18 ms·

Zoom’s Use of Facebook’s SDK in iOS Client

rbruggem 7y ago
Zoom, you've handled this perfectly
- ThePowerOfFuet 7y ago
  /s
intopieces 7y ago
I'd like this to be independently verified. There were a lot of comments on the other threads that "Of course Zoom was sending data to Facebook" because they're using Facebook's SDK. It made it seem like such data leaks were inevitable, when apparently they aren't.
- deleted 7y ago
  [deleted]
- mroche 7y ago
  From the article: > Motherboard downloaded the update and verified that it does not send data to Facebook upon opening. Edit: Fixing mental hiccup, nothing to see here.
  - starmftronajoll 7y ago
    This is the new article from Motherboard. Motherboard = Vice
    - mroche 7y ago
      Now I feel dumb. I completely forgot that connection, and skipped over the blatant “Motherboard, Tech by Vice” in the title. It’s been a long week... Don’t mind me, just fixing that mistake.
ccktlmazeltov 7y ago
And so zoom crumbled from the social pressure, while every other service and website is thinking "oof, they didn't realize that everybody does this to do advertising"
- thulecitizen 7y ago
  Sometimes I really wonder who is on hackernews that stuff like this gets downvoted. Apparently a healthy dose of (scientific) skepticism means one is being ‘rude’ in SV circles. I guess the intellectual-property-rentier industrial complex that is Silicon Valley doesn’t like people looking behind the curtains.
  - flyingcroissant 7y ago
    The implication of saying they “crumbled” to the “social pressure” is that it’s bad to take clear feedback from your user base. It doesn’t make any sense.
  - luckylion 7y ago
    Who in their right mind would downvote a "but everybody does this?! it's so mean to focus on this instance" comment? /s
  - tomhoward 7y ago
    It's not downvoted, now. Yep, no doubt it was when you commented, but an unfairly downvoted state on a comment usually corrects fairly quickly, which is one of the reasons why the guidelines ask us not to complain about it.
- floatingatoll 7y ago
  It's also possible they didn't listen to their app over the wire and see it doing this. What lesson could we teach about "why you should mitmproxy your app while it's in development?", so that people can start uncovering this in other apps — including their own?
- pixiemaster 7y ago
  here, take my gold
jscholes 7y ago
So did they just... remove Facebook login? Doesn't seem that likely. Maybe the FB SDK has some flags you can set.
- Operyl 7y ago
  > "We will be removing the Facebook SDK and reconfiguring the feature so that users will still be able to login with Facebook via their browser. ..." It sounds like this they're just no longer flat out using the Facebook SDK (which provides a slightly more "native" / "nicer" login flow for apps when used). They're going to do what most (at least, from personal experience) apps do and just show a webview with a redirect back into the app, which doesn't call out to Facebook at all. EDIT: That is, it doesn't call out to Facebook at all until you start the login flow, which is just opening a browser view to the oauth2 flows..
Executor 7y ago
Archive link to not give anti-white Vice ad money: https://web.archive.org/web/20200328020512/https://www.vice.com/en_us/article/z3b745/zoom-removes-code-that-sends-data-to-facebook https://web.archive.org/web/20200328020512/https://www.vice.....
- exhilaration 7y ago
  anti-white? can you explain?
  - angry_octet 7y ago
    He's a racist troll.
  - angry_octet 7y ago
    I'll restate my comment: it's a racist troll. Only on HN do your comments get flagged for calling out racism. So whoever you are, you're a racist too.
JumpCrisscross 7y ago
Wouldn’t a meaningful win require a change to their privacy policy?
floatingatoll 7y ago
Zoom's blog post about the removal of Facebook login and SDK: https://blog.zoom.us/wordpress/2020/03/27/zoom-use-of-facebook-sdk-in-ios-client/ https://blog.zoom.us/wordpress/2020/03/27/zoom-use-of-facebo...
yingw787 7y ago
I love $ZM, it works when nothing else does, and it's responsive to user feedback and cares about user happiness. Most of the interactions I have today are through $ZM and my life would be cut off almost entirely if $ZM didn't exist. If I'm fortunate enough to run a company, I would love to have a business relationship with $ZM, and I'll remember all this. No, I'm not a paid shill, just a really tired and stressed out guy who gets almost all of his social interaction through Zoom.
- bunchOfCucks 7y ago
  $OK
- ThePowerOfFuet 7y ago
  Whereby works great for social interaction.
shbooms 7y ago
Headline should technically read: "Zoom Removes Code That Sends Data to Facebook when you first open the app" as per the article: "Motherboard downloaded the update and verified that it does not send data to Facebook upon opening." It's a bit naive to just assume that just because they don't send the data right away, that it's not getting sent at some point later on.
- noahtallen 7y ago
  > we decided to remove the Facebook SDK in our iOS client and have reconfigured the feature so that users will still be able to log in with Facebook via their browser. Since they removed the Facebook SDK entirely, whatever mechanism Facebook used to collect the info doesn’t exist any more. Instead of being able to collect the data at all times, wouldn’t FB only have a vector to do so through web login? At that point, I assume they could do fingerprinting in the browser to collect some info, but at least the cannot do it on the system level any more. It still seems like this is a big improvement. Though, I imagine most folks will have at least one other app using the FB SDK, so it’s not like the root cause is fixed.
  - diebeforei485 7y ago
    On recent versions of iOS, in-app browsers do not share data with the Safari browser. How effective would browser fingerprinting be? Everyone with the same device, same language/locale and same timezone should have the same browser fingerprint, I thought.
    - saagarjha 7y ago
      > On recent versions of iOS, in-app browsers do not share data with the Safari browser. Specifically, SFSafariViewController does not share cookies or other data with Safari anymore. Some bad actors got caught with their hands in the cookie jar, literally, and out that sharing went.
      - greggman3 7y ago
proactivesvcs 7y ago
If Zoom "takes its users' privacy extremely seriously" and their "customers’ privacy is incredibly important" then why would they be releasing software without a strong knowledge of what third party code they're adding in, and what exfiltration might be happening as a result? They hold user privacy in such high regard and yet are releasing a program without even hooking it up to a network monitor for five minutes? Someone's lying here.
- ricardobeat 7y ago
  This is absolutely common. Business will require tracking/authentication/etc, contracts will be signed, developers will implement the provided SDK. Nobody will inspect the data being sent. > releasing a program without even hooking it up to a network monitor for five minutes How many times have you seen anyone do that? Unfortunately that is the reality - my personal take is to simply try to avoid vendor libraries at all costs, but it's hard to sell.
  - dilly_li 7y ago
    This. Most things are operated in an honor system. Take npm as another example, in a large corporation, any commercial product that relies on third-party npm packages will have to survive a long legal audit process.
  - gfodor 7y ago
    I guess this is another under-recognized benefit of developing for the web - when doing so, you're staring at the Network tab all day, trying to grok what's going on over the wire and to whom. I don't remember doing this nearly as much on native.
    - kelnos 7y ago
      Yeah, that's the thing. I do very little web development, but I inevitably find myself in the Network tab of dev tools debugging something. I do around as little mobile (Android) development, and I'm not even really sure how I'd watch network traffic coming from an Android app. (I'm sure it's possible, but I imagine it requires explicit setup, possibly with some third-party software and/or the assistance of a laptop.)
deleted 7y ago
[deleted]
anonu 7y ago
I noticed today that the mic was "muted" on zoom. I chimed in on the video call I was on and the window flashed a reminder that I was "muted". So clearly the mic itself is not muted - the software is still listening. Not sure how I felt about that given all the recent Zoom privacy revelations.
- untog 7y ago
  FWIW Google Hangouts/Meet does the same thing. It’s actually a pretty useful feature... as long as you trust the company implementing it, I guess.
  - deleted 7y ago
    [deleted]
- klyrs 7y ago
  Yeah, my light's still on when I'm not sharing video and I hate it
  - banana_giraffe 7y ago
    Interesting. The LED on my 2019 MBP's camera goes off when I stop Zoom's video.
  - rpdillon 7y ago
    This is about audio, which, afaik, doesn't by itself trigger the light on Macs.
- shostack 7y ago
  I feel like this is a common video chat feature. Given that the option to mute while in the chat is likely done most frequently through their UI vs the system settings, this seems to be an appropriate use of monitoring input to ensure the user is able to avoid common problems. There seem to be some legitimate concerns about privacy worth discussing further but I'm not sure this is one of them.
- holografix 7y ago
dx87 7y ago
It's good that they removed it, but it's also dissapointing that they had no idea that it was happening until someone made a blog post about it. Do their employees not vet any of the code they use, and just slap things together off the internet and hope it's not doing anything their users don't like?
- banana_giraffe 7y ago
  Between this and the HTTP server, it feels like Zoom of old that wrote the app was more willing to make the user experience vs user privacy trade off in favor of user experience. Now you need to log in via Facebook with a separate browser window, and thanks to the HTTP change, you need to click on a browser dialog to launch a meeting from a link. So, they've either changed their policy to err more towards the privacy side and haven't found all the cases yet, or, more likely, still have the same attitude except when the tech world starts screaming at them.
  - kelnos 7y ago
    I think it's more likely that the developers responsible for the HTTP server just didn't know much about local security, and Zoom doesn't have a good security review process (where actual infosec professionals are involved). That doesn't absolve them of responsibility, of course, but I really don't think it was malice or an intentional desire to ignore privacy concerns.
    - fiddlerwoaroof 7y ago
      The HTTP server was a great idea: the problem wasn’t the server but the bug in the server.
      - saagarjha 7y ago
        The “bug” where it would basically act like persistent malware, or the bug where it would act like persistent malware but also allow attackers remote access to your machine?
- 7y ago
pyt 7y ago
I contacted LG last month regarding their use of the Facebook SDK's automatic event collection in their ThinQ Android app. They responded and told me that they're disabling it in an upcoming release (incidentally, today's). If a single email is all it took to get a company with over $50 billion in revenue to disable Facebook's tracking in one of their apps, I really don't think that these companies are sharing data intentionally. What justification does Facebook have for keeping automatic event collection turned on by default in their SDKs? Why can't they enable it only when the the user has explicitly opted in (https://developers.facebook.com/docs/app-events/gdpr-compliance/#disabling-automatic-event-collection https://developers.facebook.com/docs/app-events/gdpr-complia...)? They even say, "you need to ensure that your SDK implementation meets these [GDPR] consent requirements."
- nh2 7y ago
  > I don't think these companies are sharing data with Facebook intentionally. That would imply they are incompetent and negligent. Would one not expect large companies like LG to have internal security and privacy reviews of the software they publish, and know very well what they are doing? > What justification Their core business.
  - yjftsjthsd-h 7y ago
    > That would imply they are incompetent and negligent. I'm surprised that you consider that unlikely/surprising. Lots of companies act in technically incompetent ways all the time
  - floatingatoll 7y ago
    Given Google's hostility towards the glacier-slow release schedules of Android updates and the continued embedding of vendor apps that screw up Android by phone vendors such as LG, I'm already quite biased in favor of "companies like LG are incompetent and negligent", based on the evidence available over the past several years.
  - kelnos 7y ago
    > That would imply they are incompetent and negligent. Not really. Product Manager: I want to be able to support Facebook login for our app. Developer: OK... [googles for how to do that] ... We can use the FB SDK for that. PM: Cool, let's do that. Dev: [implements it] Nobody really does much more due diligence than that most of the time. I suppose you could argue that's negligent, but if that's the case, then pretty much every company that has an app with login functionality is probably in that boat.
mkchoi212 7y ago
That is ridiculous that a company as big as Zoom wouldn't know what an API they're using is doing with their customer's data. Is there not a legal/privacy team at Zoom that is in charge of reading all the fine prints and license agreements??
- xiphias2 7y ago
  I guess you haven’t worked at a big company yet. For me this would be much stranger at a tiny company.
deleted 7y ago
[deleted]
mikenew 7y ago
So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting mad at Zoom for using the Facebook SDK is missing the point. They and a million others are always going to be doing this. Get mad at Apple for not letting you wireshark your own iPhone. Or having no way to package open source software where you can actually see what's running. As long as you're running binary blobs that can make whatever network connections they please, people are going to take your data and send it to places you don't know about. Yeah maybe you can pass laws about it. But is that really a great solution? Who audits that? How do you determine what's legal and what's not? We should be pushing for a platform that makes it obvious what the software you're running is up to. The random pitchfork crusade against whatever company happens to catch a bad news cycle just isn't going to get us anywhere.
- aaronbrager 7y ago
  You can pretty easily see all the traffic on your own phone. You can even do it on device https://apps.apple.com/us/app/charles-proxy/id1134218562 https://apps.apple.com/us/app/charles-proxy/id1134218562
  - JMTQp8lwXL 7y ago
    Seeing it != blocking it.
    - jbigelow76 7y ago
      If you can see it you can make an informed choice if the tradeoff is worth it.
      - shakna 7y ago
        If you can see it, but can't block it, then you've already lost a part of it before you can make that informed decision.
Hokusai 7y ago
To use the Facebook SDK is a rocky mistake. It includes all kind of telemetry that is send to Facebook, whenever the user is connected to Facebook or not. In the company I worked for, they read the code, you have access to it, and stripped that parts. It's not much work but its a pain. The best approach is to use just the HTTP APIs and ignore the SDK. Your team will better understand how Facebook works, your app will be lighter and you are free from nasty surprises that a 3rd party may add to your app without your knowledge.
- mianos 7y ago
  This is kind of exactly what they said it didn't do.
narendranag 7y ago
Considering how many apps are using Facebook's SDK, shouldn't this be something that FB should be addressing? After all, they are the ones making an SDK available to app developers to help with user-login. Shouldn't the presumption of trust rest on FB?
- designcode 7y ago
  I can’t see the big deal. We use the Facebook SDK specifically for the free analytics. It’s just a default part of the SDK. It’s not sending anything any other analytics package wouldn’t
  - yjftsjthsd-h 7y ago
    > It’s not sending anything any other analytics package wouldn’t But the where matters as much at the what; sending it to FB means that they add it to their profile of your users.
  - saagarjha 7y ago
    I do not like you using the Facebook SDK for the “free analytics” and consider this to be a big deal.
  - jeroenhd 7y ago
    Could you maybe expand on what company you work for so that the rest of us can avoid it and its products? Uploading all of this data to Facebook just so you don't have to run a Matomo instance (or whatever controlled analytics platform you use) is either laziness or disregard for your users. There's a reason the analytics are free and sacrificing your users for something this small is exactly what is wrong with the modern software ecosystem.
ineedasername 7y ago
They were made aware of the issue on the 25th... it seems like due diligence would have revealed the issue at the outset. It should be no secret that FB provides their authentication services with strings attached. At least they fixed it quickly.
awinter-py 7y ago
covid will shift the overton window on privacy centralized location tracking in an infectious crisis (either mandatory or mass voluntary) will normalize to 'good' sleazy third-party phone home from apps considered key to surviving under lockdown, apparently not ok now! good the bad news is we'll normalize some bad practices, but the good news is we'll make pragmatic compromises using actual information -- with covid taking up moral panic cycles, privacy is a place we can be rational also no business feels totally secure RN and people will do anything to win & keep business -- even zoom
dannyw 7y ago
It’s not fair to be attacking zoom so much over this. They took prompt action as soon as they were aware.
- harry8 7y ago
  As soon as they were aware of the thing they themselves did. So they don't know what they're doing? Really? How does that defense go in criminal trials?
- luckylion 7y ago
  > They took prompt action as soon as they were aware. They took prompt action because they were attacked so much over this.
aurbano 7y ago
What if mobile platforms (iOS, Android... ) changed the security/privacy policy so that apps had to request the “network access” permission, either whitelisting domains they want to talk to, or askingfor wildcard access? Most apps shouldn’t need wildcard access, and the mobile device could include a warning when an app does this teaching users that they should be careful with the app. This way at least when you installed Zoom for example, it would say something like: “Zoom is requesting network access to: - zoom.us - analytics.tracker.example.com - facebook.com “ And then at everyone would know. It still doesn’t solve the underlaying problem, but it would probably make companies more reluctant to add third party analytics and sdks.
- saagarjha 7y ago
  Most apps are extremely chatty and prompts like these may not end up being useful.
  - jmiserez 7y ago
    It worked for location access on iOS, and that was just adding a flashing blue icon. Many apps stopped using the location all the time, and now there's a popup every few days telling you how often the app requested your location in the background.
- pixelrevision 7y ago
  This wouldn’t help much unfortunately. The company could just setup a proxy server to do the work that lives under their domain. A company like segment (which routes analytics to other platforms) could then offer personalized domains and make a killing as everyone throws everything there. But there probably is some sort of good similar solution based on guidelines. If apple were to start defining policies on data collection and opt outs and say that apps needed to follow them or be rejected it would put a lot of pressure companies like Facebook to adhere to these guidelines in their sdks. I don’t know if apple has the appetite for this as it would cause a whole lot of rewriting of a whole lot of code but they are in a great position to do this.
rawoke083600 7y ago
Just uses jitsi
jbverschoor 7y ago
Tooo little, too late. Try creating a Mac App Store version first
chmike 7y ago
Is the data sent back to Facebook sent in clear text ? What if they used https to send back the data ? Would the data content be detectable ?
lultimouomo 7y ago
Nice way to bury an innocuous "iOS Advertiser ID" in the middle of the list. What "iOS Advertiser ID" means is, to a very good degree of approximation, your deanonimized identity. Also, that just linking the SDK in your app deanonimzes the user to Facebook is very, very clear in its documentation. It's not like Zoom didn't notice until someone told them. They made a decision, and now they're changing it because they were called out.
- enitihas 7y ago
  They are changing because right now they are growing like crazy without the need to do much on user acquisition, and a bad PR is just too costly right now. But good to see them doing it.
  - lultimouomo 7y ago
    Sure, good they are changing. And Zoom is definitely not alone in this. Facebook SDK usage is widespread and it's a horrible thing. And even then, the fault ultimately resides with Apple and Google that provide cross-application unique identifiers.
    - enitihas 7y ago
      Yup, cross application unique identifiers are such a bad idea that it is hard to believe they exist. Maybe for Google I understand, since their entire business is advertising and android is more like a live billboard to display ads from their POV, but Apple, the company crying privacy, still provides an advertising id is shocking.
- envy2 7y ago
  The list is in alphabetical order. It's not malicious...
  - lultimouomo 7y ago
    Alphabetical order is neither mandated by any rule, nor deterministic since you can choose how to call things. "Application Bundle Identifier" made it to the top of the list, but if it was "iOS Application Bundle Identifier" it would be below the Advertiser ID. Do you really think they prepared a PR statement to respond to harsh criticism and just decided to toss in there the list of information sent without crafting the order of the items?
benreesman 7y ago
Evil privacy-invading shit is fucking everywhere. Why is it only news when Facebook is somehow involved?
xenonite 7y ago
Let me ask how many of those who now argue in Zoom's favor have bought shares or are invested in any other way, like having bought licenses directly or indirectly for their company?
tinus_hn 7y ago
Is that list actually complete? It doesn’t sound like that much of a deal.
jka 7y ago
For anyone interested in Facebook's SDK behaviour on Android, there's a good video[1] from 35C3 covering this topic, and a related HN discussion thread[2]. [1] - https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_android/ https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_... [2] - https://news.ycombinator.com/item?id=18788658 https://news.ycombinator.com/item?id=18788658
jbverschoor 7y ago
I really don’t appreciate the downvoting mobs by certain companies.
greggman3 7y ago
I'm happy the Zoom doesn't want to help Facebook spy on me. Unfortunately the chosen solution is still a privacy nightmare. Basically they let you login to Facebook via an in app browser. The problem is an app can spy on all activity of an in app browser. That means you have to trust that Zoom is not recording your facebook password as you type it in. We need a better system. Also scary. I have never ever logged in to Facebook on my iPhone except via the Facebook app and it was the first time I've installed Zoom. When I went into the Zoom app and picked login via Facebook, somehow it knew who I was and asked if I wanted to login as me. How is this possible? Is iOS sharing cookies across apps? I feel like maybe I need to reset my phone. WTF I also feel like the best solution for this case is to somehow login via the facebook app. I know that used to be an option but it seems facebook deprecated it. My argument would be (a) I don't have to worry Zoom (or any other app) is getting my Facebook credentials (b) If actually do want to login via Facebook it's almost guaranteed I have the app installed.
- codesternews 7y ago
  Not in iOS. If they are using with webview or safariviewcontroller they can not access the browser cookies or data or most of device information.
  - greggman3 7y ago
    Not true AFAICT. Given Chrome on iOS uses a webview and overrides all networking and given Firefox can inject JavaScript it seems trivial to use both of those features to spy on any webview activity
- generalpf 7y ago
  If they’re using ASWebAuthenticationController you can’t read passwords. You can’t even see which URL they’re on.
  - RKearney 7y ago
    Is there a way for the end user to differentiate between that and a custom controller?
MUHAMMADRIZWAN 7y ago
https://bit.ly/2QTW8St https://bit.ly/2QTW8St
ababol 7y ago
>> we were made aware on Wednesday, March 25, 2020, that the Facebook SDK was collecting device information unnecessary So Zoom is basically lying here Come on, the developers who takes the responsibility to use the SDK were aware of it, ok maybe the CEO of Zoom or the market guy was not but the tech team is. They are not stupid. You should have just apologise and assume your fault, that would be the courageous position, not denying it. Tbh I am ok with Zoom sending my data to FB (I mean, in my case I've insta/messenger anyway) but not ok for Zoom taking everyone as naïve people with this lying statement.
- madwhitehatter 7y ago
  This is what scares most security analysts is the fact that the product was developed and stores data in a place that has incredibly sketchy laws when it comes to intellectual property. I can't see why Zoom can't come out with a statement regarding why they are collecting all of this sensitive data. Big corporations might be sharing stuff unwittingly with people that they don't want to share it with. https://www.sec.gov/Archives/edgar/data/1585521/000119312519083351/d642624ds1.htm https://www.sec.gov/Archives/edgar/data/1585521/000119312519... Top of page 21 in their SEC filing: "In addition, we have a high concentration of research and development personnel in China, which could expose us to market scrutiny regarding the integrity of our solution or data security features. Any security compromise in our industry, whether actual or perceived, could harm our reputation, erode confidence in the effectiveness of our security measures, negatively affect our ability to attract new customers and hosts, cause existing customers to elect not to renew their subscriptions or subject us to third-party lawsuits, regulatory fines or other action or liability, which could harm our business."
dbg31415 7y ago
Great, now if they would stop having an activity monitor that checked every process running on your computer, or made their web interface work with Firefox we’d be all set...
aledalgrande 7y ago
Just curious about the IP being sent to FB, isn't that PII? How can FB do this legally without the user agreeing to it first? Or did I miss something?
madwhitehatter 7y ago
https://www.theregister.co.uk/2020/03/27/doc_searls_zoom_privacy/ https://www.theregister.co.uk/2020/03/27/doc_searls_zoom_pri...
dylan604 7y ago
That's great for iOS users, but it doesn't mention anything about the Android client. Nor do they discuss the tracking that the webapp still does even though they explicitly state they still allow FB login via browser. Isn't this more of a sorry for getting caught rather than an actual apology?
cexilevuanh 7y ago
It seems that Facebook JS SDK also sends user behavior back to Facebook even when user doesn't click on the "Sign in with Facebook" button: https://simplelogin.io/blog/do-not-use-facebook-sdk/ https://simplelogin.io/blog/do-not-use-facebook-sdk/ On the Web, it's recommended to use a generic OAuth library instead of integrating Facebook JS SDK. On mobile, this is almost impossible though as Facebook doesn't implement the OAuth PKCE flow.
Ericsyuan 7y ago
Dear all, I am the CEO of Zoom. First, I sincerely apologize about this Facebook SDK issue. We learned a lesson, and we will do all we can to improve. I also wrote a blog. https://blog.zoom.us/wordpress/2020/03/27/zoom-use-of-facebook-sdk-in-ios-client/ https://blog.zoom.us/wordpress/2020/03/27/zoom-use-of-facebo... Please take care and be safe.
- ponsin 7y ago
  Hey, thank you for listening to security researchers and fixing a problem when you became aware. I know this is not so much a problem, but rather a business decision, but the product would be much more useable if it was possible to connect without the app without having to use some tricks. There have been many conferences that took much longer than expected to start because not everyone had Zoom
  - Ericsyuan 7y ago
    Dear Ponsin, You are right on! To focus on our service stability and security are our top 2 priorities. We will work as hard as we can to keep improving. Thank you for your great support!
Mave83 7y ago
Thank you zoom.us for the best tool available right now with a fair and acceptable price model. A special thank you also for the great Linux support, that is absolutely unmatched from all other "solutions". I am very sorry that so many bad publicity happens right now, but as far I know even bad publicity is good in the end.
- djsjejjdi324 7y ago
  well, you know, bad publicity because of bad practices.

Zoom, you've handled this perfectly

ThePowerOfFuet 7y ago
/s

I'd like this to be independently verified. There were a lot of comments on the other threads that "Of course Zoom was sending data to Facebook" because they're using Facebook's SDK. It made it seem like such data leaks were inevitable, when apparently they aren't.

deleted 7y ago
[deleted]
mroche 7y ago
From the article: > Motherboard downloaded the update and verified that it does not send data to Facebook upon opening. Edit: Fixing mental hiccup, nothing to see here.
- starmftronajoll 7y ago
  This is the new article from Motherboard. Motherboard = Vice
  - mroche 7y ago
    Now I feel dumb. I completely forgot that connection, and skipped over the blatant “Motherboard, Tech by Vice” in the title. It’s been a long week... Don’t mind me, just fixing that mistake.

ccktlmazeltov 7y ago

And so zoom crumbled from the social pressure, while every other service and website is thinking "oof, they didn't realize that everybody does this to do advertising"

thulecitizen 7y ago
Sometimes I really wonder who is on hackernews that stuff like this gets downvoted. Apparently a healthy dose of (scientific) skepticism means one is being ‘rude’ in SV circles. I guess the intellectual-property-rentier industrial complex that is Silicon Valley doesn’t like people looking behind the curtains.
- flyingcroissant 7y ago
  The implication of saying they “crumbled” to the “social pressure” is that it’s bad to take clear feedback from your user base. It doesn’t make any sense.
- luckylion 7y ago
  Who in their right mind would downvote a "but everybody does this?! it's so mean to focus on this instance" comment? /s
- tomhoward 7y ago
  It's not downvoted, now. Yep, no doubt it was when you commented, but an unfairly downvoted state on a comment usually corrects fairly quickly, which is one of the reasons why the guidelines ask us not to complain about it.
floatingatoll 7y ago
It's also possible they didn't listen to their app over the wire and see it doing this. What lesson could we teach about "why you should mitmproxy your app while it's in development?", so that people can start uncovering this in other apps — including their own?
pixiemaster 7y ago
here, take my gold

jscholes 7y ago

So did they just... remove Facebook login? Doesn't seem that likely. Maybe the FB SDK has some flags you can set.

Operyl 7y ago
> "We will be removing the Facebook SDK and reconfiguring the feature so that users will still be able to login with Facebook via their browser. ..." It sounds like this they're just no longer flat out using the Facebook SDK (which provides a slightly more "native" / "nicer" login flow for apps when used). They're going to do what most (at least, from personal experience) apps do and just show a webview with a redirect back into the app, which doesn't call out to Facebook at all. EDIT: That is, it doesn't call out to Facebook at all until you start the login flow, which is just opening a browser view to the oauth2 flows..

Executor 7y ago

Archive link to not give anti-white Vice ad money: https://web.archive.org/web/20200328020512/https://www.vice.com/en_us/article/z3b745/zoom-removes-code-that-sends-data-to-facebook https://web.archive.org/web/20200328020512/https://www.vice.....

exhilaration 7y ago
anti-white? can you explain?
- angry_octet 7y ago
  He's a racist troll.
- angry_octet 7y ago
  I'll restate my comment: it's a racist troll. Only on HN do your comments get flagged for calling out racism. So whoever you are, you're a racist too.

JumpCrisscross 7y ago

Wouldn’t a meaningful win require a change to their privacy policy?

floatingatoll 7y ago

Zoom's blog post about the removal of Facebook login and SDK: https://blog.zoom.us/wordpress/2020/03/27/zoom-use-of-facebook-sdk-in-ios-client/ https://blog.zoom.us/wordpress/2020/03/27/zoom-use-of-facebo...

yingw787 7y ago

I love $ZM, it works when nothing else does, and it's responsive to user feedback and cares about user happiness. Most of the interactions I have today are through $ZM and my life would be cut off almost entirely if $ZM didn't exist. If I'm fortunate enough to run a company, I would love to have a business relationship with $ZM, and I'll remember all this. No, I'm not a paid shill, just a really tired and stressed out guy who gets almost all of his social interaction through Zoom.

bunchOfCucks 7y ago
$OK
ThePowerOfFuet 7y ago
Whereby works great for social interaction.

shbooms 7y ago

Headline should technically read: "Zoom Removes Code That Sends Data to Facebook when you first open the app" as per the article: "Motherboard downloaded the update and verified that it does not send data to Facebook upon opening." It's a bit naive to just assume that just because they don't send the data right away, that it's not getting sent at some point later on.

noahtallen 7y ago
> we decided to remove the Facebook SDK in our iOS client and have reconfigured the feature so that users will still be able to log in with Facebook via their browser. Since they removed the Facebook SDK entirely, whatever mechanism Facebook used to collect the info doesn’t exist any more. Instead of being able to collect the data at all times, wouldn’t FB only have a vector to do so through web login? At that point, I assume they could do fingerprinting in the browser to collect some info, but at least the cannot do it on the system level any more. It still seems like this is a big improvement. Though, I imagine most folks will have at least one other app using the FB SDK, so it’s not like the root cause is fixed.
- diebeforei485 7y ago
  On recent versions of iOS, in-app browsers do not share data with the Safari browser. How effective would browser fingerprinting be? Everyone with the same device, same language/locale and same timezone should have the same browser fingerprint, I thought.
  - saagarjha 7y ago
    > On recent versions of iOS, in-app browsers do not share data with the Safari browser. Specifically, SFSafariViewController does not share cookies or other data with Safari anymore. Some bad actors got caught with their hands in the cookie jar, literally, and out that sharing went.
    - greggman3 7y ago

proactivesvcs 7y ago

If Zoom "takes its users' privacy extremely seriously" and their "customers’ privacy is incredibly important" then why would they be releasing software without a strong knowledge of what third party code they're adding in, and what exfiltration might be happening as a result? They hold user privacy in such high regard and yet are releasing a program without even hooking it up to a network monitor for five minutes? Someone's lying here.

ricardobeat 7y ago
This is absolutely common. Business will require tracking/authentication/etc, contracts will be signed, developers will implement the provided SDK. Nobody will inspect the data being sent. > releasing a program without even hooking it up to a network monitor for five minutes How many times have you seen anyone do that? Unfortunately that is the reality - my personal take is to simply try to avoid vendor libraries at all costs, but it's hard to sell.
- dilly_li 7y ago
  This. Most things are operated in an honor system. Take npm as another example, in a large corporation, any commercial product that relies on third-party npm packages will have to survive a long legal audit process.
- gfodor 7y ago
  I guess this is another under-recognized benefit of developing for the web - when doing so, you're staring at the Network tab all day, trying to grok what's going on over the wire and to whom. I don't remember doing this nearly as much on native.
  - kelnos 7y ago
    Yeah, that's the thing. I do very little web development, but I inevitably find myself in the Network tab of dev tools debugging something. I do around as little mobile (Android) development, and I'm not even really sure how I'd watch network traffic coming from an Android app. (I'm sure it's possible, but I imagine it requires explicit setup, possibly with some third-party software and/or the assistance of a laptop.)

deleted 7y ago

[deleted]

anonu 7y ago

I noticed today that the mic was "muted" on zoom. I chimed in on the video call I was on and the window flashed a reminder that I was "muted". So clearly the mic itself is not muted - the software is still listening. Not sure how I felt about that given all the recent Zoom privacy revelations.

untog 7y ago
FWIW Google Hangouts/Meet does the same thing. It’s actually a pretty useful feature... as long as you trust the company implementing it, I guess.
- deleted 7y ago
  [deleted]
klyrs 7y ago
Yeah, my light's still on when I'm not sharing video and I hate it
- banana_giraffe 7y ago
  Interesting. The LED on my 2019 MBP's camera goes off when I stop Zoom's video.
- rpdillon 7y ago
  This is about audio, which, afaik, doesn't by itself trigger the light on Macs.
shostack 7y ago
I feel like this is a common video chat feature. Given that the option to mute while in the chat is likely done most frequently through their UI vs the system settings, this seems to be an appropriate use of monitoring input to ensure the user is able to avoid common problems. There seem to be some legitimate concerns about privacy worth discussing further but I'm not sure this is one of them.
holografix 7y ago

dx87 7y ago

It's good that they removed it, but it's also dissapointing that they had no idea that it was happening until someone made a blog post about it. Do their employees not vet any of the code they use, and just slap things together off the internet and hope it's not doing anything their users don't like?

banana_giraffe 7y ago
Between this and the HTTP server, it feels like Zoom of old that wrote the app was more willing to make the user experience vs user privacy trade off in favor of user experience. Now you need to log in via Facebook with a separate browser window, and thanks to the HTTP change, you need to click on a browser dialog to launch a meeting from a link. So, they've either changed their policy to err more towards the privacy side and haven't found all the cases yet, or, more likely, still have the same attitude except when the tech world starts screaming at them.
- kelnos 7y ago
  I think it's more likely that the developers responsible for the HTTP server just didn't know much about local security, and Zoom doesn't have a good security review process (where actual infosec professionals are involved). That doesn't absolve them of responsibility, of course, but I really don't think it was malice or an intentional desire to ignore privacy concerns.
  - fiddlerwoaroof 7y ago
    The HTTP server was a great idea: the problem wasn’t the server but the bug in the server.
    - saagarjha 7y ago
      The “bug” where it would basically act like persistent malware, or the bug where it would act like persistent malware but also allow attackers remote access to your machine?
7y ago

pyt 7y ago

I contacted LG last month regarding their use of the Facebook SDK's automatic event collection in their ThinQ Android app. They responded and told me that they're disabling it in an upcoming release (incidentally, today's). If a single email is all it took to get a company with over $50 billion in revenue to disable Facebook's tracking in one of their apps, I really don't think that these companies are sharing data intentionally. What justification does Facebook have for keeping automatic event collection turned on by default in their SDKs? Why can't they enable it only when the the user has explicitly opted in (https://developers.facebook.com/docs/app-events/gdpr-compliance/#disabling-automatic-event-collection https://developers.facebook.com/docs/app-events/gdpr-complia...)? They even say, "you need to ensure that your SDK implementation meets these [GDPR] consent requirements."

nh2 7y ago
> I don't think these companies are sharing data with Facebook intentionally. That would imply they are incompetent and negligent. Would one not expect large companies like LG to have internal security and privacy reviews of the software they publish, and know very well what they are doing? > What justification Their core business.
- yjftsjthsd-h 7y ago
  > That would imply they are incompetent and negligent. I'm surprised that you consider that unlikely/surprising. Lots of companies act in technically incompetent ways all the time
- floatingatoll 7y ago
  Given Google's hostility towards the glacier-slow release schedules of Android updates and the continued embedding of vendor apps that screw up Android by phone vendors such as LG, I'm already quite biased in favor of "companies like LG are incompetent and negligent", based on the evidence available over the past several years.
- kelnos 7y ago
  > That would imply they are incompetent and negligent. Not really. Product Manager: I want to be able to support Facebook login for our app. Developer: OK... [googles for how to do that] ... We can use the FB SDK for that. PM: Cool, let's do that. Dev: [implements it] Nobody really does much more due diligence than that most of the time. I suppose you could argue that's negligent, but if that's the case, then pretty much every company that has an app with login functionality is probably in that boat.

mkchoi212 7y ago

That is ridiculous that a company as big as Zoom wouldn't know what an API they're using is doing with their customer's data. Is there not a legal/privacy team at Zoom that is in charge of reading all the fine prints and license agreements??

xiphias2 7y ago
I guess you haven’t worked at a big company yet. For me this would be much stranger at a tiny company.

deleted 7y ago

[deleted]

mikenew 7y ago

So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting mad at Zoom for using the Facebook SDK is missing the point. They and a million others are always going to be doing this. Get mad at Apple for not letting you wireshark your own iPhone. Or having no way to package open source software where you can actually see what's running. As long as you're running binary blobs that can make whatever network connections they please, people are going to take your data and send it to places you don't know about. Yeah maybe you can pass laws about it. But is that really a great solution? Who audits that? How do you determine what's legal and what's not? We should be pushing for a platform that makes it obvious what the software you're running is up to. The random pitchfork crusade against whatever company happens to catch a bad news cycle just isn't going to get us anywhere.

aaronbrager 7y ago
You can pretty easily see all the traffic on your own phone. You can even do it on device https://apps.apple.com/us/app/charles-proxy/id1134218562 https://apps.apple.com/us/app/charles-proxy/id1134218562
- JMTQp8lwXL 7y ago
  Seeing it != blocking it.
  - jbigelow76 7y ago
    If you can see it you can make an informed choice if the tradeoff is worth it.
    - shakna 7y ago
      If you can see it, but can't block it, then you've already lost a part of it before you can make that informed decision.

Hokusai 7y ago

To use the Facebook SDK is a rocky mistake. It includes all kind of telemetry that is send to Facebook, whenever the user is connected to Facebook or not. In the company I worked for, they read the code, you have access to it, and stripped that parts. It's not much work but its a pain. The best approach is to use just the HTTP APIs and ignore the SDK. Your team will better understand how Facebook works, your app will be lighter and you are free from nasty surprises that a 3rd party may add to your app without your knowledge.

mianos 7y ago
This is kind of exactly what they said it didn't do.

narendranag 7y ago

Considering how many apps are using Facebook's SDK, shouldn't this be something that FB should be addressing? After all, they are the ones making an SDK available to app developers to help with user-login. Shouldn't the presumption of trust rest on FB?

designcode 7y ago
I can’t see the big deal. We use the Facebook SDK specifically for the free analytics. It’s just a default part of the SDK. It’s not sending anything any other analytics package wouldn’t
- yjftsjthsd-h 7y ago
  > It’s not sending anything any other analytics package wouldn’t But the where matters as much at the what; sending it to FB means that they add it to their profile of your users.
- saagarjha 7y ago
  I do not like you using the Facebook SDK for the “free analytics” and consider this to be a big deal.
- jeroenhd 7y ago
  Could you maybe expand on what company you work for so that the rest of us can avoid it and its products? Uploading all of this data to Facebook just so you don't have to run a Matomo instance (or whatever controlled analytics platform you use) is either laziness or disregard for your users. There's a reason the analytics are free and sacrificing your users for something this small is exactly what is wrong with the modern software ecosystem.

ineedasername 7y ago

They were made aware of the issue on the 25th... it seems like due diligence would have revealed the issue at the outset. It should be no secret that FB provides their authentication services with strings attached. At least they fixed it quickly.

awinter-py 7y ago

covid will shift the overton window on privacy centralized location tracking in an infectious crisis (either mandatory or mass voluntary) will normalize to 'good' sleazy third-party phone home from apps considered key to surviving under lockdown, apparently not ok now! good the bad news is we'll normalize some bad practices, but the good news is we'll make pragmatic compromises using actual information -- with covid taking up moral panic cycles, privacy is a place we can be rational also no business feels totally secure RN and people will do anything to win & keep business -- even zoom

dannyw 7y ago

It’s not fair to be attacking zoom so much over this. They took prompt action as soon as they were aware.

harry8 7y ago
As soon as they were aware of the thing they themselves did. So they don't know what they're doing? Really? How does that defense go in criminal trials?
luckylion 7y ago
> They took prompt action as soon as they were aware. They took prompt action because they were attacked so much over this.

aurbano 7y ago

What if mobile platforms (iOS, Android... ) changed the security/privacy policy so that apps had to request the “network access” permission, either whitelisting domains they want to talk to, or askingfor wildcard access? Most apps shouldn’t need wildcard access, and the mobile device could include a warning when an app does this teaching users that they should be careful with the app. This way at least when you installed Zoom for example, it would say something like: “Zoom is requesting network access to: - zoom.us - analytics.tracker.example.com - facebook.com “ And then at everyone would know. It still doesn’t solve the underlaying problem, but it would probably make companies more reluctant to add third party analytics and sdks.

saagarjha 7y ago
Most apps are extremely chatty and prompts like these may not end up being useful.
- jmiserez 7y ago
  It worked for location access on iOS, and that was just adding a flashing blue icon. Many apps stopped using the location all the time, and now there's a popup every few days telling you how often the app requested your location in the background.
pixelrevision 7y ago
This wouldn’t help much unfortunately. The company could just setup a proxy server to do the work that lives under their domain. A company like segment (which routes analytics to other platforms) could then offer personalized domains and make a killing as everyone throws everything there. But there probably is some sort of good similar solution based on guidelines. If apple were to start defining policies on data collection and opt outs and say that apps needed to follow them or be rejected it would put a lot of pressure companies like Facebook to adhere to these guidelines in their sdks. I don’t know if apple has the appetite for this as it would cause a whole lot of rewriting of a whole lot of code but they are in a great position to do this.

rawoke083600 7y ago

Just uses jitsi

jbverschoor 7y ago

Tooo little, too late. Try creating a Mac App Store version first

chmike 7y ago

Is the data sent back to Facebook sent in clear text ? What if they used https to send back the data ? Would the data content be detectable ?

lultimouomo 7y ago

Nice way to bury an innocuous "iOS Advertiser ID" in the middle of the list. What "iOS Advertiser ID" means is, to a very good degree of approximation, your deanonimized identity. Also, that just linking the SDK in your app deanonimzes the user to Facebook is very, very clear in its documentation. It's not like Zoom didn't notice until someone told them. They made a decision, and now they're changing it because they were called out.

enitihas 7y ago
They are changing because right now they are growing like crazy without the need to do much on user acquisition, and a bad PR is just too costly right now. But good to see them doing it.
- lultimouomo 7y ago
  Sure, good they are changing. And Zoom is definitely not alone in this. Facebook SDK usage is widespread and it's a horrible thing. And even then, the fault ultimately resides with Apple and Google that provide cross-application unique identifiers.
  - enitihas 7y ago
    Yup, cross application unique identifiers are such a bad idea that it is hard to believe they exist. Maybe for Google I understand, since their entire business is advertising and android is more like a live billboard to display ads from their POV, but Apple, the company crying privacy, still provides an advertising id is shocking.
envy2 7y ago
The list is in alphabetical order. It's not malicious...
- lultimouomo 7y ago
  Alphabetical order is neither mandated by any rule, nor deterministic since you can choose how to call things. "Application Bundle Identifier" made it to the top of the list, but if it was "iOS Application Bundle Identifier" it would be below the Advertiser ID. Do you really think they prepared a PR statement to respond to harsh criticism and just decided to toss in there the list of information sent without crafting the order of the items?

benreesman 7y ago

Evil privacy-invading shit is fucking everywhere. Why is it only news when Facebook is somehow involved?

xenonite 7y ago

Let me ask how many of those who now argue in Zoom's favor have bought shares or are invested in any other way, like having bought licenses directly or indirectly for their company?

tinus_hn 7y ago

Is that list actually complete? It doesn’t sound like that much of a deal.

jka 7y ago

For anyone interested in Facebook's SDK behaviour on Android, there's a good video[1] from 35C3 covering this topic, and a related HN discussion thread[2]. [1] - https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_android/ https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_... [2] - https://news.ycombinator.com/item?id=18788658 https://news.ycombinator.com/item?id=18788658

jbverschoor 7y ago

I really don’t appreciate the downvoting mobs by certain companies.

greggman3 7y ago

I'm happy the Zoom doesn't want to help Facebook spy on me. Unfortunately the chosen solution is still a privacy nightmare. Basically they let you login to Facebook via an in app browser. The problem is an app can spy on all activity of an in app browser. That means you have to trust that Zoom is not recording your facebook password as you type it in. We need a better system. Also scary. I have never ever logged in to Facebook on my iPhone except via the Facebook app and it was the first time I've installed Zoom. When I went into the Zoom app and picked login via Facebook, somehow it knew who I was and asked if I wanted to login as me. How is this possible? Is iOS sharing cookies across apps? I feel like maybe I need to reset my phone. WTF I also feel like the best solution for this case is to somehow login via the facebook app. I know that used to be an option but it seems facebook deprecated it. My argument would be (a) I don't have to worry Zoom (or any other app) is getting my Facebook credentials (b) If actually do want to login via Facebook it's almost guaranteed I have the app installed.

codesternews 7y ago
Not in iOS. If they are using with webview or safariviewcontroller they can not access the browser cookies or data or most of device information.
- greggman3 7y ago
  Not true AFAICT. Given Chrome on iOS uses a webview and overrides all networking and given Firefox can inject JavaScript it seems trivial to use both of those features to spy on any webview activity
generalpf 7y ago
If they’re using ASWebAuthenticationController you can’t read passwords. You can’t even see which URL they’re on.
- RKearney 7y ago
  Is there a way for the end user to differentiate between that and a custom controller?

MUHAMMADRIZWAN 7y ago

https://bit.ly/2QTW8St https://bit.ly/2QTW8St

ababol 7y ago

>> we were made aware on Wednesday, March 25, 2020, that the Facebook SDK was collecting device information unnecessary So Zoom is basically lying here Come on, the developers who takes the responsibility to use the SDK were aware of it, ok maybe the CEO of Zoom or the market guy was not but the tech team is. They are not stupid. You should have just apologise and assume your fault, that would be the courageous position, not denying it. Tbh I am ok with Zoom sending my data to FB (I mean, in my case I've insta/messenger anyway) but not ok for Zoom taking everyone as naïve people with this lying statement.

madwhitehatter 7y ago
This is what scares most security analysts is the fact that the product was developed and stores data in a place that has incredibly sketchy laws when it comes to intellectual property. I can't see why Zoom can't come out with a statement regarding why they are collecting all of this sensitive data. Big corporations might be sharing stuff unwittingly with people that they don't want to share it with. https://www.sec.gov/Archives/edgar/data/1585521/000119312519083351/d642624ds1.htm https://www.sec.gov/Archives/edgar/data/1585521/000119312519... Top of page 21 in their SEC filing: "In addition, we have a high concentration of research and development personnel in China, which could expose us to market scrutiny regarding the integrity of our solution or data security features. Any security compromise in our industry, whether actual or perceived, could harm our reputation, erode confidence in the effectiveness of our security measures, negatively affect our ability to attract new customers and hosts, cause existing customers to elect not to renew their subscriptions or subject us to third-party lawsuits, regulatory fines or other action or liability, which could harm our business."

dbg31415 7y ago

Great, now if they would stop having an activity monitor that checked every process running on your computer, or made their web interface work with Firefox we’d be all set...

aledalgrande 7y ago

Just curious about the IP being sent to FB, isn't that PII? How can FB do this legally without the user agreeing to it first? Or did I miss something?

madwhitehatter 7y ago

https://www.theregister.co.uk/2020/03/27/doc_searls_zoom_privacy/ https://www.theregister.co.uk/2020/03/27/doc_searls_zoom_pri...

dylan604 7y ago

That's great for iOS users, but it doesn't mention anything about the Android client. Nor do they discuss the tracking that the webapp still does even though they explicitly state they still allow FB login via browser. Isn't this more of a sorry for getting caught rather than an actual apology?

cexilevuanh 7y ago

It seems that Facebook JS SDK also sends user behavior back to Facebook even when user doesn't click on the "Sign in with Facebook" button: https://simplelogin.io/blog/do-not-use-facebook-sdk/ https://simplelogin.io/blog/do-not-use-facebook-sdk/ On the Web, it's recommended to use a generic OAuth library instead of integrating Facebook JS SDK. On mobile, this is almost impossible though as Facebook doesn't implement the OAuth PKCE flow.

Ericsyuan 7y ago

Dear all, I am the CEO of Zoom. First, I sincerely apologize about this Facebook SDK issue. We learned a lesson, and we will do all we can to improve. I also wrote a blog. https://blog.zoom.us/wordpress/2020/03/27/zoom-use-of-facebook-sdk-in-ios-client/ https://blog.zoom.us/wordpress/2020/03/27/zoom-use-of-facebo... Please take care and be safe.

ponsin 7y ago
Hey, thank you for listening to security researchers and fixing a problem when you became aware. I know this is not so much a problem, but rather a business decision, but the product would be much more useable if it was possible to connect without the app without having to use some tricks. There have been many conferences that took much longer than expected to start because not everyone had Zoom
- Ericsyuan 7y ago
  Dear Ponsin, You are right on! To focus on our service stability and security are our top 2 priorities. We will work as hard as we can to keep improving. Thank you for your great support!

Mave83 7y ago

Thank you zoom.us for the best tool available right now with a fair and acceptable price model. A special thank you also for the great Linux support, that is absolutely unmatched from all other "solutions". I am very sorry that so many bad publicity happens right now, but as far I know even bad publicity is good in the end.

djsjejjdi324 7y ago
well, you know, bad publicity because of bad practices.