FaceTime privacy issue - callers can see previous meetings 😳

[richarddas]

A summary of the issue. This needs to be a clear detailed-rich summary.**

When configuring an Event Type, it's possible to add FaceTime as a Location. However, this url is applied to ALL Events that are created. When the Event is joined on FaceTime, all previous people who have joined that Event Type are visible to both the host and the guest.

Steps to Reproduce

1. Create a new Event Type
2. Add a Location of type 'FaceTime' (add from Apps)
3. In the url field, enter a FaceTime url that you copy from the FaceTime app on your Mac (or iOS device)
4. Allow someone to schedule a call
5. A calendar event is added to both the host and guest calendars, with the FaceTime URL set as the location
6. Join the call
7. End the call
8. Schedule a new call, of the same type
9. Join the call
10. You will see both the new guest AND THE PREVIOUS GUEST FROM THE OTHER EVENT listed in the attendees.

Any other relevant information. For example, why do you consider this a bug and what did you expect to happen instead?

People on a given meeting should only see invitees to the current meeting.

What's happening right now that is different from what is expected

see above

This is an ideal result that the system should get after the tests are performed

People on a given meeting should only see invitees to the current meeting.

Browser version, screen recording, console logs, network requests: You can make a recording with [Bird Eats Bug]

n/a

Evidence

How was this tested? This is quite mandatory in terms of bugs. Providing evidence of your testing with screenshots or/and videos is an amazing way to prove the bug and a troubleshooting chance to find the solution.

I learned this the hard way, by hosting a call with a customer, who could then see who my previous customer was from the day before!

[richarddas]

Would it be possible to add a url in the format: facetime:<user_id> instead? So that a new call is generated each time?

[richarddas]

I have had to quickly remove FaceTime as an option from all my Events, due to this issue.

After a bit of further investigation it looks like the FaceTime location type in the Event configuration is validating the url by ensuring it starts "http://facetime.apple.com/".

On the other hand, the location type "Link meeting" accepts facetime:<user_id> as a valid location, however this is displayed to users who are making the booking as "Link Meeting", with no explanation of what that is.

[richarddas]

@Mythie hey mate - I saw you were the one who first got FaceTime working, wondering if you have any insight on this, cheers! 👍

[PeerRich]

i agree this is a privacy concern. AFAIK facetime has no API to generate these unique links, no?

[PeerRich]

i removed the app from the app store until someone has an idea how to fix this

[richarddas]

Thanks @PeerRich — just FYI, I have 2 active Event types with FaceTime configured as a location, and that still appears active to visitors.

I do not know of any available API to generate unique links.

I have come up with a workaround, which has some pros and cons:

In my configuration I have created a Location type "FaceTime" (using the cal.com app) and set the URL to validate: "https://facetime.apple.com/join?v=1&p=" — this is an incomplete link as it is missing the call id, however cal.com does accept this as valid.

When a user books an appointment with me, I get an email notification as per normal. I then go to my FaceTime app (on my Mac, or device) and generate a Link URL. I go into cal.com/bookings and then add the URL specifically to the upcoming meeting. Then, both our calendar invites are updated with the correct URL, and as an added bonus the upcoming meetings appear in the FaceTime app with the title of the booking!

This is actually a great plus, however has the caveat that for each upcoming booking I have to manually generate a link, log into cal.com and update the booking.

Personally, I think this is an acceptable workaround and really love the fact that I can schedule appointments using FaceTime.

Perhaps we can think of ways to streamline the experience, to make the updating procedure a bit smoother for hosts?

[Mythie]

i agree this is a privacy concern. AFAIK facetime has no API to generate these unique links, no?

Not as far as I know either, I did try to find something that would hopefully do this during the initial implementation but had no luck in the matter.

[richarddas]

I can outline a proposal for a solution, where is the best place to put it? (Inline here?)

[richarddas]

Currently, with the app deactivated, FaceTime still appears as an option for visitors to my Event type, and they are still able to book meetings with me. However, as the app is not available in my interface, I am no longer able to update the URL to a valid link.

I propose a 3 stage solution, ranging from simplest (quickest) to more robust:

1. Re-enable FaceTime Cal.com app as-is.

Re-activate the FaceTime app (as it is), with an added message in the host interface that FaceTime links are not unique per Booking. (This would avoid the confusion I had in the first place!)

2. Update FaceTime Cal.com app

Update the FaceTime app to use the "incomplete" URL by default, so that when Booking .icals are emailed, they do not point to a call that can overlap users.

Add instructions for Hosts to ensure they log into Cal.com and alter the Location URL prior to the time of the booking.

Potentially auto-email hosts 48, 24hrs before a booking with a default URL occurs, to remind them to update it.

3. Enhance the FaceTime Cal.com app

Allow Hosts to add a batch of FaceTime URLs to the Cal.com interface, such that when new Bookings are created links are automatically taken from the available pool. Hosts only need to top up their list of FaceTime URLs periodically.

I'd welcome thoughts on the above, and would be very glad to contribute! Currently I think the ability to schedule FaceTime calls in this way is quite unique to Cal.com so would love to see the full potential realised!

[richarddas]

@PeerRich sorry to bug you, would it be possible to re-activate the App please, as I can no longer amend active bookings to provide a valid link to my clients?

Very keen to contribute here and get this working for everyone! 👍