8 ms·

EVERY. SINGLE. APP. THAT. INCLUDES. THE. FACEBOOK. SDK. Even if you don't log in. The Facebook SDK sends data back. Hook your device up to an intercepting pro

by st3fan 7y ago

EVERY. SINGLE. APP. THAT. INCLUDES. THE. FACEBOOK. SDK. Even if you don't log in. The Facebook SDK sends data back. Hook your device up to an intercepting proxy and start up a few apps. 99% of them do this. I really wish Apple would put an end to this.

tdstein 7y ago
This! It isn't just Zoom. It's a known "feature" of the Facebook SDK.
- toomuchtodo 7y ago
  Can Apple be held liable by the CCPA as they are a reviewer with a gating process for iOS apps, allowing the Facebook SDK to be included?
  - idoh 7y ago
    That would be quite a stretch of the CCPA. The businesses that are doing the collecting have to have to comply. In this case, Apple isn't collecting that info.
    - toomuchtodo 7y ago
      Likely, simply curious if questioning Apple about it is enough for them to nuke the Facebook SDK from further app inclusion at the review process. Privacy is their whole marketing schtick, no? [1] If it's a core value, stand up for it. [1] https://www.apple.com/privacy/ https://www.apple.com/privacy/ ("Privacy is a fundamental human right. At Apple, it’s also one of our core values. Your devices are important to so many parts of your life. What you share from those experiences, and who you share it with, should be up to you. We design Apple products to protect your privacy and give you control over your information. It’s not always easy. But that’s the kind of innovation we believe in.")
      - gingerlime 7y ago
        It’s a facade. Apple has its own advertising ID and it’s on by default even though it’s quite clearly (imho) in violation of the GDPR. https://blog.gingerlime.com/2020/does-apple-care-about-your-privacy/ https://blog.gingerlime.com/2020/does-apple-care-about-your-...
- cloverich 7y ago
  I would wager some or most developers do not realize that when they add a login with Facebook button, they are also sending analytics data for _all_ users to Facebook. It is, imho, a very dark pattern.
ChrisMarshallNY 7y ago
If they did, it would raise a ruckus. There's a lot of developers that rely on these dependencies, and just blocking them would cause a major backlash.
- ChrisMarshallNY 7y ago
  I'm wondering why this post was so unpopular. It wasn't meant to be offensive or judgmental, in any way at all.
  - ipsum2 7y ago
    Some people on Hacker News hate Facebook so much, that they downvote factual information if it doesn't fit with their views.
  - AnthonyMouse 7y ago
    It's because Apple is one of the largest companies in the world and can survive a "backlash" much to the chagrin of small developers already subject to their mercurial policies. So the idea that that's what's stopping them doesn't really mesh with the reality that if it was, it would be stopping them from doing half the things they already do.
    - ChrisMarshallNY 7y ago
      This is a good point. I have been an Apple developer for 34 years. If you know what that means, it means that I am a scarred, grizzled vet, with an eyepatch and a trick knee.
      - dylan604 7y ago
        But do you have a gray beard and suspenders?
        ChrisMarshallNY 7y ago
        Nope. I do have grey hair, though. Anyone who has been an Apple developer for more than a couple of decades, has had the experience of having the rug pulled out from under them by Apple. That's one reason that I'm not hurrying to adopt SwiftUI. I really like it, and hope that it makes it (I despise Auto-Layout), but I have also seen other promising tech smothered in the crib (OpenDoc? QuickDrawGX?).
pergadad 7y ago
Is this automatically part of any app using react/react native?
- lacker 7y ago
  No. React and React Native are totally separate from the Facebook SDK.
mpclark 7y ago
I’m surprised Zoom is happy for Facebook to know exactly who its customers are. This is information that could be used against the company at some point, for example if FB made a video conferencing play.
- Rainymood 7y ago
  I don't think many people want to mix their professional with their personal (facebook). Doesn't facebook have this "Facebook at work thing" that no one uses?
- deleted 7y ago
  [deleted]
- badwolf 7y ago
  Zoom uses Facebook login. Zoom also buys ads on Facebook, so integrates the SDK for attribution.
- duxup 7y ago
  A lot of companies had data sharing deals with Facebook, I assume they get something out of it themselves.
AnthonyMouse 7y ago
> I really wish Apple would put an end to this. This is what really gives lie to the whole walled garden thing. Its selling point is supposed to be in Apple preventing things like this, but here we are in reality and they don't. Meanwhile they do e.g. prevent Signal from replacing Apple's default app for SMS, which has no purpose other than to create barriers for cross-platform competitors to the default apps.
- Polylactic_acid 7y ago
  Its incredible how blocking changing the default app on iOS isn't illegal. Its obviously insanely anti competitive.
  - Phlarp 7y ago
    It's like people forget "the bar" for anti-trust action used to be bundling the default app (web browser) with the OS (windows)
    - yborg 7y ago
      You're forgetting the 90% market share part.
      - AnthonyMouse 7y ago
        Apple doesn't have >90% market share for iOS app stores? Who is their competition? You can't run an Android app on iOS. There are no iOS apps on Amazon or Google Play. That makes it a separate market.
        deleted 7y ago
        [deleted]
        madeofpalk 7y ago
        100% market share of your own market doesn't really count.
yellow_postit 7y ago
This is equivalent to including Google Analytics or any 3P analytics platform.
golergka 7y ago
As an app developer, I think that I've done "Facebook SDK integration" task over 10 times at the very least. I don't think I'm the only one. It's unrealistic to expect a mobile app not to offer a user the option to login through Facebook. And yet, we don't need to integrate Facebook's binary blobs to use this SDK's main features. How about we implement the open version of Facebook SDK that uses their APIs but doesn't do anything that we don't want it to?
- Nextgrid 7y ago
  I'm certain you can implement Facebook login through standard OAuth and not have to rely on any of their code.
megablast 7y ago
Can't apps start up the facebook SDK after someone has clicked the facebook login button? If someone has already logged in with facebook, set a flag in NSUserDefaults, and start the sdk then.
- Nextgrid 7y ago
  I'm pretty sure they can (though another comment states the opposite and might be right), and I'm definitely sure they can even implement the whole Facebook login through standard OAuth without using any of Facebook's code. They choose not to because 1) it's easier and 2) Facebook gives them a "cut" of the revenue in the form of free analytics and insights into how their Facebook ads are performing. The companies decided that the value they get out of Facebook ads & analytics are worth more than their customers' privacy. Until well-enforced regulations come into play (so not the GDPR) nothing will change.
kube-system 7y ago
Tons of websites do this as well
leipert 7y ago
This was presented at the 36C3 last year: https://media.ccc.de/v/36c3-10693-no_body_s_business_but_mine_a_dive_into_menstruation_apps https://media.ccc.de/v/36c3-10693-no_body_s_business_but_min... I assume a lot of people just “slap” the SDK in there and call it a day and it starts sending data.
wideasleep1 7y ago
Examples on Android for 'an intercepting proxy' are No Root Firewall, and even better, the paid/donate version of Netguard, which allows you to permanently kill these errant calls. Additionally, you can disable Google Services Framework with it too, if you'd like to try running your Android without Google tethered and watching, while you enjoy sweet, well-designed FOSS apps and services.
ladfjkl 7y ago
Has anyone tried the Lockdown app? https://9to5mac.com/2019/07/24/lockdown-ios-firewall-open-source/ https://9to5mac.com/2019/07/24/lockdown-ios-firewall-open-so... It looks promising, and has been posted to HN a few times, but nobody has commented on it. https://news.ycombinator.com/item?id=20519456 https://news.ycombinator.com/item?id=20519456
- ktta 7y ago
  There's also Guardian Firewall, which is built (or atleast started by) a well known iOS jailbreaker https://9to5mac.com/2019/08/05/guardian-firewall-vpn-ios-app/ https://9to5mac.com/2019/08/05/guardian-firewall-vpn-ios-app...
ozmbie 7y ago
I would love if Apple started treating app analytics like they do my GPS location or my camera permissions. Basically, if apps want to send analytics, they must go through an iOS API. Then as a user, I can inspect what apps are sending and how frequently. I should be able to block requests or set myself as anonymous. Or allow apps for certain amounts of time etc.
qserasera 7y ago
Thank you st3fan. I will reference your comment in the future.
ElectrodesD 7y ago
Apple isn't interested in that as well as most of the corporations out there. Data is one of the most valuable assets and this is easy cash flow.
arendtio 7y ago
Apple is busy deleting localStorage data from PWA users... For those who did not read about it: https://andregarzia.com/2020/03/private-client-side-only-pwas-are-hard-but-now-apple-made-them-impossible.html https://andregarzia.com/2020/03/private-client-side-only-pwa...

by st3fan 7y ago

tdstein 7y ago

This! It isn't just Zoom. It's a known "feature" of the Facebook SDK.

toomuchtodo 7y ago
Can Apple be held liable by the CCPA as they are a reviewer with a gating process for iOS apps, allowing the Facebook SDK to be included?
- idoh 7y ago
  That would be quite a stretch of the CCPA. The businesses that are doing the collecting have to have to comply. In this case, Apple isn't collecting that info.
  - toomuchtodo 7y ago
    Likely, simply curious if questioning Apple about it is enough for them to nuke the Facebook SDK from further app inclusion at the review process. Privacy is their whole marketing schtick, no? [1] If it's a core value, stand up for it. [1] https://www.apple.com/privacy/ https://www.apple.com/privacy/ ("Privacy is a fundamental human right. At Apple, it’s also one of our core values. Your devices are important to so many parts of your life. What you share from those experiences, and who you share it with, should be up to you. We design Apple products to protect your privacy and give you control over your information. It’s not always easy. But that’s the kind of innovation we believe in.")
    - gingerlime 7y ago
      It’s a facade. Apple has its own advertising ID and it’s on by default even though it’s quite clearly (imho) in violation of the GDPR. https://blog.gingerlime.com/2020/does-apple-care-about-your-privacy/ https://blog.gingerlime.com/2020/does-apple-care-about-your-...
cloverich 7y ago
I would wager some or most developers do not realize that when they add a login with Facebook button, they are also sending analytics data for _all_ users to Facebook. It is, imho, a very dark pattern.

ChrisMarshallNY 7y ago

If they did, it would raise a ruckus. There's a lot of developers that rely on these dependencies, and just blocking them would cause a major backlash.

ChrisMarshallNY 7y ago
I'm wondering why this post was so unpopular. It wasn't meant to be offensive or judgmental, in any way at all.
- ipsum2 7y ago
  Some people on Hacker News hate Facebook so much, that they downvote factual information if it doesn't fit with their views.
- AnthonyMouse 7y ago
  It's because Apple is one of the largest companies in the world and can survive a "backlash" much to the chagrin of small developers already subject to their mercurial policies. So the idea that that's what's stopping them doesn't really mesh with the reality that if it was, it would be stopping them from doing half the things they already do.
  - ChrisMarshallNY 7y ago
    This is a good point. I have been an Apple developer for 34 years. If you know what that means, it means that I am a scarred, grizzled vet, with an eyepatch and a trick knee.
    - dylan604 7y ago
      But do you have a gray beard and suspenders?
      - ChrisMarshallNY 7y ago
        Nope. I do have grey hair, though. Anyone who has been an Apple developer for more than a couple of decades, has had the experience of having the rug pulled out from under them by Apple. That's one reason that I'm not hurrying to adopt SwiftUI. I really like it, and hope that it makes it (I despise Auto-Layout), but I have also seen other promising tech smothered in the crib (OpenDoc? QuickDrawGX?).

pergadad 7y ago

Is this automatically part of any app using react/react native?

lacker 7y ago
No. React and React Native are totally separate from the Facebook SDK.

mpclark 7y ago

I’m surprised Zoom is happy for Facebook to know exactly who its customers are. This is information that could be used against the company at some point, for example if FB made a video conferencing play.

Rainymood 7y ago
I don't think many people want to mix their professional with their personal (facebook). Doesn't facebook have this "Facebook at work thing" that no one uses?
deleted 7y ago
[deleted]
badwolf 7y ago
Zoom uses Facebook login. Zoom also buys ads on Facebook, so integrates the SDK for attribution.
duxup 7y ago
A lot of companies had data sharing deals with Facebook, I assume they get something out of it themselves.

AnthonyMouse 7y ago

> I really wish Apple would put an end to this. This is what really gives lie to the whole walled garden thing. Its selling point is supposed to be in Apple preventing things like this, but here we are in reality and they don't. Meanwhile they do e.g. prevent Signal from replacing Apple's default app for SMS, which has no purpose other than to create barriers for cross-platform competitors to the default apps.

Polylactic_acid 7y ago
Its incredible how blocking changing the default app on iOS isn't illegal. Its obviously insanely anti competitive.
- Phlarp 7y ago
  It's like people forget "the bar" for anti-trust action used to be bundling the default app (web browser) with the OS (windows)
  - yborg 7y ago
    You're forgetting the 90% market share part.
    - AnthonyMouse 7y ago
      Apple doesn't have >90% market share for iOS app stores? Who is their competition? You can't run an Android app on iOS. There are no iOS apps on Amazon or Google Play. That makes it a separate market.
      - deleted 7y ago
        [deleted]
      - madeofpalk 7y ago
        100% market share of your own market doesn't really count.

yellow_postit 7y ago

This is equivalent to including Google Analytics or any 3P analytics platform.

golergka 7y ago

As an app developer, I think that I've done "Facebook SDK integration" task over 10 times at the very least. I don't think I'm the only one. It's unrealistic to expect a mobile app not to offer a user the option to login through Facebook. And yet, we don't need to integrate Facebook's binary blobs to use this SDK's main features. How about we implement the open version of Facebook SDK that uses their APIs but doesn't do anything that we don't want it to?

Nextgrid 7y ago
I'm certain you can implement Facebook login through standard OAuth and not have to rely on any of their code.

megablast 7y ago

Can't apps start up the facebook SDK after someone has clicked the facebook login button? If someone has already logged in with facebook, set a flag in NSUserDefaults, and start the sdk then.

Nextgrid 7y ago
I'm pretty sure they can (though another comment states the opposite and might be right), and I'm definitely sure they can even implement the whole Facebook login through standard OAuth without using any of Facebook's code. They choose not to because 1) it's easier and 2) Facebook gives them a "cut" of the revenue in the form of free analytics and insights into how their Facebook ads are performing. The companies decided that the value they get out of Facebook ads & analytics are worth more than their customers' privacy. Until well-enforced regulations come into play (so not the GDPR) nothing will change.

kube-system 7y ago

Tons of websites do this as well

leipert 7y ago

This was presented at the 36C3 last year: https://media.ccc.de/v/36c3-10693-no_body_s_business_but_mine_a_dive_into_menstruation_apps https://media.ccc.de/v/36c3-10693-no_body_s_business_but_min... I assume a lot of people just “slap” the SDK in there and call it a day and it starts sending data.

wideasleep1 7y ago

Examples on Android for 'an intercepting proxy' are No Root Firewall, and even better, the paid/donate version of Netguard, which allows you to permanently kill these errant calls. Additionally, you can disable Google Services Framework with it too, if you'd like to try running your Android without Google tethered and watching, while you enjoy sweet, well-designed FOSS apps and services.

ladfjkl 7y ago

Has anyone tried the Lockdown app? https://9to5mac.com/2019/07/24/lockdown-ios-firewall-open-source/ https://9to5mac.com/2019/07/24/lockdown-ios-firewall-open-so... It looks promising, and has been posted to HN a few times, but nobody has commented on it. https://news.ycombinator.com/item?id=20519456 https://news.ycombinator.com/item?id=20519456

ktta 7y ago
There's also Guardian Firewall, which is built (or atleast started by) a well known iOS jailbreaker https://9to5mac.com/2019/08/05/guardian-firewall-vpn-ios-app/ https://9to5mac.com/2019/08/05/guardian-firewall-vpn-ios-app...

ozmbie 7y ago

I would love if Apple started treating app analytics like they do my GPS location or my camera permissions. Basically, if apps want to send analytics, they must go through an iOS API. Then as a user, I can inspect what apps are sending and how frequently. I should be able to block requests or set myself as anonymous. Or allow apps for certain amounts of time etc.

qserasera 7y ago

Thank you st3fan. I will reference your comment in the future.

ElectrodesD 7y ago

Apple isn't interested in that as well as most of the corporations out there. Data is one of the most valuable assets and this is easy cash flow.

arendtio 7y ago

Apple is busy deleting localStorage data from PWA users... For those who did not read about it: https://andregarzia.com/2020/03/private-client-side-only-pwas-are-hard-but-now-apple-made-them-impossible.html https://andregarzia.com/2020/03/private-client-side-only-pwa...