Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom’s Use of Facebook’s SDK in iOS Client

blog.zoom.us

Post reply on HN
Print view View original

201–210 of 272 posts

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#201

Post by krrrh »

kelnos wrote: post #79
gfodor wrote: post #28

Earlier quoted context omitted.

I guess this is another under-recognized benefit of developing for the web - when doing so, you're staring at the Network tab all day, trying to grok what's going on over the wire and to whom. I don't remember doing this nearly as much on native.

Yeah, that's the thing. I do very little web development, but I inevitably find myself in the Network tab of dev tools debugging something. I do around as little mobile (Android) development, and I'm not even really sure how I'd watch network traffic coming from an Android app. (I'm sure it's possible, but I imagine it requires explicit setup, possibly with some third-party software and/or the assistance of a laptop.…

mitmproxy or Charles proxy on your laptop. Charles proxy also has an iOS version, I imagine there is something similar that can run directly on Android.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#202

Post by generalpf »

greggman3 wrote: post #187

I'm happy the Zoom doesn't want to help Facebook spy on me. Unfortunately the chosen solution is still a privacy nightmare. Basically they let you login to Facebook via an in app browser. The problem is an app can spy on all activity of an in app browser. That means you have to trust that Zoom is not recording your facebook password as you type it in. We need a better system. Also scary. I have never ever logged in t…

If they’re using ASWebAuthenticationController you can’t read passwords. You can’t even see which URL they’re on.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#203

Post by windexh8er »

nexuist wrote: post #62
mikenew wrote: post #45

So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting ma…

I don't want to live in a world where my parents and grandparents are expected to pull up Wireshark to figure out if the app they're using will record their front camera without consent. Blaming Zoom and FB is entirely acceptable here, it is their responsibility to keep my data private. Blaming Apple? Why, when Zoom is on the Play Store as well? https://play.google.com/store/apps/details?id=us.zoom.videom... >As long…

>Surely there are open source video chat solutions already? They haven't taken off for one simple reason: video hosting is expensive. It's quite literally one of the most intensive network activities you can partake in, rivaling torrenting.

There are, as you state OSS solutions [0]. But the video hosting is not akin to Torrenting. Most people are fine with 720p quality video as you're not "watching" the participants like a movie. And as you scale up the number of users the required bandwidth for each subsequent user goes down in a linear fashion due to reduced screen real estate. A conference with 8 users, from a video perspective doesn't reasonably take up more bandwidth than that of 2 given the smaller stream. I am on almost constant conference meetings with 4-12 users, many times with video and I have a full packet monitoring solution at home and can tell you it's not remotely as intensive as you've claimed here.

[0] https://jitsi.org/jitsi-meet/

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#204

Post by _v7gu »

raverbashing wrote: post #163
judge2020 wrote: post #67

Earlier quoted context omitted.

> Blaming Apple? Why, when Zoom is on the Play Store as well? Blame Apple because they constantly tout the iPhone as being "privacy respecting" and "what happens on your iPhone stays on your iPhone"[0], while they A. Apple doesn't default to "limit tracking", or at least make "limit tracking" an option on setup/iOS upgrade B. Apple doesn't penalize developers for using Facebook's SDK with auto data collection (ie. pu…

It seems whoever is gathering that info and sending it is Facebook Blame them. Not Apple

You can't have a walled garden and not be responsible for the things that take place in it

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#205

Post by pixelrevision »

mikenew wrote: post #45

So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting ma…

Another problem is these analytics platforms just keep getting worse. There used to be a lot of effort put in to not collecting any personally identifiable info. Hell even google analytics was strict about that. It also took time to integrate them.

Now almost all the packages grab identifiable info by default and some are doing things like making screen recordings. Combine that with a rotating set of product owners like described above and a lot of apps just end up making way too many calls to way too many places.

And I do think Apple could and should be doing something more here. Their developer analytics setup is a good example to lead by as it gives users a global option to opt out. They also are able to reject apps for an icon being offbrand so I’m pretty sure they could figure out something here.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#206

Post by RKearney »

generalpf wrote: post #202
greggman3 wrote: post #187

I'm happy the Zoom doesn't want to help Facebook spy on me. Unfortunately the chosen solution is still a privacy nightmare. Basically they let you login to Facebook via an in app browser. The problem is an app can spy on all activity of an in app browser. That means you have to trust that Zoom is not recording your facebook password as you type it in. We need a better system. Also scary. I have never ever logged in t…

If they’re using ASWebAuthenticationController you can’t read passwords. You can’t even see which URL they’re on.

Is there a way for the end user to differentiate between that and a custom controller?

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#207

Post by pixelrevision »

aurbano wrote: post #104

What if mobile platforms (iOS, Android... ) changed the security/privacy policy so that apps had to request the “network access” permission, either whitelisting domains they want to talk to, or askingfor wildcard access? Most apps shouldn’t need wildcard access, and the mobile device could include a warning when an app does this teaching users that they should be careful with the app. This way at least when you insta…

This wouldn’t help much unfortunately. The company could just setup a proxy server to do the work that lives under their domain. A company like segment (which routes analytics to other platforms) could then offer personalized domains and make a killing as everyone throws everything there.

But there probably is some sort of good similar solution based on guidelines. If apple were to start defining policies on data collection and opt outs and say that apps needed to follow them or be rejected it would put a lot of pressure companies like Facebook to adhere to these guidelines in their sdks.

I don’t know if apple has the appetite for this as it would cause a whole lot of rewriting of a whole lot of code but they are in a great position to do this.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#208

Post by fortydegrees »

saagarjha wrote: post #87
mikenew wrote: post #45

So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting ma…

> Getting mad at Zoom for using the Facebook SDK is missing the point. They and a million others are always going to be doing this. Get mad at Apple for not letting you wireshark your own iPhone. There’s plenty of anger to go around. Get mad all all three: Facebook for making an SDK that tracks you, Zoom for integrating it, and Apple for letting it through unencumbered.

I can't tell if your comment is intentionally funny, but I got a good laugh out of it.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#209

Post by nothrabannosir »

dannyr wrote: post #182
nothrabannosir wrote: post #147

Earlier quoted context omitted.

This is unsustainable. It requires constant vigilance and turns the privacy matter into a cat and mouse game where we are constantly one step behind the worst actors. These systems exist everywhere in the world and they’re fundamentally inefficient. E.g. recycling, or “please bring your own plastic bag”, which relies on goodwill. Compare to a system where you fix the incentives to automatically align everyone’s inter…

> bottle deposits, or a small fee for plastic bags You know how these programs started? They started small. A few stores requiring them. Eventually, they become a law.

I guess your point is that fixing this one transgression is the equivalent of one store implementing that rule, and if we fix more of them eventually it’s a law, making it but the first step on the journey to sustainable privacy?

It isn’t. This is recycling one bottle. It doesn’t have any sustainable long lasting effect.

To stretch the metaphor, the equivalent of one store asking for deposits would be e.g. Apple requiring full disclosure of all such tracking SDKs on the App Store page, as suggested by someone else in this thread. That’s sustainable, scalable, and that’s what might eventually even lead to legislation, as you pointed out.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#210

Post by ababol »

>> we were made aware on Wednesday, March 25, 2020, that the Facebook SDK was collecting device information unnecessary

So Zoom is basically lying here

Come on, the developers who takes the responsibility to use the SDK were aware of it, ok maybe the CEO of Zoom or the market guy was not but the tech team is. They are not stupid.

You should have just apologise and assume your fault, that would be the courageous position, not denying it.

Tbh I am ok with Zoom sending my data to FB (I mean, in my case I've insta/messenger anyway) but not ok for Zoom taking everyone as naïve people with this lying statement.

Post reply on HN