Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom’s Use of Facebook’s SDK in iOS Client

blog.zoom.us

Post reply on HN
Print view View original

191–200 of 272 posts

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#191

Post by codesternews »

greggman3 wrote: post #187

I'm happy the Zoom doesn't want to help Facebook spy on me. Unfortunately the chosen solution is still a privacy nightmare. Basically they let you login to Facebook via an in app browser. The problem is an app can spy on all activity of an in app browser. That means you have to trust that Zoom is not recording your facebook password as you type it in. We need a better system. Also scary. I have never ever logged in t…

Not in iOS. If they are using with webview or safariviewcontroller they can not access the browser cookies or data or most of device information.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#192

Post by greggman3 »

judge2020 wrote: post #67
nexuist wrote: post #62

Earlier quoted context omitted.

I don't want to live in a world where my parents and grandparents are expected to pull up Wireshark to figure out if the app they're using will record their front camera without consent. Blaming Zoom and FB is entirely acceptable here, it is their responsibility to keep my data private. Blaming Apple? Why, when Zoom is on the Play Store as well? https://play.google.com/store/apps/details?id=us.zoom.videom... >As long…

> Blaming Apple? Why, when Zoom is on the Play Store as well? Blame Apple because they constantly tout the iPhone as being "privacy respecting" and "what happens on your iPhone stays on your iPhone"[0], while they A. Apple doesn't default to "limit tracking", or at least make "limit tracking" an option on setup/iOS upgrade B. Apple doesn't penalize developers for using Facebook's SDK with auto data collection (ie. pu…

Agreed. Apps on iOS (IMO) should have to declare what domains they'll access and otherwise get no other network access with special exceptions for browsers and network tools. I hope Apple will prevent apps from seeing SSIDs. I also hope Apple will come up with some similar solution for bluetooth so that apps can only see the devices the user selects and not just scan for all devices.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#193

Post by krrrh »

xiphias2 wrote: post #41
dx87 wrote: post #27

It's good that they removed it, but it's also dissapointing that they had no idea that it was happening until someone made a blog post about it. Do their employees not vet any of the code they use, and just slap things together off the internet and hope it's not doing anything their users don't like?

It’s the official SDK of one of the biggest companies. I can’t fault them on not catching this. What Facebook does is ugly.

As a sometimes iOS developer, I can’t even imagine how you could build something like Zoom without at least sometimes auditing the network traffic. Even a novice user can do this in a few minutes with Charles Proxy.

People on the team knew, they just either didn’t care or were ignored when they voiced concerns.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#194

Post by m463 »

mikenew wrote: post #45

So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting ma…

Nice to see someone who gets it.

Apple gives you no way to find what your phone is doing, and no way to prevent it from doing it.

They provide company sponsored "controls" on what apps can do, which is about as useful as a factory alarm on a mid-80's car. Except with a modern twist, where they're the only ones capable of installing an alarm. (and imagine the alarm gives a free pass to apple)

The fact that they're starting in on MacOS and Little Snitch makes me think their platform isn't long for the world.

sigh. I do like arch linux.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#195

Post by m463 »

nexuist wrote: post #62
mikenew wrote: post #45

So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting ma…

I don't want to live in a world where my parents and grandparents are expected to pull up Wireshark to figure out if the app they're using will record their front camera without consent. Blaming Zoom and FB is entirely acceptable here, it is their responsibility to keep my data private. Blaming Apple? Why, when Zoom is on the Play Store as well? https://play.google.com/store/apps/details?id=us.zoom.videom... >As long…

> I don't want to live in a world where my parents and grandparents are expected to pull up Wireshark...

Their kids should be able to help.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#196

Post by greggman3 »

saagarjha wrote: post #90
diebeforei485 wrote: post #44

Earlier quoted context omitted.

On recent versions of iOS, in-app browsers do not share data with the Safari browser. How effective would browser fingerprinting be? Everyone with the same device, same language/locale and same timezone should have the same browser fingerprint, I thought.

> On recent versions of iOS, in-app browsers do not share data with the Safari browser. Specifically, SFSafariViewController does not share cookies or other data with Safari anymore. Some bad actors got caught with their hands in the cookie jar, literally, and out that sharing went.

The do still share something. In response to this headline I installed the Zoom app and picked to login with Facebook. A browser popped up showing the facebook webpage and said "Login as Gregg Tavares?". Since I just installed app how did Facebook know it was me? The only possibility that comes to mind is that Safari was using cookies from some other app's embedded webview.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#197

Post by Justice4Yall »

tyingq wrote: post #172
girvo wrote: post #161

Earlier quoted context omitted.

While I have zero love for any given hyper capitalistic business like Apple, Android is not any better on the whole in this space, and in some ways measurably worse (especially when you take into account what devices actually hold the largest market share)

This is true, but Apple touts how much better they are about Privacy, and charges a premium for it. Google is more up front that they make little money on the initial sale, and are dependent on advertising to make money.

> Privacy is built in from the beginning. Our products and features include innovative privacy technologies and techniques designed to minimize how much of your data we — or anyone else — can access

https://www.apple.com/privacy/features/

Apple sells privacy, brags about privacy - yet Privacy is abused in from the beginning in the store apps.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#199

Post by doctor_eval »

tyingq wrote: post #172
girvo wrote: post #161

Earlier quoted context omitted.

While I have zero love for any given hyper capitalistic business like Apple, Android is not any better on the whole in this space, and in some ways measurably worse (especially when you take into account what devices actually hold the largest market share)

This is true, but Apple touts how much better they are about Privacy, and charges a premium for it. Google is more up front that they make little money on the initial sale, and are dependent on advertising to make money.

No. Apple charged a premium well before they started talking about privacy.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#200

Post by spunker540 »

krrrh wrote: post #189
JMTQp8lwXL wrote: post #58

Earlier quoted context omitted.

Doesn't scale. We can't have 1,000,000 front page "App X uses Y SDK" posts. People will stop caring. Nobody's made a post of that flavor in awhile, and Zoom got caught in the crossfire. Honestly, if anything it shields other apps. People have a limited capacity for repeatedly addressing the same thing.

I pay $20 a month for Zoom and consider it a business product. Collecting analytics via Facebook is unacceptable in this context.

Would any cloud-hosted analytics be acceptable? Is it just Facebook that’s problematic? What if they switched from client-side analytics to server-side so you couldn’t detect it all? Would that be any better? The bottom line is when you use a service, that data is their data to send to whomever they want.
Post reply on HN