Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom’s Use of Facebook’s SDK in iOS Client

blog.zoom.us

Post reply on HN
Print view View original

61–70 of 272 posts

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#61

Post by toomuchtodo »

mikenew wrote: post #59
intopieces wrote: post #55

Earlier quoted context omitted.

>Getting mad at Zoom for using the Facebook SDK is missing the point. It's really hard to believe this point given that... getting mad seems to have worked.

My point is that you've removed one instance of the Facebook SDK from your phone, but you still have 50 others. Plus probably hundreds of other analytics frameworks that you've never even heard of that are just as bad or worse.

A journey begins with a single step. As a community, we suss our and shame the rest into removal. If shame doesn’t work, those in California try using the CCPA.

We’re all stuck inside for a while, this is the perfect time to act. One app and SDK at a time.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#62

Post by nexuist »

mikenew wrote: post #45

So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting ma…

I don't want to live in a world where my parents and grandparents are expected to pull up Wireshark to figure out if the app they're using will record their front camera without consent.

Blaming Zoom and FB is entirely acceptable here, it is their responsibility to keep my data private.

Blaming Apple? Why, when Zoom is on the Play Store as well?

https://play.google.com/store/apps/details?id=us.zoom.videom...

>As long as you're running binary blobs that can make whatever network connections they please, people are going to take your data and send it to places you don't know about.

Surely there are open source video chat solutions already? They haven't taken off for one simple reason: video hosting is expensive. It's quite literally one of the most intensive network activities you can partake in, rivaling torrenting.

It doesn't make sense economically to offer a video hosting platform without collecting income from it. Nor does it make sense to attempt a peer-to-peer solution knowing full well that one laggy peer wrecks the experience for everyone else.

It's a very hard problem.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#64

Post by proactivesvcs »

ricardobeat wrote: post #21
proactivesvcs wrote: post #20

If Zoom "takes its users' privacy extremely seriously" and their "customers’ privacy is incredibly important" then why would they be releasing software without a strong knowledge of what third party code they're adding in, and what exfiltration might be happening as a result? They hold user privacy in such high regard and yet are releasing a program without even hooking it up to a network monitor for five minutes? So…

This is absolutely common. Business will require tracking/authentication/etc, contracts will be signed, developers will implement the provided SDK. Nobody will inspect the data being sent. > releasing a program without even hooking it up to a network monitor for five minutes How many times have you seen anyone do that? Unfortunately that is the reality - my personal take is to simply try to avoid vendor libraries at…

Oh I don't doubt the practice is common, but for an organisation making their claims about privacy it is at odds with their slapdash approach to development.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#65

Post by proactivesvcs »

holografix wrote: post #35
proactivesvcs wrote: post #20

If Zoom "takes its users' privacy extremely seriously" and their "customers’ privacy is incredibly important" then why would they be releasing software without a strong knowledge of what third party code they're adding in, and what exfiltration might be happening as a result? They hold user privacy in such high regard and yet are releasing a program without even hooking it up to a network monitor for five minutes? So…

I for one don’t think Zoom is being malicious here. I imagine plenty of other apps out there are doing the same right now, by naïvely making use of FBook’s SDK.

I don't yet have a comment on whether they acted maliciously by permitting user data to be exfiltrated to third parties without their permission, but to make categorical falsehoods about the importance they place on privacy is malicious in of itself.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#66

Post by jbigelow76 »

JMTQp8lwXL wrote: post #57
aaronbrager wrote: post #52

Earlier quoted context omitted.

You can pretty easily see all the traffic on your own phone. You can even do it on device https://apps.apple.com/us/app/charles-proxy/id1134218562

Seeing it != blocking it.

If you can see it you can make an informed choice if the tradeoff is worth it.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#67

Post by judge2020 »

nexuist wrote: post #62
mikenew wrote: post #45

So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting ma…

I don't want to live in a world where my parents and grandparents are expected to pull up Wireshark to figure out if the app they're using will record their front camera without consent. Blaming Zoom and FB is entirely acceptable here, it is their responsibility to keep my data private. Blaming Apple? Why, when Zoom is on the Play Store as well? https://play.google.com/store/apps/details?id=us.zoom.videom... >As long…

> Blaming Apple? Why, when Zoom is on the Play Store as well?

Blame Apple because they constantly tout the iPhone as being "privacy respecting" and "what happens on your iPhone stays on your iPhone"[0], while they

A. Apple doesn't default to "limit tracking", or at least make "limit tracking" an option on setup/iOS upgrade

B. Apple doesn't penalize developers for using Facebook's SDK with auto data collection (ie. punishment by having text like "sends data to: facebook, google, hotjar" on an app's install page)

C. Apple doesn't do any software stuff to limit and track the trackers. Having a counter for # of total days a domain name was contacted would be an eye-opener for many, and being able to toggle a "block" on the domain would be a big step forward.

Facebook meets the standard for being included in apps (respects the user resetting the usage ID), but that standard isn't the standard privacy-conscious users want. Apple can do better, but whether it be industry pressure or monetary pressure [google paying to be the default search engine], they don't actually put privacy first.

0: https://www.businessinsider.com/apples-ces-ad-las-vegas-misl...

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#68

Post by perfectstorm »

dx87 wrote: post #27

It's good that they removed it, but it's also dissapointing that they had no idea that it was happening until someone made a blog post about it. Do their employees not vet any of the code they use, and just slap things together off the internet and hope it's not doing anything their users don't like?

they can't see what happens inside FacebookSDK's code. even if they could see it, good luck convincing the PMs and directors to avoid implementing Facebook login.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#69

Post by marta_morena_23 »

mikenew wrote: post #45

So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting ma…

Baffling how this can be the top post...

"Who audits that?" We just did. And if there was a law against that, Zoom would just have been exposed for breaking it. Any sane company will try their best to adhere to laws. Some big players like Google can afford to mess around pay a few billions in fines, but those are the exceptions, not the rule. Eventually, even they can't afford to pay the fines in the long run (Even Google bowed to GDPR or at least its getting bashed with steeper fines until they wake up).

"How do you determine what's legal and what's not?" You pass a law, read the law? This is a self-contradiction. Laws are open for interpretation but the interpretation is quite clear after a supreme court case (for the better or worse).

"We should be pushing for a platform that makes it obvious what the software you're running is up to". Oh the web of trust? Did you ever install Snitch or some other firewall on your system? Its utterly hopeless even if you are knowledgeable. There is simply not way to audit that. Who audits that? Here you CAN ask this question.

I can't for the life of me understand how you can believe that it is better for everyone, including parents and grandparents to audit their phone, instead of having researchers audit phones and report companies who break the law. This is non-nonsensical. You must either be some expert without a connection to the real world, or some elitist who thinks everyone is like him.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#70

Post by yjftsjthsd-h »

nh2 wrote: post #56
pyt wrote: post #32

I contacted LG last month regarding their use of the Facebook SDK's automatic event collection in their ThinQ Android app. They responded and told me that they're disabling it in an upcoming release (incidentally, today's). If a single email is all it took to get a company with over $50 billion in revenue to disable Facebook's tracking in one of their apps, I really don't think that these companies are sharing data i…

> I don't think these companies are sharing data with Facebook intentionally. That would imply they are incompetent and negligent. Would one not expect large companies like LG to have internal security and privacy reviews of the software they publish, and know very well what they are doing? > What justification Their core business.

> That would imply they are incompetent and negligent.

I'm surprised that you consider that unlikely/surprising. Lots of companies act in technically incompetent ways all the time

Post reply on HN