Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom’s Use of Facebook’s SDK in iOS Client

blog.zoom.us

Post reply on HN
Print view View original

261–270 of 272 posts

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#261

Post by type0 »

nh2 wrote: post #227
asutekku wrote: post #121

Earlier quoted context omitted.

As nice as it would be, auditing everything you use is almost impossible, especially for smaller teams.

Is this really a compelling argument for the given case? A detailed audit does not seem necessary here: This is not some surprising behaviour hidden in some random dependency. This is the Facebook SDK, from Facebook, and everybody knows what their business is.

> This is the Facebook SDK, from Facebook, and everybody knows what their business is.

Ignorance is a bliss. Talk to some people that still use fb after their scandal and you'll get "who cares, everyone is tracking users and selling data anyway" as an answer.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#262

Post by andrekandre »

sneak wrote: post #188
andrekandre wrote: post #184

Earlier quoted context omitted.

i wonder if apple configurator “filtering” profile [0] could be used?... [0] https://support.apple.com/en-is/guide/mdm/mdmc77c9609/1/web/... maybe some kind of automated little snitch settings ⇄ profile converter?

The problem is the lack of notification/visibility into what hosts to which the app is connecting. It’s possible that your solution might work for some small fraction of users, some of the time, for known spying hosts. Many people still want to access Facebook and Instagram, though.

yea... that seems the biggest problem for sure... i really hope apple builds in some mechanism for this soon

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#263

Post by ponsin »

Ericsyuan wrote: post #250

Dear all, I am the CEO of Zoom. First, I sincerely apologize about this Facebook SDK issue. We learned a lesson, and we will do all we can to improve. I also wrote a blog. https://blog.zoom.us/wordpress/2020/03/27/zoom-use-of-facebo... Please take care and be safe.

Hey, thank you for listening to security researchers and fixing a problem when you became aware. I know this is not so much a problem, but rather a business decision, but the product would be much more useable if it was possible to connect without the app without having to use some tricks. There have been many conferences that took much longer than expected to start because not everyone had Zoom

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#264

Post by shermozle »

judge2020 wrote: post #67
nexuist wrote: post #62

Earlier quoted context omitted.

I don't want to live in a world where my parents and grandparents are expected to pull up Wireshark to figure out if the app they're using will record their front camera without consent. Blaming Zoom and FB is entirely acceptable here, it is their responsibility to keep my data private. Blaming Apple? Why, when Zoom is on the Play Store as well? https://play.google.com/store/apps/details?id=us.zoom.videom... >As long…

> Blaming Apple? Why, when Zoom is on the Play Store as well? Blame Apple because they constantly tout the iPhone as being "privacy respecting" and "what happens on your iPhone stays on your iPhone"[0], while they A. Apple doesn't default to "limit tracking", or at least make "limit tracking" an option on setup/iOS upgrade B. Apple doesn't penalize developers for using Facebook's SDK with auto data collection (ie. pu…

Apple's browser is privacy respecting. The app universe is still the wild west. IDFA is terrifying because you can do out-of-band lookups with third parties and you'd NEVER KNOW. At least with cookies you can trace the information flows.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#265

Post by Ericsyuan »

ponsin wrote: post #263
Ericsyuan wrote: post #250

Dear all, I am the CEO of Zoom. First, I sincerely apologize about this Facebook SDK issue. We learned a lesson, and we will do all we can to improve. I also wrote a blog. https://blog.zoom.us/wordpress/2020/03/27/zoom-use-of-facebo... Please take care and be safe.

Hey, thank you for listening to security researchers and fixing a problem when you became aware. I know this is not so much a problem, but rather a business decision, but the product would be much more useable if it was possible to connect without the app without having to use some tricks. There have been many conferences that took much longer than expected to start because not everyone had Zoom

Dear Ponsin,

You are right on! To focus on our service stability and security are our top 2 priorities. We will work as hard as we can to keep improving. Thank you for your great support!

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#266

Post by cerberusss »

Zenbit_UX wrote: post #239
aaronbrager wrote: post #52

Earlier quoted context omitted.

You can pretty easily see all the traffic on your own phone. You can even do it on device https://apps.apple.com/us/app/charles-proxy/id1134218562

If you can set your own DNS on iOS why not just use something like nextDNS.io?

NextDNS is fantastic. I use it to block ads on my iPhones and iPads.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#267

Post by greggman3 »

codesternews wrote: post #191
greggman3 wrote: post #187

I'm happy the Zoom doesn't want to help Facebook spy on me. Unfortunately the chosen solution is still a privacy nightmare. Basically they let you login to Facebook via an in app browser. The problem is an app can spy on all activity of an in app browser. That means you have to trust that Zoom is not recording your facebook password as you type it in. We need a better system. Also scary. I have never ever logged in t…

Not in iOS. If they are using with webview or safariviewcontroller they can not access the browser cookies or data or most of device information.

Not true AFAICT. Given Chrome on iOS uses a webview and overrides all networking and given Firefox can inject JavaScript it seems trivial to use both of those features to spy on any webview activity

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#268

Post by neycoda »

mikenew wrote: post #45

So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting ma…

Steve Jobs made Apple about the user. Tim Cook is just leveraging that to make it all about the money.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#269

Post by LeoNatan25 »

saagarjha wrote: post #87
mikenew wrote: post #45

So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting ma…

> Getting mad at Zoom for using the Facebook SDK is missing the point. They and a million others are always going to be doing this. Get mad at Apple for not letting you wireshark your own iPhone. There’s plenty of anger to go around. Get mad all all three: Facebook for making an SDK that tracks you, Zoom for integrating it, and Apple for letting it through unencumbered.

Do you know what developer uproar there would be if Apple decided to block all Facebook SDK usage? Surely you know most anger will be targeted at Apple, rather than FB.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#270

Post by angry_octet »

exhilaration wrote: post #10
Executor wrote: post #9

Archive link to not give anti-white Vice ad money: https://web.archive.org/web/20200328020512/https://www.vice.... .

anti-white? can you explain?

I'll restate my comment: it's a racist troll.

Only on HN do your comments get flagged for calling out racism. So whoever you are, you're a racist too.

Post reply on HN