Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many popular iPhone apps are recording user sessions without asking

techcrunch.com

Post reply on HN
Print view View original

41–50 of 126 posts

Re: Many popular iPhone apps are recording user sessions without asking

#41

Post by o10449366 »

paxys wrote: post #11

> Many major companies, like Air Canada, Hollister and Expedia, are recording every tap and swipe you make on their iPhone apps. In most cases you won’t even realize it. And they don’t need to ask for permission. The key phrases here are "recording every tap and swipe" and "on their iPhone apps". I'm not saying it is okay, but the sensationalist headline takes away from the real issue.

I've been seeing the same sensationalist language even in "respected" publications like the NYT lately. For example, they recently published a story where it was implied that because Spotify's Messenger plugin has standard read/write permissions (necessary to ensure basic functionality like sharing songs) that it could also actively monitor, store, and modify your private messages.

In smaller publications, some shoddy reporting can often be attributed to a lack of experience or resources. It's hard to find an excuse for larger publications with well-established editorial resources, however. These stories are presented under the guise of public interest, but in reality they seem increasingly driven by politics and sinister ulterior motives. The end result is the spread of misinformation and further public distrust of the media and technology as a whole.

Re: Many popular iPhone apps are recording user sessions without asking

#42

Post by ryanwhitney »

userbinator wrote: post #33
paxys wrote: post #11

> Many major companies, like Air Canada, Hollister and Expedia, are recording every tap and swipe you make on their iPhone apps. In most cases you won’t even realize it. And they don’t need to ask for permission. The key phrases here are "recording every tap and swipe" and "on their iPhone apps". I'm not saying it is okay, but the sensationalist headline takes away from the real issue.

"Many popular iPhone apps record what you do with them" would be perfectly accurate and less sensationalist. I saw the title and thought "so the app is recording what's on the screen... which on a phone, is going to be itself ... that's not such a big deal." As much as I don't like this sort of telemetry, it is in no way the sort of security issue the title appears to be insinuating.

How is that not a major privacy and security issue? A screen recording of your session would expose passwords in many cases as the characters show up one at a time before being masked.

Re: Many popular iPhone apps are recording user sessions without asking

#43

Post by ryanwhitney »

rnotaro wrote: post #35
notable_user wrote: post #14

Earlier quoted context omitted.

The real take away is that they’re sending all text typed in, including credit card and social security numbers, unencrypted to a third party.

Source? This would probably fail some compliances audit. Most of these kind of tools (ie:HotJar) have a flag that will prevent theses data from being sent.

> In the case of Air Canada’s app, although the fields are masked, the masking didn’t always stick

Re: Many popular iPhone apps are recording user sessions without asking

#44

Post by wmf »

ryanwhitney wrote: post #42
userbinator wrote: post #33

Earlier quoted context omitted.

"Many popular iPhone apps record what you do with them" would be perfectly accurate and less sensationalist. I saw the title and thought "so the app is recording what's on the screen... which on a phone, is going to be itself ... that's not such a big deal." As much as I don't like this sort of telemetry, it is in no way the sort of security issue the title appears to be insinuating.

How is that not a major privacy and security issue? A screen recording of your session would expose passwords in many cases as the characters show up one at a time before being masked.

When an app records itself it only has access to passwords that it already has access to. The issues are (1) these recordings go to a separate company, not the app developer and (2) developers (should) know to treat passwords as sensitive data but they didn't think to treat these recordings the same way.

Re: Many popular iPhone apps are recording user sessions without asking

#45

Post by nerdile »

Ok. So what? Software and services have kept usage metrics and clickstream data for decades. They have privacy policies saying that they may collect data about how you use their product. This is that data. So, is this a surprise?

If you don't want Abercrombie to know which items you looked at, don't look at them on the Abercrombie app, or at the Abercrombie store, or on the Abercrombie website.

Re: Many popular iPhone apps are recording user sessions without asking

#46

Post by wmf »

saagarjha wrote: post #36
wmf wrote: post #18

Earlier quoted context omitted.

Maybe Apple should make this into a built-in iOS feature with proper privacy and data minimization.

Even when your app crashes, Apple gives you crash log and nothing else, so I don't see they providing a way to tag users more granularly than this.

But it's fine to allow third parties to do it?

Re: Many popular iPhone apps are recording user sessions without asking

#47

Post by kankles »

Replaying user behaviour is not a privacy issue. Pretty much every mobile/web app connected to the internet is doing this with varying granularity.

AFAIK it's a pretty standard practice in UX and product design. A&F might have analysed hours of your finger gesture activity, but I doubt they're gonna know what brand of toilet paper you wiped with this morning.

Re: Many popular iPhone apps are recording user sessions without asking

#48

Post by yeahSoNah »

nerdile wrote: post #45

Ok. So what? Software and services have kept usage metrics and clickstream data for decades. They have privacy policies saying that they may collect data about how you use their product. This is that data. So, is this a surprise? If you don't want Abercrombie to know which items you looked at, don't look at them on the Abercrombie app, or at the Abercrombie store, or on the Abercrombie website.

Yeah... but... I didn’t want to have to boycott a company that has something reasonably priced, and worth buying, just because they can’t control themselves, and feel an urgent need to stalk me, and help other stalkers stalk me, and maybe even know enough about me to affect employment opportunities, or help others learn about how much money they can make of me, whether they should insure me, rent an apartment to me, offer lines of credit, help me buy a home or property, offer up granular evidence of my whereabouts, which could inform on me during a forensic investigation, attempt to manipulate me according to sexuality and orientation, pretend their my friend...

Re: Many popular iPhone apps are recording user sessions without asking

#49

Post by kalleboo »

kbenson wrote: post #30
kovrik wrote: post #19

Earlier quoted context omitted.

It is all good until you start sending credit card details and all other personal and sensitive information without even asking user about it. As a user, I don't care at all if it makes dev's life easier. I bought the app and don't want my personal info to be leaked.

So, we're supposed to trust the application's main process to accept a credit card securely, but not trust their system which tracks UX? It might be one more place to screw up, but so is just having more actions your app can do. I'm not sure I see any difference between an app recording all I traction within it (for single purpose apps, but not browsers) and a store video recording everything in it.

> So, we're supposed to trust the application's main process to accept a credit card securely, but not trust their system which tracks UX?

Correct. The payment code is usually gone over with a comb for PCI compliance (or completely outsourced to someone like Stripe), whereas the UX tracking is much less so. It's also a common enough issue that stuff like credit cards or API codes end up leaking into logs.

Re: Many popular iPhone apps are recording user sessions without asking

#50

Post by Alterlife »

paxys wrote: post #11

> Many major companies, like Air Canada, Hollister and Expedia, are recording every tap and swipe you make on their iPhone apps. In most cases you won’t even realize it. And they don’t need to ask for permission. The key phrases here are "recording every tap and swipe" and "on their iPhone apps". I'm not saying it is okay, but the sensationalist headline takes away from the real issue.

Another key paragraph is this one:

“This gives Air Canada employees — and anyone else capable of accessing the screenshot database — to see unencrypted credit card and password information,” he told TechCrunch.

The takeaway is that some companies are capturing things that they shouldn't be storing, and the article has exposed atleast one instance where this information has been sent to a third party without masking.

--

As a side note, I've always been afraid to use payment options within apps that redirect to bank logins or payment gateways and this only feeds my fears.

Even if you're making the payment through a trusted bank or a payment provider, these apps still probably intercept and store the information you gave your bank.

Post reply on HN