Zoom’s Use of Facebook’s SDK in iOS Client

https://apps.apple.com/us/app/charles-proxy/id1134218562

It's really hard to believe this point given that... getting mad seems to have worked.

Blaming Zoom and FB is entirely acceptable here, it is their responsibility to keep my data private.

Blaming Apple? Why, when Zoom is on the Play Store as well?

https://play.google.com/store/apps/details?id=us.zoom.videom...

>As long as you're running binary blobs that can make whatever network connections they please, people are going to take your data and send it to places you don't know about.

Surely there are open source video chat solutions already? They haven't taken off for one simple reason: video hosting is expensive. It's quite literally one of the most intensive network activities you can partake in, rivaling torrenting.

It doesn't make sense economically to offer a video hosting platform without collecting income from it. Nor does it make sense to attempt a peer-to-peer solution knowing full well that one laggy peer wrecks the experience for everyone else.

It's a very hard problem.

"Who audits that?" We just did. And if there was a law against that, Zoom would just have been exposed for breaking it. Any sane company will try their best to adhere to laws. Some big players like Google can afford to mess around pay a few billions in fines, but those are the exceptions, not the rule. Eventually, even they can't afford to pay the fines in the long run (Even Google bowed to GDPR or at least its getting bashed with steeper fines until they wake up).

"How do you determine what's legal and what's not?" You pass a law, read the law? This is a self-contradiction. Laws are open for interpretation but the interpretation is quite clear after a supreme court case (for the better or worse).

"We should be pushing for a platform that makes it obvious what the software you're running is up to". Oh the web of trust? Did you ever install Snitch or some other firewall on your system? Its utterly hopeless even if you are knowledgeable. There is simply not way to audit that. Who audits that? Here you CAN ask this question.

I can't for the life of me understand how you can believe that it is better for everyone, including parents and grandparents to audit their phone, instead of having researchers audit phones and report companies who break the law. This is non-nonsensical. You must either be some expert without a connection to the real world, or some elitist who thinks everyone is like him.

There’s plenty of anger to go around. Get mad all all three: Facebook for making an SDK that tracks you, Zoom for integrating it, and Apple for letting it through unencumbered.

I’d like to see Apple launch their own telemetry/events framework, that users can examine the data from, and then cut off everyone else

But you’ve just said everyone does it and we shouldn’t get mad at them - so we don’t need wireshark, because it would simply confirm that everyone does it and we shouldn’t get mad at them - right?

edit: some people won't want to give them any slack because they committed the offenses in the first place, but I think that's silly. Reward them for trying, because if this is the way they're going to respond to blowing it, they're one of the good guys.

PWAs could answer this problem, at least to some extent, but Apple historically has been limiting the features to protect the AppStore and the Apple Tax (v. the recent local persistence changes in ITP).

It's better than, say, Google pretending that third-party cookies make the web a safer place (yup, that happened).

(Don't get me wrong, I think ITP and Safari are great)

> Get mad at Apple for not letting you wireshark your own iPhone.

People on HN can, but an average user shouldn't have to care about that. I'm 100% up for stronger legislative measures (both tech and dark UX patterns) and more education in this area. Sounds boring, but without it we'll just keep running in circles.

This is not true and even if it was true it is an extremely lame argument. You can justify pretty much everything with this logic.

That's a tiny proportion of the user population and doesn't imply agreement or consent to the information the Facebook SDK shares. And even if it it did, it wouldn't automatically mean that it's an acceptable or good behaviour by those apps and Facebook.

Bringing widely-distributed privacy breaches to a wider audience's attention can help those users provide feedback regarding products and then allow them to select vendors who respect their values.

Regarding the issue that started this Zoom-FB dialogue I have commented a dozen (or more) times on the necessity to have a firewalled phone that a user (unfortunately the user needs to have basic knowledge of firewall admin) can decide what to allow and what to block. Your point on who audits is valid (I am a CISA and CISM of many years), and, well, nobody does. Each user will have to do his/her own work/effort to keep their family clear of these scum.

Apple gives you no way to find what your phone is doing, and no way to prevent it from doing it.

They provide company sponsored "controls" on what apps can do, which is about as useful as a factory alarm on a mid-80's car. Except with a modern twist, where they're the only ones capable of installing an alarm. (and imagine the alarm gives a free pass to apple)

The fact that they're starting in on MacOS and Little Snitch makes me think their platform isn't long for the world.

sigh. I do like arch linux.

Now almost all the packages grab identifiable info by default and some are doing things like making screen recordings. Combine that with a rotating set of product owners like described above and a lot of apps just end up making way too many calls to way too many places.

And I do think Apple could and should be doing something more here. Their developer analytics setup is a good example to lead by as it gives users a global option to opt out. They also are able to reject apps for an icon being offbrand so I’m pretty sure they could figure out something here.

That would imply they are incompetent and negligent.

Would one not expect large companies like LG to have internal security and privacy reviews of the software they publish, and know very well what they are doing?

> What justification

Their core business.

Now you need to log in via Facebook with a separate browser window, and thanks to the HTTP change, you need to click on a browser dialog to launch a meeting from a link. So, they've either changed their policy to err more towards the privacy side and haven't found all the cases yet, or, more likely, still have the same attitude except when the tech world starts screaming at them.

"It's good that they removed it, and it goes to show just how important it is to inspect your application's wire traffic as part of your development and testing processes. Otherwise you'll have no idea what's happening until someone makes a blog post about it."

That sounds like a pretty accurate description of how software is built. (No, I'm not being flippant.)

> ... and hope it's not doing anything their users don't like?

I expect most don't think too much about it, not out of malice, but because their product manager told them "I want FB login" and to do that, they either spend an afternoon using the FB SDK, or spend a week figuring out how it works, implementing it from scratch themselves, and debugging the inevitable interop issues with whatever oauth2 (or whatever) library they've picked. It's really a no-brainer... few developers can take the week-long route and then justify that to their manager. They'll get fired.

So they don't know what they're doing? Really? How does that defense go in criminal trials?

They took prompt action because they were attacked so much over this.

But there probably is some sort of good similar solution based on guidelines. If apple were to start defining policies on data collection and opt outs and say that apps needed to follow them or be rejected it would put a lot of pressure companies like Facebook to adhere to these guidelines in their sdks.

I don’t know if apple has the appetite for this as it would cause a whole lot of rewriting of a whole lot of code but they are in a great position to do this.

Since they removed the Facebook SDK entirely, whatever mechanism Facebook used to collect the info doesn’t exist any more. Instead of being able to collect the data at all times, wouldn’t FB only have a vector to do so through web login? At that point, I assume they could do fingerprinting in the browser to collect some info, but at least the cannot do it on the system level any more.

It still seems like this is a big improvement. Though, I imagine most folks will have at least one other app using the FB SDK, so it’s not like the root cause is fixed.

> releasing a program without even hooking it up to a network monitor for five minutes

How many times have you seen anyone do that? Unfortunately that is the reality - my personal take is to simply try to avoid vendor libraries at all costs, but it's hard to sell.

If the defense is the practice being common then there isn't anything special about Zoom regarding user privacy, is it.

> Motherboard downloaded the update and verified that it does not send data to Facebook upon opening.

Edit: Fixing mental hiccup, nothing to see here.

It sounds like this they're just no longer flat out using the Facebook SDK (which provides a slightly more "native" / "nicer" login flow for apps when used). They're going to do what most (at least, from personal experience) apps do and just show a webview with a redirect back into the app, which doesn't call out to Facebook at all.

EDIT: That is, it doesn't call out to Facebook at all until you start the login flow, which is just opening a browser view to the oauth2 flows..

For me this would be much stranger at a tiny company.

There seem to be some legitimate concerns about privacy worth discussing further but I'm not sure this is one of them.

I can't see why Zoom can't come out with a statement regarding why they are collecting all of this sensitive data.

Big corporations might be sharing stuff unwittingly with people that they don't want to share it with.

https://www.sec.gov/Archives/edgar/data/1585521/000119312519...

Top of page 21 in their SEC filing:

"In addition, we have a high concentration of research and development personnel in China, which could expose us to market scrutiny regarding the integrity of our solution or data security features. Any security compromise in our industry, whether actual or perceived, could harm our reputation, erode confidence in the effectiveness of our security measures, negatively affect our ability to attract new customers and hosts, cause existing customers to elect not to renew their subscriptions or subject us to third-party lawsuits, regulatory fines or other action or liability, which could harm our business."