4 ms·

Headline should technically read: "Zoom Removes Code That Sends Data to Facebook when you first open the app" as per the article: "Motherboard downloaded the

Headline should technically read: "Zoom Removes Code That Sends Data to Facebook when you first open the app" as per the article: "Motherboard downloaded the update and verified that it does not send data to Facebook upon opening." It's a bit naive to just assume that just because they don't send the data right away, that it's not getting sent at some point later on.

noahtallen 7y ago
> we decided to remove the Facebook SDK in our iOS client and have reconfigured the feature so that users will still be able to log in with Facebook via their browser. Since they removed the Facebook SDK entirely, whatever mechanism Facebook used to collect the info doesn’t exist any more. Instead of being able to collect the data at all times, wouldn’t FB only have a vector to do so through web login? At that point, I assume they could do fingerprinting in the browser to collect some info, but at least the cannot do it on the system level any more. It still seems like this is a big improvement. Though, I imagine most folks will have at least one other app using the FB SDK, so it’s not like the root cause is fixed.
- diebeforei485 7y ago
  On recent versions of iOS, in-app browsers do not share data with the Safari browser. How effective would browser fingerprinting be? Everyone with the same device, same language/locale and same timezone should have the same browser fingerprint, I thought.
  - saagarjha 7y ago
    > On recent versions of iOS, in-app browsers do not share data with the Safari browser. Specifically, SFSafariViewController does not share cookies or other data with Safari anymore. Some bad actors got caught with their hands in the cookie jar, literally, and out that sharing went.
    - greggman3 7y ago
      The do still share something. In response to this headline I installed the Zoom app and picked to login with Facebook. A browser popped up showing the facebook webpage and said "Login as Gregg Tavares?". Since I just installed app how did Facebook know it was me? The only possibility that comes to mind is that Safari was using cookies from some other app's embedded webview.
      - leesalminen 7y ago
        I believe the cookies passed into the webview are limited to a specific domain. So the app developer says “open a webview for Facebook.com” and the webview includes cookies only for the stated domain.

noahtallen 7y ago

> we decided to remove the Facebook SDK in our iOS client and have reconfigured the feature so that users will still be able to log in with Facebook via their browser. Since they removed the Facebook SDK entirely, whatever mechanism Facebook used to collect the info doesn’t exist any more. Instead of being able to collect the data at all times, wouldn’t FB only have a vector to do so through web login? At that point, I assume they could do fingerprinting in the browser to collect some info, but at least the cannot do it on the system level any more. It still seems like this is a big improvement. Though, I imagine most folks will have at least one other app using the FB SDK, so it’s not like the root cause is fixed.

diebeforei485 7y ago
On recent versions of iOS, in-app browsers do not share data with the Safari browser. How effective would browser fingerprinting be? Everyone with the same device, same language/locale and same timezone should have the same browser fingerprint, I thought.
- saagarjha 7y ago
  > On recent versions of iOS, in-app browsers do not share data with the Safari browser. Specifically, SFSafariViewController does not share cookies or other data with Safari anymore. Some bad actors got caught with their hands in the cookie jar, literally, and out that sharing went.
  - greggman3 7y ago
    The do still share something. In response to this headline I installed the Zoom app and picked to login with Facebook. A browser popped up showing the facebook webpage and said "Login as Gregg Tavares?". Since I just installed app how did Facebook know it was me? The only possibility that comes to mind is that Safari was using cookies from some other app's embedded webview.
    - leesalminen 7y ago
      I believe the cookies passed into the webview are limited to a specific domain. So the app developer says “open a webview for Facebook.com” and the webview includes cookies only for the stated domain.