Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom iOS app sends data to Facebook even if you don’t have a Facebook account

vice.com

Post reply on HN
Print view View original

351–360 of 375 posts

Re: Zoom iOS app sends data to Facebook even if you don’t have a Facebook account

#351

Post by Spooky23 »

r-w wrote: post #302
Spooky23 wrote: post #220

Earlier quoted context omitted.

That’s bullshit. The federal government is able to produce a lot of useful technical regulation and guidance. Hell the whole infosec policy framework used everywhere is built off of NIST 800-53.

I’m pretty sure NIST has more engineers than politicians. The same cannot be said of Congress.

Congress would write a law with general objectives, and leave the regulatory work to an exec branch agency. The regulations generally either reference or draw inspiration from NIST.

HHS uses NIST stuff to guide HIPPA. IRS is more prescriptive, but everything in IRS 1075 is still based on NIST stuff.

You have to separate the political puffery from reality. The Federal government is very good at establishing effective regulatory frameworks. They fall down with the long-term maintenance of regulations, as it's often difficult to keep the legal mandate up to date.

Re: Zoom iOS app sends data to Facebook even if you don’t have a Facebook account

#352

Post by elliekelly »

mikebonnell wrote: post #332
elliekelly wrote: post #330

Earlier quoted context omitted.

GitHub’s privacy policy is exceptional. Particularly the section on sub-processors[1] where they list out every company, don’t have any sort of CYA language that covers others that might not be listed, and make a commitment to update that page every time the sub-processors or the sub-processor’s function changes. [1] https://help.github.com/en/github/site-policy/github-subproc...

Corrected link: https://help.github.com/en/github/site-policy/github-subproc... (original has an extra s on the end)

Thank you!

Re: Zoom iOS app sends data to Facebook even if you don’t have a Facebook account

#353

Post by thebean11 »

catacombs wrote: post #335
adam_fallon_ wrote: post #171

Earlier quoted context omitted.

One thing i'll note here as to a potential reason why they do this I just recently attempted to set up Facebook adverts for an app I developed. When it came time for me to set the metric up I obviously chose "App Installs" as my metric to track. To do this, Facebook told me I needed to install the Facebook SDK in my app to attribute an adverts conversion. I didn't end up running the ad, but I can see why companies po…

> I just recently attempted to set up Facebook adverts for an app I developed. Stop giving Facebook your money. Surely there are other places to promote your app.

Sure but they probably all have a worse ROI

Re: Zoom iOS app sends data to Facebook even if you don’t have a Facebook account

#354

Post by AnthonyMouse »

URSpider94 wrote: post #292
AnthonyMouse wrote: post #93

Earlier quoted context omitted.

You're now talking about a different section of the same act. There are some separate provisions in there to fight insurance fraud, but that doesn't really have a lot to do with privacy for medical records, except to the extent that having somebody else's medical records might make it easier to commit insurance fraud against their insurance policy.

The quote explicitly says that the act covers “how PII ... should be protected from fraud and theft.” HIPAA is ostensibly about protecting patient privacy and data. It’s certainly possible that the insurance industry went along with it because they figured it would help them keep their patient data proprietary, but that most certainly wasn’t the goal of the legislation.

What do you think "fraud and theft" mean in this context? Sick people aren't great fraud targets, they're frequently unable to work and have already lost what money they had to medical bills. The "fraud" is insurance fraud, for which the PII would be things like your name and policy number (i.e. what's needed to file a fraudulent claim against your policy) rather than your actual medical records. And the parties most interested in having access your medical records are the insurance companies themselves, as already mentioned. There is a fairly large financial incentive for a shady insurance company to use patient medical records to poach low risk patients.

Re: Zoom iOS app sends data to Facebook even if you don’t have a Facebook account

#356

Post by munk-a »

shermozle wrote: post #276
leggomylibro wrote: post #19

Earlier quoted context omitted.

It's past time for us to get serious and apply HIPAA-style protection to the storage and transmission of PII, without exemptions. Companies like Facebook will complain loudly that they won't be able to survive, but that is not our problem. If we pass legislation with teeth, they will need to change their business model. That would be the point.

They're not sending your name and address. They're sending the IDFA, device ID, of your device to Facebook. The fact that Facebook can link that device ID to your identity is on YOU. You logged into Facebook in their app to make that connection.

This uses unnecessarily accusatory wording. But it is also both unhelpful and just flat out wrong - Facebook gets data fed from a lot of sources - it can start stitching up that data into a picture of you without you ever creating a Facebook account.

Re: Zoom iOS app sends data to Facebook even if you don’t have a Facebook account

#358

Post by ccorcos »

I did a study of which applications use Facebook advertising tracking and was really surprised to see how many products have it. Here's a sample:

- airtable - asana - atlassian - bear - stripe - slack - loggly - tandem - pagerduty - figma - circleci - evernote - airbnb

Apparently if you want to advertise on the internet, Facebook Ads are the way to go. I figure there's enough information to tune in their machine learning just by knowing if a user clicked an ad, but once you see how much information they gather, it starts to make more sense. For example, they send the document.title every time you navigate -- that's often sensitive information! So the more "responsible" companies embed all the facebook tracking scripts inside an iframe and interact with it via postMessage.

Re: Zoom iOS app sends data to Facebook even if you don’t have a Facebook account

#359

Post by rochak »

bosswipe wrote: post #68

In my experience developers that integrate the FB SDK into their apps just copy-paste whatever code snippet Facebook tells them to do, which is always maximum data capture, without thinking of any of the implications. There's usually a way to limit data leakage while using the minimum FB functionality you want, such as only using FB for login without sending every damn app event to Facebook.

How is this not reviewed by other developers who might not be as negligent as the one who just copied the code?

Re: Zoom iOS app sends data to Facebook even if you don’t have a Facebook account

#360

Post by rochak »

ryandrake wrote: post #40
Daniel_sk wrote: post #23

A lot of apps are doing it without the developers even knowing about (ask me how I know). You just integrate their SDK for social login or something else and it will start sending data to the mothership.

This is one of the reasons why you are supposed to audit your dependencies and understand what they do. There is no excuse for an app developer to ship their app and not know what it does.

Exactly. It pains me to see so many developers just going with the flow and not exercising critical thinking to decide what all they need to do before and bringing a dependency.
Post reply on HN