Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many popular iPhone apps are recording user sessions without asking

techcrunch.com

Post reply on HN
Print view View original

71–80 of 126 posts

Re: Many popular iPhone apps are recording user sessions without asking

#71

Post by dwd »

paxys wrote: post #11

> Many major companies, like Air Canada, Hollister and Expedia, are recording every tap and swipe you make on their iPhone apps. In most cases you won’t even realize it. And they don’t need to ask for permission. The key phrases here are "recording every tap and swipe" and "on their iPhone apps". I'm not saying it is okay, but the sensationalist headline takes away from the real issue.

A lot of companies and insurance in particular screen capture desktop applications as well.

This is so that should there be a dispute they have a screen shot of the forms presented and what details the customer provided. Payment screens would not be captured this way.

Re: Many popular iPhone apps are recording user sessions without asking

#72

Post by kbenson »

kalleboo wrote: post #49
kbenson wrote: post #30

Earlier quoted context omitted.

So, we're supposed to trust the application's main process to accept a credit card securely, but not trust their system which tracks UX? It might be one more place to screw up, but so is just having more actions your app can do. I'm not sure I see any difference between an app recording all I traction within it (for single purpose apps, but not browsers) and a store video recording everything in it.

> So, we're supposed to trust the application's main process to accept a credit card securely, but not trust their system which tracks UX? Correct. The payment code is usually gone over with a comb for PCI compliance (or completely outsourced to someone like Stripe), whereas the UX tracking is much less so. It's also a common enough issue that stuff like credit cards or API codes end up leaking into logs.

PCI compliance covers all aspects of credit card numbers and how they are collected, transmitted and stored. There's no reason to believe a company you can't trust to either not grab it or transmit it or store it for UX metrics non-compliantly will take care to do so in a compliant manner otherwise for normal operations. Either they take care with important data or they don't, and for this measurement "assume it's taken care of because they offload it to some other company" doesn't really count as taking care and absolve them of the responsibility, as I'm sure a lot of developers convince themselves it does.

That said, my point isn't necessarily that you should trust apps gathering UX metrics more, but that you should probably trust all apps quite a bit less, whether they track user actions or not.

Re: Many popular iPhone apps are recording user sessions without asking

#73

Post by EGreg »

_s wrote: post #60
o10449366 wrote: post #41

Earlier quoted context omitted.

I've been seeing the same sensationalist language even in "respected" publications like the NYT lately. For example, they recently published a story where it was implied that because Spotify's Messenger plugin has standard read/write permissions (necessary to ensure basic functionality like sharing songs) that it could also actively monitor, store, and modify your private messages. In smaller publications, some shodd…

I doubt the sinister / political motives - these headlines and articles are nothing more than to drive traffic / revenue. Pick a popular company / product / service, find something that they could be doing, throw up an article suggesting that's what they could be doing but have the title inferring that it is what they are actually doing. Rinse / repeat.

However!

This is what happens under capitalism when private news organizations are disrupted by the Internet.

The solution is a collaborative news site, we don’t need intrepid reporters going into war zones when everyone can record video on their phone. We don’t need biased clickbait news providing fodder for soial network algorithms to herd us into echo chambers. We need a place where people of all viewpoints meet and duke it out like Wikipedia but for news.

PS: wikinews in particular sucks though

Re: Many popular iPhone apps are recording user sessions without asking

#74

Post by extra88 »

anyfoo wrote: post #70
o10449366 wrote: post #41

Earlier quoted context omitted.

I've been seeing the same sensationalist language even in "respected" publications like the NYT lately. For example, they recently published a story where it was implied that because Spotify's Messenger plugin has standard read/write permissions (necessary to ensure basic functionality like sharing songs) that it could also actively monitor, store, and modify your private messages. In smaller publications, some shodd…

Wait, how is read/write permissions to messages (assuming that’s what you allude to) in any way necessary? On iOS at least, apps can’t even get access to your messages, and sharing works very well. I must misunderstand something.

No, they mean Facebook Messenger. The extension can be used for things like collaboratively creating a playlist with contacts in Messenger, sounds like that would require being able to read messages from Messenger and write messages to it.

https://support.spotify.com/is/using_spotify/playlists/group...

Re: Many popular iPhone apps are recording user sessions without asking

#75

Post by whitexn--g28h »

EGreg wrote: post #73
_s wrote: post #60

Earlier quoted context omitted.

I doubt the sinister / political motives - these headlines and articles are nothing more than to drive traffic / revenue. Pick a popular company / product / service, find something that they could be doing, throw up an article suggesting that's what they could be doing but have the title inferring that it is what they are actually doing. Rinse / repeat.

However! This is what happens under capitalism when private news organizations are disrupted by the Internet. The solution is a collaborative news site, we don’t need intrepid reporters going into war zones when everyone can record video on their phone. We don’t need biased clickbait news providing fodder for soial network algorithms to herd us into echo chambers. We need a place where people of all viewpoints meet a…

There's a difference between the photos people take on a phone and the journalism that people like Tyler Hicks do. It's just not the same. Please show me a crowd sourced article that has this impact. https://www.nytimes.com/interactive/2018/10/20/world/middlee...

Re: Many popular iPhone apps are recording user sessions without asking

#76

Post by TheChaplain »

kankles wrote: post #47

Replaying user behaviour is not a privacy issue. Pretty much every mobile/web app connected to the internet is doing this with varying granularity. AFAIK it's a pretty standard practice in UX and product design. A&F might have analysed hours of your finger gesture activity, but I doubt they're gonna know what brand of toilet paper you wiped with this morning.

I would rather not having an app sending screenshots of the screen / record taps while I input my CC number.

Nor of any alerts / notifications that are unrelated to the app itself.

So I'd say it can be quite a privacy issue.

Re: Many popular iPhone apps are recording user sessions without asking

#78

Post by jahewson »

kankles wrote: post #47

Replaying user behaviour is not a privacy issue. Pretty much every mobile/web app connected to the internet is doing this with varying granularity. AFAIK it's a pretty standard practice in UX and product design. A&F might have analysed hours of your finger gesture activity, but I doubt they're gonna know what brand of toilet paper you wiped with this morning.

“Videotaping your screen is not a privacy issue”

Hmm.

Re: Many popular iPhone apps are recording user sessions without asking

#79

Post by kkarakk »

millstone wrote: post #67
nerdile wrote: post #45

Ok. So what? Software and services have kept usage metrics and clickstream data for decades. They have privacy policies saying that they may collect data about how you use their product. This is that data. So, is this a surprise? If you don't want Abercrombie to know which items you looked at, don't look at them on the Abercrombie app, or at the Abercrombie store, or on the Abercrombie website.

Abercrombie's data collection should start and end at the data I choose to send them, including the products I click on. I do not expect Abercrombie to "see what I do in real time," including where I position my mouse on my screen, text I type and then choose to delete, my physical location, etc.

then goto the mall? except wait, probably tracked on security cam there nowadays + credit card transactions are tracked + tracking movement in the store using multiple wifi APs + tracking what you purchase internally.

the expectation of privacy when dealing with a business that can monetise the data about you in some way may be a dead thing already until the govt gets involved.

Re: Many popular iPhone apps are recording user sessions without asking

#80

Post by fasteddie »

TheChaplain wrote: post #76
kankles wrote: post #47

Replaying user behaviour is not a privacy issue. Pretty much every mobile/web app connected to the internet is doing this with varying granularity. AFAIK it's a pretty standard practice in UX and product design. A&F might have analysed hours of your finger gesture activity, but I doubt they're gonna know what brand of toilet paper you wiped with this morning.

I would rather not having an app sending screenshots of the screen / record taps while I input my CC number. Nor of any alerts / notifications that are unrelated to the app itself. So I'd say it can be quite a privacy issue.

Many of these companies (e.g. FullStory, Hotjar) obfuscate all input fields for exactly this reason.
Post reply on HN