Many popular iPhone apps are recording user sessions without asking • Hacker News Board

Re: Many popular iPhone apps are recording user sessions without asking

#61

Post by bdcravens » Thu, Feb 07, 2019, 4:52 AM UTC

ikeboy wrote: post #51

Alterlife wrote: post #50

Earlier quoted context omitted.

Another key paragraph is this one: “This gives Air Canada employees — and anyone else capable of accessing the screenshot database — to see unencrypted credit card and password information,” he told TechCrunch. The takeaway is that some companies are capturing things that they shouldn't be storing, and the article has exposed atleast one instance where this information has been sent to a third party without masking.…

Could they lose PCI compliance then?

If they encrypt the screenshots the same way they do the stored details, probably not.

Re: Many popular iPhone apps are recording user sessions without asking

#62

Post by haukilup » Thu, Feb 07, 2019, 4:53 AM UTC

zaidf wrote: post #54

This is horrible reporting if by “record” they mean “log meta data like swipe coordinates and recreate it.” That is not the same as record.

> This is horrible reporting if by “record” they mean “log meta data like swipe coordinates and recreate it.” That is not the same as record.

Is there much of a practical difference here? Employees at the company can essentially watch a video-like recreation of how you went through and used their app. This includes details that you might not expect such as which email you typed into a field before backspacing and choosing another to sign up with.

I want to believe that a product owner at companies like Tinder aren't watching videos of me sexting someone to "learn how we can improve the user experience". If the response is then to say "don't use Tinder!", start considering the alternatives - you end up having to trust someone, or do nothing digitally.

Re: Many popular iPhone apps are recording user sessions without asking

#63

Post by chaitanya » Thu, Feb 07, 2019, 4:57 AM UTC

A lot of people here are commenting that its no big deal that organizations are recording every screen, tap and swipe for their own apps. There are two problems with that:

1. As the article mentions, in some cases these apps end up leaking sensitive data like credit card detail and passwords. Generally, if you are taking snapshots of the user's screen instead of sending text metrics, it becomes much harder to mask sensitive data at all times.

2. The bigger issue is that these services generally use third parties to record this, and their privacy policy is a big problem. For example, Glassbox explicitly mentions that it will share end user personal data with their "enterprise" clients (which I am guessing are basically ad companies):

> From time to time, GLASSBOX grants certain of its enterprise clients a license or other rights to GLASSBOX’s proprietary software products and solutions (the “GLASSBOX Solutions”). Through their use of these GLASSBOX Solutions and/or through other means, enterprise clients of GLASSBOX may get access to, collect and use: (i) End User non-personally identifiable information; and (ii) End User Personal Data.

> There are also times when we will combine such information with additional non-personal or de-identified information we obtain from other companies as well as End User Personal Data, in order for our enterprise clients to market directly to a certain person subject to requirements of applicable law. We typically analyze this information and organize it into user groups and audiences, based on factors such as age, gender, geography, interests and online actions. We and our enterprise clients then use these user groups and audiences, along with information about the possible relationships among different browsers and devices, to design and deliver customized advertising campaigns or other relevant content.

https://www.glassboxdigital.com/privacy-policy/

Re: Many popular iPhone apps are recording user sessions without asking

#64

Post by morpheuskafka » Thu, Feb 07, 2019, 5:03 AM UTC

paxys wrote: post #11

> Many major companies, like Air Canada, Hollister and Expedia, are recording every tap and swipe you make on their iPhone apps. In most cases you won’t even realize it. And they don’t need to ask for permission. The key phrases here are "recording every tap and swipe" and "on their iPhone apps". I'm not saying it is okay, but the sensationalist headline takes away from the real issue.

This. The only real issue is that the teams implementing this decided not to do a data security assessment and are violating PCI-DSS and similar by recording things that are supposed to be stored securely or not at all (ex. CCV).

Also, as I recall, banks legitimately "track" user interactions as a means of fraud detection.

Re: Many popular iPhone apps are recording user sessions without asking

#65

Post by morpheuskafka » Thu, Feb 07, 2019, 5:03 AM UTC

bdcravens wrote: post #61

ikeboy wrote: post #51

Earlier quoted context omitted.

Could they lose PCI compliance then?

If they encrypt the screenshots the same way they do the stored details, probably not.

CCV isn't ever to be stored after transaction completion, encrypted or not.

Re: Many popular iPhone apps are recording user sessions without asking

#66

Post by LearnProg17 » Thu, Feb 07, 2019, 5:05 AM UTC

o10449366 wrote: post #41

paxys wrote: post #11

> Many major companies, like Air Canada, Hollister and Expedia, are recording every tap and swipe you make on their iPhone apps. In most cases you won’t even realize it. And they don’t need to ask for permission. The key phrases here are "recording every tap and swipe" and "on their iPhone apps". I'm not saying it is okay, but the sensationalist headline takes away from the real issue.

I've been seeing the same sensationalist language even in "respected" publications like the NYT lately. For example, they recently published a story where it was implied that because Spotify's Messenger plugin has standard read/write permissions (necessary to ensure basic functionality like sharing songs) that it could also actively monitor, store, and modify your private messages. In smaller publications, some shodd…

But you do agree that Spotify can read private messages, if it wants to. The news may not be clear about this, but we do need tighter permissions.

Re: Many popular iPhone apps are recording user sessions without asking

#67

Post by millstone » Thu, Feb 07, 2019, 5:07 AM UTC

nerdile wrote: post #45

Ok. So what? Software and services have kept usage metrics and clickstream data for decades. They have privacy policies saying that they may collect data about how you use their product. This is that data. So, is this a surprise? If you don't want Abercrombie to know which items you looked at, don't look at them on the Abercrombie app, or at the Abercrombie store, or on the Abercrombie website.

Abercrombie's data collection should start and end at the data I choose to send them, including the products I click on.

I do not expect Abercrombie to "see what I do in real time," including where I position my mouse on my screen, text I type and then choose to delete, my physical location, etc.

Re: Many popular iPhone apps are recording user sessions without asking

#68

Post by jimjimjim » Thu, Feb 07, 2019, 5:16 AM UTC

kankles wrote: post #47

Replaying user behaviour is not a privacy issue. Pretty much every mobile/web app connected to the internet is doing this with varying granularity. AFAIK it's a pretty standard practice in UX and product design. A&F might have analysed hours of your finger gesture activity, but I doubt they're gonna know what brand of toilet paper you wiped with this morning.

Just because everyone does it doesn't make it right!

Re: Many popular iPhone apps are recording user sessions without asking

#69

Post by o10449366 » Thu, Feb 07, 2019, 5:21 AM UTC

LearnProg17 wrote: post #66

o10449366 wrote: post #41

Earlier quoted context omitted.

I've been seeing the same sensationalist language even in "respected" publications like the NYT lately. For example, they recently published a story where it was implied that because Spotify's Messenger plugin has standard read/write permissions (necessary to ensure basic functionality like sharing songs) that it could also actively monitor, store, and modify your private messages. In smaller publications, some shodd…

But you do agree that Spotify can read private messages, if it wants to. The news may not be clear about this, but we do need tighter permissions.

No, I don't.

https://newsroom.fb.com/news/2018/12/facebooks-messaging-par...

I don't want this to devolve into an argument of semantics, but given NYT's editorial resources there's no doubt they carefully scrutinized how the "read" and "write" would be interpreted by their readership in the context of a negative report about Facebook.

Re: Many popular iPhone apps are recording user sessions without asking

#70

Post by anyfoo » Thu, Feb 07, 2019, 5:22 AM UTC

o10449366 wrote: post #41

paxys wrote: post #11

> Many major companies, like Air Canada, Hollister and Expedia, are recording every tap and swipe you make on their iPhone apps. In most cases you won’t even realize it. And they don’t need to ask for permission. The key phrases here are "recording every tap and swipe" and "on their iPhone apps". I'm not saying it is okay, but the sensationalist headline takes away from the real issue.

I've been seeing the same sensationalist language even in "respected" publications like the NYT lately. For example, they recently published a story where it was implied that because Spotify's Messenger plugin has standard read/write permissions (necessary to ensure basic functionality like sharing songs) that it could also actively monitor, store, and modify your private messages. In smaller publications, some shodd…

Wait, how is read/write permissions to messages (assuming that’s what you allude to) in any way necessary? On iOS at least, apps can’t even get access to your messages, and sharing works very well. I must misunderstand something.