Facebook sued for skirting Apple privacy rules to snoop on users

https://www.bloomberg.com/news/articles/2022-09-22/meta-sued-for-skirting-apple-privacy-rules-to-snoop-on-users

by JumpCrisscross • 4 years ago

370 124 4 years ago

bloomberg.com

greyface-• 4 years ago

Dockets:

https://www.courtlistener.com/docket/65365093/willis-v-meta-...

https://www.courtlistener.com/docket/65352415/mitchell-v-met...

artursapek• 4 years ago

lol Facebook is shameless

mtoner23• 4 years ago

Sure this sucks, but its the in-app browser. probably totally follows apples rules.

sybercecurity• 4 years ago

Can Apple really enforce what goes on in an app? Probably only by rejecting it from the app store, but that's risky on Apple's part and would cause a lot of user complaints.

Cthulhu_• 4 years ago

To a point; they control all the interfaces, which is why an app like Facebook cannot access your photos, location or address book without your explicit permission.

And Apple has gone for the nuclear option of removing apps from the store; not long ago they booted Fortnite, one of the big earners (billions in revenue of which Apple got a percentage through their commissions), after they added a means to circumvent the app store fees, starting a long proceeding into getting it lowered or dismissed entirely - partially successful in specific jurisdictions.

ben7799• 4 years ago

Apple should change the rules to reject apps that try to open links in an in-app browser instead of sending the user to Safari.

Maybe as a workaround let Meta put up their own browser on the app store and make it possible for a user to choose to let let the FB app send links to the Meta browser for someone who really wants this behavior.

But don't allow the FB app to do this with no way for the user to stop it.

Chrome for iOS seems to exist for exactly the same reason, to provide a way for google to track users.

jjulius2• 4 years ago

probably totally follows apples rules.

I've only ever used Android, so I'm ignorant here to how iOS operates and, to a certain extent, the rules Apple has in place around this sort of thing. I would think, though, that this sentence is key:

The Facebook app gets around Apple privacy rules by opening web links in an in-app browser, rather than the user’s default browser, according to Wednesday’s complaint.

If FB is supposed to follow iOS settings by opening links in the default browser set by the user, but is intentionally not doing that here so that they can maximize the data they collect, then yeah they'd be breaking rules.

codazoda• 4 years ago

I don't think there's any such rule. Ton's of apps open things in their own browser instead of leaving the app.

jclardy• 4 years ago

The "in-app browser" is Safari, not their own rendering engine (Which is explicitly disallowed.) The difference between in-app safari and external...is that the app can get callbacks for every link tapped within the in-app browser, and the app itself can inject javascript into each web page it loads, which essentially means unlimited perfect tracking for social networks (Since the user is already logged in to the app.)

This sounds bad...but the integrated webview is necessary for things like Cordova/Ionic/React Native/etc to exist on the platform. It's also a byproduct of iOS's pre-multitasking days where launching out to Safari was a big context change, vs now where you can just swipe back to the app you were in.

ascagnel_• 4 years ago

If FB is supposed to follow iOS settings by opening links in the default browser set by the user, but is intentionally not doing that here so that they can maximize the data they collect, then yeah they'd be breaking rules.

Users can't set a default browser on iOS. Apps can choose to open URLs in one of two in-app webviews (the old WKWebView or the newer SafariViewController), or they can use the "universal links" option to allow the system to open a URL (which can be redirected to another native app, should one be available to handle the domain). While SafariViewController is more full-featured (it forces the use of the system default share control and shows the URL), a lot of sketchier apps prefer to use the older WKWebView (where they can better customize the UI, hide system default controls, and hide the URL). Since WKWebView hides the URL, you can somewhat transparently route users through tracking domains (something I already observed Twitter doing), which may also be the vector Meta is using to inject JS.

All this said, the visual customization of WKWebView also has a legitimate use: many apps use it for showing regular in-app screens, not just for an internal browser.

Well-made third-party apps (Tweetbot for Twitter, Apollo for Reddit) generally let the user choose between SVC or just letting the system handle the URL, because they're not interested in monetizing user data in the same way.

latexr• 4 years ago

“Instagram and Facebook can track anything you do on any website in their in-app browser”: https://news.ycombinator.com/item?id=32415470

stevewatson301• 4 years ago

Couldn't Apple's ATT be enforced at a technical level, giving poisoned information such as XPrivacy did in its heydays, or by preventing JS injection in webviews?

wilde2• 4 years ago

Eh, if they're going to do that I'd rather they just force developers to use normal Safari for external links. It'd be easier to verify and I'd get to finally keep my cookies and not log in to news sites for the 100th time.

alkonaut• 4 years ago

Apple could still targhet specific endpoints deliberately for repeeat offenders also in the normal Safari.

They could have a privacy feature (default on) which blocks or poisons specific endpoints on specific hosts belonging to e.g. Meta, Alphabet, ByteDance.

Apple are in a unique position here to protect users' privacy since they control the browser of so many. It's unfortunate that they also have their own advertising agenda so any steps they take will always be scrutinzed as being anti competitive and simply making their own ads more profitable. But I'd still want Apple to pull the trigger on more drastic measures like these. The last round of privacy isolation should just be the start. I'd love to see apple e.g. block Facbook ads inside the facebook app and refer to privacy concerns and only unblock them if Meta follows all privacy guidelines elsewhere.

Aulig2• 4 years ago

Preventing JS injection would make lots of legitimate use cases impossible. I really hope Apple doesn't punish all developers for Facebook's actions.

rvz• 4 years ago

Just like Google getting fined, not even Facecbook (Meta) should be allowed a pass on trying to escape this evasion and continuing to violate user privacy and collect more personal identifiable information (PII).

As soon as they lose, they should be fined in the multi-billions of dollars again, much higher than the FTC fine that they got years ago.

Given that they won't ever change, the fines should just get higher.

sircastor• 4 years ago

A little while back I recall some pundit describing Facebook as believing that this kind of data was theirs. Not “theirs for the taking”, but literally if they could find a way to obtain it, they considered it their right to have it. Like it was baked into the culture of the company. The more I read about Facebook’s practices, the more it rings true.

seibelj• 4 years ago

There was a belief for a time that consumers no longer cared about privacy, that the millennial generation preferred to share everything, and harvesting data was fine because the concept of privacy was antiquated.

What surprised a lot of tech execs was that when people understood how much data was collected they got creeped out and when given the option to opt-out of data collection they agreed at very high rates.

Apple's move to limit in-app tracking was genius because any lawsuit from FB or similar is counter-productive - consumers are given the option and they opt out at 99%. Suing Apple to force them to let FB track consumers would be a PR disaster.

gjsman-1000• 4 years ago

Have you ever read Yurtle the Turtle by Dr. Seuss? It’s the story of a turtle who considered himself “the king of all that I can see,” and kept building a tower of turtles higher and higher to see more, and thus rule more…

yanderekko• 4 years ago

There was a belief for a time that consumers no longer cared about privacy, that the millennial generation preferred to share everything, and harvesting data was fine because the concept of privacy was antiquated.

It's not like this is wrong. If you give consumers the choice of paying $5/month directly for some service vs. providing $5/month in personal data then they'll pretty much always choose the latter - I don't believe this has changed.

What has changed is that now third parties are better-able to disrupt companies from Meta from silently harvesting personal data as a default, and consumers generally don't mind this because they see the result as them getting to use the data-harvesting websites for free. Just like they're happy to use adblockers even if that collectively results in sites having to use heavy-handed subscription policies. If you give people the option to free ride, it's not surprising that they do it.

itslennysfault2• 4 years ago

Anecdotally every non-tech person I know gives literally zero Fs about their data/privacy. They're FAR more annoyed by the cookie / tracking pop-ups than what they represent, and would generally opt to just be tracked everywhere than be annoyed with the question. I'd also say that the majority of my tech friends feel about the same, and do not care, and have the "I have nothing to hide / who cares if they see my boring life" attitude.

Mountain_Skies• 4 years ago

IIRC, Facebook got its start by scraping student data from university servers. If so, the belief that any data it can get its hands on is fair game pretty much is the foundation of the company.

beezlebroxxxxxx• 4 years ago

Zuckerberg and a lot of tech/SM CEOs have a strong "rules for thee, not for me" vibe when it comes to personal privacy. One day they'll claim "privacy is outdated" or "a matter of context" in relation to their business, and the next they'll spend fortunes to protect and insist on personal privacy for their family and themselves. One can only imagine that billions they make do a lot to paper over the ethical void at the heart of many of the businesses under their control.

lioeters• 4 years ago

Exactly why I consider Facebook to be a monstrously overgrown malware that was allowed to become a corporation.

JohnFen3• 4 years ago

Yes. Facebook was a skeezy company at the start, and has never stopped being so.

AlexandrB• 4 years ago

Of course it's baked into the culture of the company. The CEO famously called his users "dumb fucks"[1] for trusting him with their data. As far as I'm concerned there's no reason to think his basic attitude has changed. Just the messaging has gotten better.

[1] https://www.esquire.com/uk/latest-news/a19490586/mark-zucker...

jbullock352• 4 years ago

The CEO famously called his users "dumb fucks"[1]

The sourcing for that claim is extremely poor. The Esquire article links to a Business Insider article from 2010, which in turn cites "anonymous sources" on a 2004 IM conversation:

According to SAI sources, the following exchange is between a 19-year-old Mark Zuckerberg and a friend shortly after Mark launched The Facebook in his dorm room

supertrope• 4 years ago

“It is difficult to get a man to understand something, when his salary depends on his not understanding it“

npteljes• 4 years ago

Sounds like an iteration of "might is right".

https://www.merriam-webster.com/dictionary/might%20is%20righ...

duxup• 4 years ago

It doesn't seem like there are ANY rules at Facebook.

They put out a vpn app targeting kids ... and when told not to do that they renamed it and put it back on the store a little while later.

If they can get it they'll do whatever it takes.

dotdi• 4 years ago

https://archive.ph/rB7oD

m3tashameless• 4 years ago

Wonder if similar lawsuits are going to happen in Europe, hopefully it happens here too and the fine is a % of the revenue, fuck f$ceb$$k.

joshstrange13• 4 years ago

Yes, I understand why Apple doesn't pull FB/IG/WA/Uber/etc but as a smaller developer it's incredibly frustrating to have the full rules applied to me but not the big players.

A week or two ago I had to fight with app review over some functionality that was behind a login screen (they thought it should be public, I disagreed) and for my pre-permission-request screens (you know, the screen almost every app shows before firing the system prompt). Turns out you can have that screen but you can't ask a question on that screen or offer a way to dismiss and not get the system dialog. That was news to me since I had seen countless "Do you want to enable push notifications (yes|no)?" screens in top apps but that rule has changed and no longer allows you to pre-ask. I complied but the very next day I opened an app from a billion dollar company and I got a pre-ask that I was able to dismiss without popping the system dialog. wtf...

Why am I expected to bend over backwards for app review when these serial abusers get a free pass (no ban AND they can do things smaller apps get slapped down for)?

I know the answer is "money" but I fucking hate it.

galleywest200• 4 years ago

Removing text seems like an incredibly minor change request.

joshstrange13• 4 years ago

Removing text seems like an incredibly minor change request.

Can you expand on this? I'm not exactly sure what you mean. To clarify, I had 2 issues:

* App review thought part of my app should not be being a login screen, the data on this screen was fetched via our API was was authenticated (not a super easy change to expose that and we don't expose it to unauthed clients on purpose.

* Our app asked the user if they wanted to allow location access to see nearby stores on our map page (only asked when they went to the map page). We didn't pop the system dialog unless they agreed first to our own permission prompt (since you can only pop the system dialog once). This is against the rules now, which is fine, my frustration stems from continuing to see this practice everywhere.

jasonlotito• 4 years ago

It might be if your only language is English. If not, it requires going back and getting translations done again. And it's not necessarily as easy as just removing the offending text. Text is very contextual, and the removal of some text might necessitate changing other text.

I'd not want to suggest that something is "minor" in a system I'm not familiar with.

secretsatan• 4 years ago

FB did once have their developer certificate once by Apple : https://arstechnica.com/gadgets/2019/01/facebook-and-google-...

joshstrange13• 4 years ago

Right but that was just their enterprise cert and didn't affect their big apps, only internal apps and their gross VPN apps (which they were distributing via enterprise cert to get around app review).

cageface2• 4 years ago

My life has improved immeasurably since I gave up iOS dev and went back to the web. My baseline frustration level is so much lower.

joshstrange13• 4 years ago

That might be a viable path if not for push notifications and the fact that companies want an app more than anything. I've used cross platform frameworks in the past and had the web version up and all I hear is "when app?", even though it's the same codebase, same look, sometimes without even leveraging anything like push notifications or other app-only features. They literally will not even look at the web version. I've proven this over 10+ different companies. I deliver the web version, then I get started on app store hell and only after the app (iOS is all they often care about, at least at the start) is out do they start giving feedback. It's frustrating since they normally have had access to the identical web version for weeks but they just don't care.

I love the web, but users and companies just want apps, and I want to get paid.

pier25• 4 years ago

I did the same. Dealing with Apple was an endless source of frustration.

ffhhj• 4 years ago

It seems that the golden age of apps is comming to an end. One of my many apps gets banned daily by Google due to some silly rule interpretation, which among them include what seems to be punishment for using an ad provider different from AdWords or whatever they call it now.

blint_carton• 4 years ago

Agreed. I supported a relatively large retail app (about a million users) with a team of 5-8. Apple review process was always a risk. I've had times as well where my submission was denied, but in the appeal process would point to a larger app that did the same thing and it would rarely help.

joshstrange13• 4 years ago

The reply I got when I pointed at other apps was "Please file a report via the App Store, other apps not following the rules doesn't give you a free pass". :rolleyes:

I also once got told (on the phone with a reviewer) that I couldn't say

    Allow "My App" to use your location?

In the title of the permission dialog because I was "leading" the user to allow. Never mind that the title of that dialog is system-generated and you can only edit the description that shows underneath. I went 3-4 rounds with the reviewer saying I didn't control that while they insisted I did/could. I finally gave up, made 1 other change they requested, then resubmitted and it went through. Reviewer roulette sucks.

tonmoy• 4 years ago

For what it’s worth, I know FB/IG spies on me and avoid installing their apps, whereas I’d feel much safer with a small app like yours.

TedDoesntTalk2• 4 years ago

Same here. I only use Facebook and IG websites on mobile.

justapassenger2• 4 years ago

Counter argument - small apps _usually_ have much more trackers, coming from many different sources. As a result, your data is syphoned to many dozens of entities, and each of the faces less scrutiny than FB/IG.

eloisius• 4 years ago

or offer a way to dismiss and not get the system dialog.

I wish it was applied fairly, but I am thankful for that rule, because it reduces the amount of “soft requests” where the app will continue to pester me relentlessly about enabling access to my contacts or something

joshstrange13• 4 years ago

I see both sides here. It'd be different if I didn't hear from clients/users about how they can't get push/location/etc feature to work only to find out they dismissed/denied the initial request. I have code I move from project to project to handle the soft-request and to handle the "you denied the system request, let me guide you to where you need to go in settings to fix this". Turns out my soft-request code goes against the rules (ok, that's fine, I just with it was constant) so I'll remove that but getting only 1 try to request is rough (though I agree it would be worse if apps could request that an unlimited number of times). I don't know what the good middle ground is here, maybe 1 request is the middle ground.

delecti• 4 years ago

It might not work on iOS, but at least on Android one trick is to accept the "soft" request, and then reject the OS dialog.

hedora2• 4 years ago

This sounds like classic anticompetitive collusion between monopolies to me.

If this behavior really is common, I suggest complaining to the relevant authorities.

joshstrange13• 4 years ago

I know you are trying to be helpful but I can't stop laughing. There are no "relevant authorities", it's Apple/Google's way or the highway. Even if there were "relevant authorities" I don't have the funds/time to buy the justice I want.

toast0• 4 years ago

but that rule has changed and no longer allows you to pre-ask. I complied but the very next day I opened an app from a billion dollar company and I got a pre-ask that I was able to dismiss without popping the system dialog. wtf...

Apple enforcement on rule changes has several different options:

a) only applied to new apps

b) only applied on next app submission

c) app will be removed on date unless it's fixed

This sort of change seems likely to be in category A, and then over time will be in category B and eventually the billion dollar apps will get an update denied until they fix it. They may drag their feet a little or a lot first.

Some of the subjective review things will get flagged only sometimes, so you might get through if you resubmit with no changes, or if you only address some of the requests. Inconsistent enforcement is frustrating, of course.

joshstrange13• 4 years ago

I know this is the case for certain changes such as allowing users to delete their accounts. I remember the new apps/updates being bifurcated with updates being allowed for a few months after it went into effect for new apps but for this system dialog change I'm not aware of anything being said publicly about this, I think the rules just changed internally. My google-fu might be failing me but I can't even find articles about this change. It was news to me (it's in the HIG, not in the guidelines) when we got hit with it and normally I keep abreast of any new requirements/rule-changes and when they go into effect.

I completely understand and agree with the different options you outline but I don't think that was done in this case, at least publically. Please, if I'm wrong and someone has a link to an article about this I'd love to see it/know about it.

isodev• 4 years ago

Imaging myself getting the same treatment as Facebook - as an indie dev, I prefer my app to get rejected rather than deal with a lawsuit of that magnitude. Complying with App Review guidelines is a small effort, after all.

s1k3• 4 years ago

I actually specifically decided not to start any app companies because of the risk inherent with being on the App Store. Apple wield their power to heavy handidly. I’ve been affected by it at my last couple of jobs where apple just stonewalls or otherwise makes a complete mess of trying to get something in the App Store. It’s too much platform risk. They’re starting to push innovators away.

JimDabell4• 4 years ago

Turns out you can have that screen but you can't ask a question on that screen or offer a way to dismiss and not get the system dialog. That was news to me since I had seen countless "Do you want to enable push notifications (yes|no)?" screens in top apps but that rule has changed and no longer allows you to pre-ask.

We regularly (multiple times per month) launch new applications in new Apple developer accounts where we present a screen explaining what notifications we send and two buttons, one of which says “Notify me” that triggers the system permissions prompt, and one of which says “Not now” and continues without triggering the system permissions prompt.

I’m not sure of the precise difference Apple sees between what you are doing and what we are doing, but this is not a roadblock for us, so perhaps copy that approach more closely and Apple will relax a bit?

joshstrange13• 4 years ago

I'm in the exact same boat as you. It's a whitelabel app that we have launched many times in the past on new Apple Developer accounts but we just randomly got hit with this. Our screen also said "Enable Location" or "Not now" but that wasn't satisfactory. If you look at the "Pre-alert screens" section of this HIG document [0] you will see even your way of doing it isn't allowed but with all things app review, it's a game of roulette if the reviewer notices/cares. I've run into this before where I set up 2 apps within days of each other, different accounts, same core base base, and one gets dinged in review and the other doesn't.

I've shipped new apps that didn't have the ability to delete user data well after Apple's deadline and some sneak through ("sneak" but I wasn't trying to sneak, I just forgot to add it to one of my apps, I quickly added it in the next update so I didn't run into a brick wall later if they noticed) and some are caught.

[0] https://developer.apple.com/design/human-interface-guideline...

isk517• 4 years ago

I just got back from a trip were I was visiting a lot of older relatives and everyone of them now has a iPad that about 40-70% of their usage is FaceBook. In a battle between Apple and Meta I honestly wonder who would blink first but my money would be on Meta. Apple has already made their money and the primary FaceBook audience isn't rushing out to buy a new iPad every year, where as losing complete access to the Apple market would immediately have a huge impact on Meta's bottom line.

classified• 4 years ago

Let me get this straight, they are serial offenders and apparently incapable of even realizing that they're doing wrong. Any non-rich person would at least end up in psychiatric care for something like that, but we let these psychopaths run free?

Tijdreiziger• 4 years ago

If you're rich, it's just called 'eccentric'.

pGuitar• 4 years ago

They put all the blame on the company, which is legally considered a person that can't go to jail (because it isn't a person).

maxwell• 4 years ago

https://library.osu.edu/dc/concern/generic_works/sx61dq02c

null_object• 4 years ago

If an app needs a webview, it should always strive to open that view in an embedded Safari webview (called an SFSafariViewController) or link to the view in the user's own choice of browser. The app is prevented from seeing ‘inside’ this view.

Sometimes an app needs to control some aspect of the external view - for instance listen to some Js event, or inject authorization - and this can be for totally legitimate reasons in the flow of the app. Then the application needs to use another type of embedded webview called a WKWebView, which by definition allows the app to see into the user's interactions in the embedded browser.

Most developers and apps use these for totally necessary reasons - but Facebook is deviously abusing this functionality.

Some of the posters in this thread are blaming Apple for Facebook's evil behavior, but a lot of totally legitimate functionality that needs this type of app/browser communication would be impossible without the ability to enable it for genuine and well-founded reasons.

mooman219• 4 years ago

If "skirting Apple privacy rules" amounts to opening a web link, then it absolutely is Apple's fault. If Apple provided SFNextPaymentsInformationExporter, and a malicious app used that nefariously, and then the app was approved, that's entirely on Apple.

If Apple wants to advertise security and privacy, as well as enforcing App reviews, then I consider that to be enough to hold them accountable if they fail their advertised promise. Apple did not respond by removing the offending app from their store either.

aborsy• 4 years ago

> The suits are based on a report by data privacy researcher Felix Krause, who said that Meta’s Facebook and Instagram apps for Apple’s iOS inject JavaScript code onto websites visited by users. Krause said the code allowed the apps to track “anything you do on any website,” including typing passwords.

Does it mean that Facebook can exfiltrate users’ passwords for any website?

rawling• 4 years ago

Yes, if you open it in the in-FB-app browser and log in.

revscat• 4 years ago

The Facebook app gets around Apple privacy rules by opening web links in an in-app browser, rather than the user’s default browser, according to Wednesday’s complaint.

TikTok does the exact same thing.

Aulig2• 4 years ago

I hate that Facebook has to abuse the freedom of injecting Javascript into WebViews. This is why we can't have nice things.

I fear that this will lead to an overreaction from Apple that results in blocking or severely limiting this feature, which will be a huge issue for apps that depend on it for legitimate reasons.

JohnFen3• 4 years ago

The abuse of Javascript is a longstanding tradition, far from unique to Facebook. It's why I don't allow JS to execute on my machines by default.

nocsi3• 4 years ago

Facebook would just argue user experience - which is true, users do prefer to stay in the app. Users don’t really understand this behavior, however. I’m sure there have been users that have opened links in FB, then decided to go log into their bank on the same session.

If apple were to address this, they might end up monitoring the inapp browser and prompting for the user to hop out into safari depending on the url. As of now, apps like FB discourage reopening sessions in safari. The worst ones are like LinkedIn which requires like 2-3 key presses to reopen in safari. It’s clear these apps have an incentive in keeping users within the inapp browser

daniel-cussen• 4 years ago

I like this. This is competition. Apple is drawing Facebook out. I like both companies but the incentives of any trillion-dollar company are very fucked and it helps Facebook internally when they get sued for breaking the rules. Let he without sin cast the first stone, everybody breaks some rule at some point, it's original sin and inescapable. Even saints sin, they just also atone. This helps Facebook's angels on its shoulder speak up with bigger numbers--which is the name of the game--and drown out the devil on the left. Like wouldn't it be good for--extreme example--Judas if he put a price of thirty pieces of silver against betraying Jesus? That mitigates temptation.

Slaps on the wrist are harmful especially for those receiving slaps on the wrist. No moral development.

How does this apply to a FAANG company? Nobody knows--better than another FAANG company. Yes they know each other yes they hire each other's employees yes cross-polination yes yes yes--but they also compete. And when they hold back on competition, they at least do the public the favor of doing so at a very high cost--like Apple taking $20,000,000,000 from Google in exchange for not entering the search engine market. So there the higher the price extolled, the better for the public. The higher the price, the harder for Google to pay it to avoid competition, and the more likely it will not be paid which leads to competition.

In practice every FAANG company competes against all the others on everything. This is a success! Google can't beat Apple on smartphones, and Apple can't beat Google on search (even if they wanted to), so both companies have money, so they duke it out in every battleground beyond their moat. If they don't have a moat, however, they go to shit and can't carry out that competition in every other field.

iroh2727• 4 years ago

I saw an article recently where an FB spokesperson was arguing—albeit in an indirect, fluffily-phrased way—that in order to be able to only track you in the places X where they're allowed to and not the places Y they're not allowed to, they need to track you everywhere (X+Y) to know if you're in X. That way, presumably, they can be sure to not track you in X.

I gotta find that article again...

Facebook sued for skirting Apple privacy rules to snoop on users

Related Stories