231–240 of 272 posts
Earlier quoted context omitted.
> I suppose you could argue that's negligent, but if that's the case, then pretty much every company that has an app with login functionality is probably in that boat. I think every company that does this is negligent. Audit your dependencies, people!
As nice as it would be, auditing everything you use is almost impossible, especially for smaller teams.
Earlier quoted context omitted.
See, one way I often solve this is by reducing my reliance on third-party dependencies.
Which is also a hard thing to do on small teams. I think for small teams this is a near impossible task. For big corporations it should be doable and expected. They actually have some leverage to push the other big companies to track less. Something a small company simply can't do.
So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting ma…
Earlier quoted context omitted.
It seems whoever is gathering that info and sending it is Facebook Blame them. Not Apple
You can't have a walled garden and not be responsible for the things that take place in it
Earlier quoted context omitted.
>Getting mad at Zoom for using the Facebook SDK is missing the point. It's really hard to believe this point given that... getting mad seems to have worked.
My point is that you've removed one instance of the Facebook SDK from your phone, but you still have 50 others. Plus probably hundreds of other analytics frameworks that you've never even heard of that are just as bad or worse.
If California and the EU get wind of this, they may also give Facebook a gentle nudge.
That'll get Facebook to remove it fairly quickly, or at least stop triggering it in the background without user initiation.
Earlier quoted context omitted.
As nice as it would be, auditing everything you use is almost impossible, especially for smaller teams.
Is this really a compelling argument for the given case? A detailed audit does not seem necessary here: This is not some surprising behaviour hidden in some random dependency. This is the Facebook SDK, from Facebook, and everybody knows what their business is.
So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting ma…
You can pretty easily see all the traffic on your own phone. You can even do it on device https://apps.apple.com/us/app/charles-proxy/id1134218562
Earlier quoted context omitted.
> On recent versions of iOS, in-app browsers do not share data with the Safari browser. Specifically, SFSafariViewController does not share cookies or other data with Safari anymore. Some bad actors got caught with their hands in the cookie jar, literally, and out that sharing went.
The do still share something. In response to this headline I installed the Zoom app and picked to login with Facebook. A browser popped up showing the facebook webpage and said "Login as Gregg Tavares?". Since I just installed app how did Facebook know it was me? The only possibility that comes to mind is that Safari was using cookies from some other app's embedded webview.