Zoom has removed its “Login with Facebook” feature using the Facebook SDK for iOS as the Facebook SDK was collecting device information unnecessary for Zoom to provide its services.
In a recent blog, Zoom said they originally implemented the “Login with Facebook” feature using the Facebook SDK for iOS (Software Development Kit) in order to provide their users with another convenient way to access the platform. However, they were made aware on Wednesday, March 25, 2020, that the Facebook SDK was collecting unnecesary device information.
The information collected by the Facebook SDK did not include information and activities related to meetings such as attendees, names, notes, etc., but rather included information about devices, such as the mobile OS type and version, the device time zone, device OS, device model and carrier, screen size, processor cores, and disk space, Zoom said.
"Our customers’ privacy is incredibly important to us," noted Zoom. Therefore, Zoom decided to remove the Facebook SDK in the iOS client and have reconfigured the feature, so that users will still be able to log in with Facebook via their browser. In addition, Zoom thanked Joseph Cox from Motherboard for alerting Zoom to this privacy concern.
Chris Hazelton, Director of Security Solutions at Lookout, noted Lookout analyzed the latest version of Zoom and confirmed that they are still communicating with Facebook APIs in the current iOS version of the Zoom app. "We have analyzed more than 100 million apps, and allow organizations to analyze any mobile app to identify cybersecurity and privacy threats. Zoom did update their app with version 4.6.9, which was updated to three days ago for “Improvements to Facebook Login”. The app communicates with IPs in the US, China, India, and Germany. This is to leverage APIs from Alibaba, Box, Dropbox, Facebook, Google, Microsoft, RingCentral, WeChat and QQ."
Below are details from a Lookout App Analysis of the iOS Zoom app, generated on March 30, 2020, that verifies Zoom did update their app: