iPhone to add their own certificates to the system, which are then trusted by other applications - that would already be pretty alarming. I think Android still requires certificates to be manually impo…

If you've got a Jailbroken phone, this post explains how to extract the TLS keys (to decrypt the traffic) using a Frida script

https://andydavies.me/blog/2019/12/12/capturing-and-decrypti...

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#152

Post by lultimouomo » Sat, Mar 28, 2020, 9:32 AM UTC

envy2 wrote: post #148

lultimouomo wrote: post #136

Nice way to bury an innocuous "iOS Advertiser ID" in the middle of the list. What "iOS Advertiser ID" means is, to a very good degree of approximation, your deanonimized identity. Also, that just linking the SDK in your app deanonimzes the user to Facebook is very, very clear in its documentation. It's not like Zoom didn't notice until someone told them. They made a decision, and now they're changing it because they…

The list is in alphabetical order. It's not malicious...

Alphabetical order is neither mandated by any rule, nor deterministic since you can choose how to call things. "Application Bundle Identifier" made it to the top of the list, but if it was "iOS Application Bundle Identifier" it would be below the Advertiser ID.

Do you really think they prepared a PR statement to respond to harsh criticism and just decided to toss in there the list of information sent without crafting the order of the items?

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#153

Post by dewey » Sat, Mar 28, 2020, 9:33 AM UTC

JMTQp8lwXL wrote: post #57

aaronbrager wrote: post #52

Earlier quoted context omitted.

You can pretty easily see all the traffic on your own phone. You can even do it on device https://apps.apple.com/us/app/charles-proxy/id1134218562

Seeing it != blocking it.

So https://guardianapp.com then?

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#154

Post by lultimouomo » Sat, Mar 28, 2020, 9:35 AM UTC

enitihas wrote: post #146

lultimouomo wrote: post #136

Nice way to bury an innocuous "iOS Advertiser ID" in the middle of the list. What "iOS Advertiser ID" means is, to a very good degree of approximation, your deanonimized identity. Also, that just linking the SDK in your app deanonimzes the user to Facebook is very, very clear in its documentation. It's not like Zoom didn't notice until someone told them. They made a decision, and now they're changing it because they…

They are changing because right now they are growing like crazy without the need to do much on user acquisition, and a bad PR is just too costly right now. But good to see them doing it.

Sure, good they are changing. And Zoom is definitely not alone in this. Facebook SDK usage is widespread and it's a horrible thing. And even then, the fault ultimately resides with Apple and Google that provide cross-application unique identifiers.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#155

Post by xenonite » Sat, Mar 28, 2020, 9:40 AM UTC

Let me ask how many of those who now argue in Zoom's favor have bought shares or are invested in any other way, like having bought licenses directly or indirectly for their company?

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#156

Post by tinus_hn » Sat, Mar 28, 2020, 9:42 AM UTC

Is that list actually complete? It doesn’t sound like that much of a deal.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#157

Post by Fnoord » Sat, Mar 28, 2020, 9:44 AM UTC

pimeys wrote: post #137

JMTQp8lwXL wrote: post #57

Earlier quoted context omitted.

Seeing it != blocking it.

You basically need your own VPN server with Pi-hole installed to control the tracking. It is a very effective way to block this, but not that easy to setup.

If you can use NextDNS, you have something akin to a Pi Hole.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#158

Post by kingludite » Sat, Mar 28, 2020, 9:45 AM UTC

nexuist wrote: post #62

mikenew wrote: post #45

So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting ma…

I don't want to live in a world where my parents and grandparents are expected to pull up Wireshark to figure out if the app they're using will record their front camera without consent. Blaming Zoom and FB is entirely acceptable here, it is their responsibility to keep my data private. Blaming Apple? Why, when Zoom is on the Play Store as well? https://play.google.com/store/apps/details?id=us.zoom.videom... >As long…

Cant you put just the dysfunctional peer behind the expensive network magic?

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#159

Post by mianos » Sat, Mar 28, 2020, 9:49 AM UTC

Hokusai wrote: post #49

To use the Facebook SDK is a rocky mistake. It includes all kind of telemetry that is send to Facebook, whenever the user is connected to Facebook or not. In the company I worked for, they read the code, you have access to it, and stripped that parts. It's not much work but its a pain. The best approach is to use just the HTTP APIs and ignore the SDK. Your team will better understand how Facebook works, your app will…

This is kind of exactly what they said it didn't do.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#160

Post by tomhoward » Sat, Mar 28, 2020, 9:56 AM UTC

thulecitizen wrote: post #8

ccktlmazeltov wrote: post #3

And so zoom crumbled from the social pressure, while every other service and website is thinking "oof, they didn't realize that everybody does this to do advertising"

Sometimes I really wonder who is on hackernews that stuff like this gets downvoted. Apparently a healthy dose of (scientific) skepticism means one is being ‘rude’ in SV circles. I guess the intellectual-property-rentier industrial complex that is Silicon Valley doesn’t like people looking behind the curtains.

It's not downvoted, now.

Yep, no doubt it was when you commented, but an unfairly downvoted state on a comment usually corrects fairly quickly, which is one of the reasons why the guidelines ask us not to complain about it.