Live data from Hacker News

Zoom’s Use of Facebook’s SDK in iOS Client

blog.zoom.us

241–250 of 272 posts

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#241
post #32

I contacted LG last month regarding their use of the Facebook SDK's automatic event collection in their ThinQ Android app. They responded and told me that they're disabling it in an upcoming release (incidentally, today's). If a single email is all it took to get a company with over $50 billion in revenue to disable Facebook's tracking in one of their apps, I really don't think that these companies are sharing data i…

[deleted]

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#242
post #62
post #45

So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting ma…

I don't want to live in a world where my parents and grandparents are expected to pull up Wireshark to figure out if the app they're using will record their front camera without consent. Blaming Zoom and FB is entirely acceptable here, it is their responsibility to keep my data private. Blaming Apple? Why, when Zoom is on the Play Store as well? https://play.google.com/store/apps/details?id=us.zoom.videom... >As long…

This whole Zoom revelation reminds me of the Cambridge Analytica scandal. This has been going on for a long time now, and it wasn't until one specific company did it that everyone is now concerned.

If you want to be creeped out, go to https://www.facebook.com/off_facebook_activity/ and find out how many apps have been quietly reporting all your usage activity to Facebook.

I have 100's of websites which managed to identify my Facebook account despite me logging into Facebook only in Incognito for the past 2 years.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#243

Earlier quoted context omitted.

> Do you really think they prepared a PR statement to respond to harsh criticism and just decided to toss in there the list of information sent without crafting the order of the items? Yes, because it's in alphabetical order. You don't have to craft anything for it to be in alphabetical order. You just put it in alphabetical order. The sorts of people who are going to read that list and understand any of it are the s…

> Yes, because it's in alphabetical order. > You don't have to craft anything for it to be in alphabetical order. > You just put it in alphabetical order. Again, if you get to choose the names, you get to choose the order.

Whatever happened to occam's razor?

Seriously, what is more likely, someone decided to nefariously re-order the list, possibly while laughing maniacally, or the list was just pulled and presented in alphabetical order?

HN commenters are just determined to turn everyone in to evil not-so-geniuses, refusing to recognise that almost everyone involved in this at Zoom are just like everyone else on HN.

They found a thing that did what they needed, an official SDK no less, and used it. They found out (in zoom's case via public crucifixion) that it was doing something nefarious they didn't like, and stopped using it.

But no, if HN is to be believed, they were collaborating with Facebook in some evil diabolical plan to take over the world via advertising.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#244
post #76

Earlier quoted context omitted.

If you can see it you can make an informed choice if the tradeoff is worth it.

If you can see it, but can't block it, then you've already lost a part of it before you can make that informed decision.

Of course you can block it, a private DNS with ad blocking is trivial to setup. Knowing about it is far important as you can make informed decisions.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#245
It seems that Facebook JS SDK also sends user behavior back to Facebook even when user doesn't click on the "Sign in with Facebook" button: https://simplelogin.io/blog/do-not-use-facebook-sdk/

On the Web, it's recommended to use a generic OAuth library instead of integrating Facebook JS SDK. On mobile, this is almost impossible though as Facebook doesn't implement the OAuth PKCE flow.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#246

Nice way to bury an innocuous "iOS Advertiser ID" in the middle of the list. What "iOS Advertiser ID" means is, to a very good degree of approximation, your deanonimized identity. Also, that just linking the SDK in your app deanonimzes the user to Facebook is very, very clear in its documentation. It's not like Zoom didn't notice until someone told them. They made a decision, and now they're changing it because they…

The Advertising Identifier is app-specific, and if Limit Ad Tracking is enabled, it is set to all zeros. So it's not accurate to say that it's "your deanonimized identity".

You are correct that users can disable it but incorrect to say it is app specific:

https://developer.apple.com/documentation/adsupport/asidenti...

You are thinking of “identifierForVendor”:

https://developer.apple.com/documentation/uikit/uidevice/162...

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#247
post #32

I contacted LG last month regarding their use of the Facebook SDK's automatic event collection in their ThinQ Android app. They responded and told me that they're disabling it in an upcoming release (incidentally, today's). If a single email is all it took to get a company with over $50 billion in revenue to disable Facebook's tracking in one of their apps, I really don't think that these companies are sharing data i…

news for you: it wasn’t your email that caused it. the change was already underway

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#248
post #62
post #45

So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting ma…

I don't want to live in a world where my parents and grandparents are expected to pull up Wireshark to figure out if the app they're using will record their front camera without consent. Blaming Zoom and FB is entirely acceptable here, it is their responsibility to keep my data private. Blaming Apple? Why, when Zoom is on the Play Store as well? https://play.google.com/store/apps/details?id=us.zoom.videom... >As long…

> I don't want to live in a world where my parents and grandparents are expected to pull up Wireshark to figure out if the app they're using will record their front camera without consent.

It's a "commons" issue. I don't necessarily trust FOSS software because I am going to login to the repo and check the code (though I have once or twice), I trust it because I know thousands of people motiviated by ethics and quality vs. money have peer reviewed the code for things like this.

Similar in concept to herd immunity.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#249
post #62

Earlier quoted context omitted.

I don't want to live in a world where my parents and grandparents are expected to pull up Wireshark to figure out if the app they're using will record their front camera without consent. Blaming Zoom and FB is entirely acceptable here, it is their responsibility to keep my data private. Blaming Apple? Why, when Zoom is on the Play Store as well? https://play.google.com/store/apps/details?id=us.zoom.videom... >As long…

Why not blame Facebook for being the most data hungry and privacy disrespecting for-profit entity ever known to man? (Google is tied for that spot, Microsoft close third) It‘s a little bit like blaming the person making the deal with the devil. Of course on some level they deserve blame for engaging with evil but evil presenting itself in a slick interface should also get its fair share.

Yes, Facebook deserves blame for automatically sending all those things to them, even if an app only wants to provide optional Facebook login for users who opt in.

However every app vendor by now should know that Facebook is hungry for data and careless use of Facebook software is to blame in them.

As is Apple (and Google) to blame for providing no privacy measures for users.

Post reply on HN