Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom iOS app sends data to Facebook even if you don’t have a Facebook account

vice.com

Post reply on HN
Print view View original

311–320 of 375 posts

Re: Zoom iOS app sends data to Facebook even if you don’t have a Facebook account

#311

Post by dkersten »

godelski wrote: post #272
_cyrus wrote: post #205

Earlier quoted context omitted.

A user agent is not PII

What about a Unique Advertiser Identifier? What about a UAI with a name, phone number, phone model, GPS coordinates, and software version?

Had a briefing with our company lawyer a while back and any information can be considered PII when paired with other information. Eg that you bought 7 foo’s is not PII, but that you bought 7 foo’s on Tuesday might be if that can then be looked up in the purchase history and you were the only one who bought 7 on Tuesday.

Re: Zoom iOS app sends data to Facebook even if you don’t have a Facebook account

#312

Post by dmooney1 »

sizzle wrote: post #139
spitfire wrote: post #87

Earlier quoted context omitted.

IP address, telephone number, city and other identifying information is ALL considered PII. I work with (adjacent industry) HIPAA protected data, which is considered PII by virtue of knowing Bob Smith is in the system. If they're under a BAA and sending that information to Facebook they're in violation. If one of my sub-processors did this my lawyer would be livid. But hey, it's Silicon Valley, don't harsh their buzz…

How do you even report something this technical to non technical folks who oversee HIPAA? Would you have to do a case study style write up?

There are plenty of technical people overseeing HIPAA.

Re: Zoom iOS app sends data to Facebook even if you don’t have a Facebook account

#313

Post by pj1115 »

newscracker wrote: post #18
rvz wrote: post #10

Well everything that imports the Facebook SDK or allows sign in with Facebook does this so as long as an app has that blue button on the screen, you shouldn't be surprised that it will phone home to Facebook once the app is opened and initialised. Too bad it isn't practical to have a system-wide blacklist of selected hosts on iOS. Maybe you can but requires a jailbreak, but that too can break some apps.

There are some “VPN” apps that can stop connections system-wide. I’m not sure about custom block lists, but take a look at the free Lockdown app (it’s FOSS). It does all processing on-device. There’s also a paid app (which for me is an expensive subscription) called Guardian Firewall, which uses its servers to process requests.

If you 'supervise' your iPhone you can also configure an adblocker with a proxy auto-config. Less fiddly than a VPN but harder to customise! Supervising requires a wipe too. https://github.com/essandess/easylist-pac-privoxy

Re: Zoom iOS app sends data to Facebook even if you don’t have a Facebook account

#314

Post by type0 »

sizzle wrote: post #139
spitfire wrote: post #87

Earlier quoted context omitted.

IP address, telephone number, city and other identifying information is ALL considered PII. I work with (adjacent industry) HIPAA protected data, which is considered PII by virtue of knowing Bob Smith is in the system. If they're under a BAA and sending that information to Facebook they're in violation. If one of my sub-processors did this my lawyer would be livid. But hey, it's Silicon Valley, don't harsh their buzz…

How do you even report something this technical to non technical folks who oversee HIPAA? Would you have to do a case study style write up?

As if it's binary definition - technical and non technical, unless they're amish I don't see why it can't be reported in plain terms

Re: Zoom iOS app sends data to Facebook even if you don’t have a Facebook account

#315

Post by ChrisMarshallNY »

dylan604 wrote: post #239
ChrisMarshallNY wrote: post #196

Earlier quoted context omitted.

This is a good point. I have been an Apple developer for 34 years. If you know what that means, it means that I am a scarred, grizzled vet, with an eyepatch and a trick knee.

But do you have a gray beard and suspenders?

Nope. I do have grey hair, though.

Anyone who has been an Apple developer for more than a couple of decades, has had the experience of having the rug pulled out from under them by Apple.

That's one reason that I'm not hurrying to adopt SwiftUI. I really like it, and hope that it makes it (I despise Auto-Layout), but I have also seen other promising tech smothered in the crib (OpenDoc? QuickDrawGX?).

Re: Zoom iOS app sends data to Facebook even if you don’t have a Facebook account

#316

Post by tim1994 »

arielm wrote: post #101
somethoughts wrote: post #70

Earlier quoted context omitted.

Similar to how we have organizations which can certify whether produce is organic or not, we need organizations which can certify whether apps and websites are certified ad tracking free.

We (Appfigures) are scanning apps for SDKs so we know which trackers, analytics, location trackers apps are using. We’re working on a way to make that data accessible to app developers so they can learn from competitors, but having a simple way to tell if an app tracks you that doesn’t require signing up or anything like that could be an interesting idea. Would you actually check an app before downloading/using it?

There is another service that does this for Android apps:

https://reports.exodus-privacy.eu.org/en

It is also build into the Aurora Store (alternative Google Play Store client for Android).

Re: Zoom iOS app sends data to Facebook even if you don’t have a Facebook account

#317

Post by tim1994 »

Nextgrid wrote: post #107
arielm wrote: post #101

Earlier quoted context omitted.

We (Appfigures) are scanning apps for SDKs so we know which trackers, analytics, location trackers apps are using. We’re working on a way to make that data accessible to app developers so they can learn from competitors, but having a simple way to tell if an app tracks you that doesn’t require signing up or anything like that could be an interesting idea. Would you actually check an app before downloading/using it?

I am very shy of downloading apps because I expect most of them to stalk me or rat me out to Facebook and don't have the time to check for myself (by using Charles Proxy or Burp Suite). I would definitely appreciate it if there was a service that allows me to quickly check if an app is safe.

There is, Exodus Privacy (see my reply on the parent comment)

Re: Zoom iOS app sends data to Facebook even if you don’t have a Facebook account

#319

Post by mikorym »

saagarjha wrote: post #293
mikorym wrote: post #291

It's interesting how all the infosec experts are zooming in on Zoom and providing details that otherwise may have gone unnoticed for a long time.

Because a lot of people are using Zoom regularly?

Yes, due the lockdowns and quarantines.

Re: Zoom iOS app sends data to Facebook even if you don’t have a Facebook account

#320

Post by sneak »

conradev wrote: post #242
adam_fallon_ wrote: post #171

Earlier quoted context omitted.

One thing i'll note here as to a potential reason why they do this I just recently attempted to set up Facebook adverts for an app I developed. When it came time for me to set the metric up I obviously chose "App Installs" as my metric to track. To do this, Facebook told me I needed to install the Facebook SDK in my app to attribute an adverts conversion. I didn't end up running the ad, but I can see why companies po…

It is Zoom’s responsibility to list Facebook here: https://zoom.us/subprocessors Not sure why Vice called out the omission from the privacy policy – I’ve never seen one that actually lists all companies out by name. The GDPR mandates a list of subprocessors, though!

Listing this on their webpage doesn’t solve the spying problem.

“Well, at least they told us about it” is absolutely no solution to “so many of our tools are spying on us”.

Post reply on HN