Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many popular iPhone apps are recording user sessions without asking

techcrunch.com

Post reply on HN
Print view View original

31–40 of 126 posts

Re: Many popular iPhone apps are recording user sessions without asking

#31

Post by [deleted] »

cglace wrote: post #29
paxys wrote: post #11

> Many major companies, like Air Canada, Hollister and Expedia, are recording every tap and swipe you make on their iPhone apps. In most cases you won’t even realize it. And they don’t need to ask for permission. The key phrases here are "recording every tap and swipe" and "on their iPhone apps". I'm not saying it is okay, but the sensationalist headline takes away from the real issue.

I worked in this space and its definitly possible https://uxcam.com/ and https://appsee.com/ are other players in the space. They record the full screen by default. Much like fullstory for desktop.

[deleted]

Re: Many popular iPhone apps are recording user sessions without asking

#32

Post by crispytx »

People that complain about this stuff obviously have never launched an app before. If you don't record what people are doing with your app, then you're not going to have any idea if anyone is actually using it, or if it is any good, or if there is anything you need to fix.

Re: Many popular iPhone apps are recording user sessions without asking

#33

Post by userbinator »

paxys wrote: post #11

> Many major companies, like Air Canada, Hollister and Expedia, are recording every tap and swipe you make on their iPhone apps. In most cases you won’t even realize it. And they don’t need to ask for permission. The key phrases here are "recording every tap and swipe" and "on their iPhone apps". I'm not saying it is okay, but the sensationalist headline takes away from the real issue.

"Many popular iPhone apps record what you do with them" would be perfectly accurate and less sensationalist.

I saw the title and thought "so the app is recording what's on the screen... which on a phone, is going to be itself... that's not such a big deal." As much as I don't like this sort of telemetry, it is in no way the sort of security issue the title appears to be insinuating.

Re: Many popular iPhone apps are recording user sessions without asking

#34

Post by saagarjha »

crispytx wrote: post #32

People that complain about this stuff obviously have never launched an app before. If you don't record what people are doing with your app, then you're not going to have any idea if anyone is actually using it, or if it is any good, or if there is anything you need to fix.

> If you don't record what people are doing with your app, then you're not going to have any idea if anyone is actually using it, or if it is any good, or if there is anything you need to fix.

There are other ways to get information as to what to fix, and I have no need to know what people are doing in my app.

Re: Many popular iPhone apps are recording user sessions without asking

#35

Post by rnotaro »

notable_user wrote: post #14
fitzroy wrote: post #8

"Record the screen" could be more precise. I assumed the article was saying apps were literally recording a video of the screen, complete with alert popups etc (like the Screen Recorder app). I realize there isn't functionally much difference within an app. But unless I'm reading it incorrectly, it's not recording the screen it's just the UI of the app. That's not nothing, but I always assumed (sadly?) that a lot of…

The real take away is that they’re sending all text typed in, including credit card and social security numbers, unencrypted to a third party.

Source? This would probably fail some compliances audit.

Most of these kind of tools (ie:HotJar) have a flag that will prevent theses data from being sent.

Re: Many popular iPhone apps are recording user sessions without asking

#36

Post by saagarjha »

wmf wrote: post #18
MagicPropmaker wrote: post #17

Users are very bad at describing what they did when an app crashed. Recording application state and logging it is a wonderful aid to debugging. I did this routinely when deploying in-house applications.

Maybe Apple should make this into a built-in iOS feature with proper privacy and data minimization.

Even when your app crashes, Apple gives you crash log and nothing else, so I don't see they providing a way to tag users more granularly than this.

Re: Many popular iPhone apps are recording user sessions without asking

#37

Post by vlozko »

I’ve worked with a similar library before: appsee. While it does have a little bit of value in helping trace crash reports and provide heat maps, we ultimately got rid of it and for the better. It can be hard to find and “cover up” every single place where sensitive information can be displayed. That’s really up to the developer to manually do most of it, though some of it is done automatically (e.g. password fields). Even the most well intentioned developer can miss out on a label that shows th user’s email or a text field with address data. And that’s just the developers who know about this challenge and try to do something about it. I’d venture many don’t. Just as bad is the performance hit. Taking screenshots utilizes the main thread (no way around it) and it just kills any attempts at making buttery smooth animations throughout the app. Suffice to say, such libraries are just not worth it for the perceived value they allegedly provide.

Re: Many popular iPhone apps are recording user sessions without asking

#39

Post by YeahSureWhyNot »

sensationalist bs. how is ability to watch a screen recording of you using their app and typing in your credit card into THEIR app is different from the same app developer just pulling up your credit card info from their database? if you give the info to the app, the app owner will see your info. as discussed as that. the fact that its in a form of screen recording doesn't make it scary or dangerous.

Re: Many popular iPhone apps are recording user sessions without asking

#40

Post by foobiekr »

YeahSureWhyNot wrote: post #39

sensationalist bs. how is ability to watch a screen recording of you using their app and typing in your credit card into THEIR app is different from the same app developer just pulling up your credit card info from their database? if you give the info to the app, the app owner will see your info. as discussed as that. the fact that its in a form of screen recording doesn't make it scary or dangerous.

Well, one extremely important difference is that I might trust company X in part because they will want to preserve their brand but not trust poorly-run user-analytics company Y that a part of X uses which will give X plausible deniability for responsibility.

The other is that PCI helps mitigate their handling on the CC side but those user analytics companies aren't part of that.

Post reply on HN