Hacker News Reader

Comment by julianozen | Hacker News Reader

To clarify, having just worked with the Facebook SDK library for my company's codebase, I dont think it is possible to setup the SDK without this happening. Disclaimer: I do not know what the FacebookSDK does after you call it's launch methods but I am pretty certain that they are required for a least some versions of the SDK.

If you are a Zoom user who is not using a Facebook account, I believe the only info Facebook is getting is that the Zoom app was launched and nothing about the user itself. Unfortunately the side-effect of using the FBSDK is that Facebook can track your app's usage for all users.

I believe this is true of all apps with a "Login in with Facebook" button. FWIW, it does not appear that other OAuth's do this (including Google's)

View on HN

FWIW, it's possible to use OAuth login without importing the SDK.

I did it on my last company's apps and webapps when we had to optimise for performance, and removed some dependencies.

Of course, now that I'm gone the SDK is back because one of the developers was bullish on using the SDKs at all costs (the webapp, for example, now loads FB, Google and Linkedin SDKs on launch).

This is a problem that we developers are creating.

This is a good idea. I will propose we do this

FWIW it looks like zoom did the same.

I imagine in an alternative universe that Snowden's book is about his time at Facebook.

Can't they fingerprint the device? The fact that Zoom was launched on a specific device is still a lot more information than I would be comfortable giving up if I don't use Facebook at all.

It looks like they are fingerprinting the device. Which means that if you have facebook but don't install the phone app, that your phone can be connected with your account and then you can be tracked across the web. There are also, of course, the facebook shadow accounts. Information connected with fingerprints, but not associated with a facebook account.

If they are it's against Apple's rules. Not sure what they are using to fingerprint anyways, given Apple has blocked access to the older system values that were being used.

> Not sure what they are using to fingerprint anyways

>> The Zoom app notifies Facebook when the user opens the app, details on the user's device such as the model, the time zone and city they are connecting from, which phone carrier they are using, __and a unique advertiser identifier__ created by the user's device which companies can use to target a user with advertisements

There are two identifiers: Identifier for Advertisers (IDFA) and Identifier for Vendors (IDFV).

IDFA is the same across all apps on a device. However, it can be reset by the user or disabled (in which case it returns all 0s). Also, apps have to disclose (to Apple) that they use the IDFA - not sure if that's visible to the user in the App Store anywhere.

IDFV is unique per vendor - that is, each app has a different ID, but two apps from the same developer will have the same ID. I believe this is also reset when resetting the device.

The FBSDK doesn't require developers to enable the IDFA, so the unique identifier in the phone home request is either the IDFV (effectively unique) or just a UUID that the FBSDK generates and stores on launch.

IIRC Apple made all device identifiers different between apps so it isn’t possible to do that.

Reply on news.ycombinator.com