Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many popular iPhone apps are recording user sessions without asking

techcrunch.com

Post reply on HN
Print view View original

91–100 of 126 posts

Re: Many popular iPhone apps are recording user sessions without asking

#91

Post by zimbatm »

dominicr wrote: post #86
katsura wrote: post #6

A two/three years ago I noticed that inspectlet (similar tech for the web) was happily sending the passwords in clear text to their servers, even though on their website they mentioned that passwords are never sent. I sent them an email and they eventually fixed it, but I wonder how many passwords and credit card CVC data did they collect before that?

A few years ago I was doing a security audit on a site and found this very problem. The marketing department had access to the Google Tag Manager account and added several (!) almost identical user tracking plug-ins. They were capturing all form fields, including credit card numbers, passwords, etc... The documentation talked about how to block this capture but that involved a developer getting involved and the devel…

That's why it's good to separate the marketing website from the main product to different domains. When you can.

* www.mydomain.com - install Google Tag Manager, let the marketing people go crazy

* app.mydomain.com - all tracking request has to go through a developer

That works well for SaaS type of products. Not so well for online stores where you want everything integrated.

Re: Many popular iPhone apps are recording user sessions without asking

#92

Post by calgoo »

kkarakk wrote: post #79
millstone wrote: post #67

Earlier quoted context omitted.

Abercrombie's data collection should start and end at the data I choose to send them, including the products I click on. I do not expect Abercrombie to "see what I do in real time," including where I position my mouse on my screen, text I type and then choose to delete, my physical location, etc.

then goto the mall? except wait, probably tracked on security cam there nowadays + credit card transactions are tracked + tracking movement in the store using multiple wifi APs + tracking what you purchase internally. the expectation of privacy when dealing with a business that can monetise the data about you in some way may be a dead thing already until the govt gets involved.

Its only dead because people choose to give up. If we don't fight it at every turn, we will keep on living in this dystopian future. The government will never step in to protect you as they want as much of this information as possible. We have already seen how politicians try to abuse any possible thing they can to get more power and/or win elections.

We need the engineers in the these companies to join the fight, refuse to install or add these features. If that impossible because there are many people who don't see this as a corrupt practice, then we need others to step up and help block and expose it.

Please don't give up on privacy or freedoms, that just dooms us more.

Re: Many popular iPhone apps are recording user sessions without asking

#93

Post by kaolti »

Not sure how long it's been there, but found this in Inspectlet's terms of service:

7. Disclosure. As soon as you begin to use Our Service, You agree to add a disclosure to either Your terms of use, user agreement and/or privacy policy to inform Your end-users and customers of Inspectlet’s access to their Personal Information through Your website, and adding a link to Our Privacy Policy which governs Our use of all such Personal Information accessed by Inspectlet through Your website or through Your use of Our Services.

Re: Many popular iPhone apps are recording user sessions without asking

#94

Post by jsmith99 »

HenryBemis wrote: post #83

One of the reasons why I switched from iPhone to Android is the firewall. On my jailbroken i-devices (all of them) I was always installing "Firewall IP", and when an app was running, for any connection not previously (or globally - meaning rule applies for all apps) approved I would get a pop-up message (screenshot of an earlier iOS Firewall IP)[1]. Now with the jailbreaks being less efficient, and the Firewall IP ap…

For Samsung, there are Knox based options (I recommend adhell3) for host file style blocking that don't require root or vpn.

Re: Many popular iPhone apps are recording user sessions without asking

#95

Post by TeMPOraL »

JazzXP wrote: post #52

So if I'm understanding this right, the big issue they have is that they're not telling the customers that they're doing it. Can't any website do exactly the same thing in recording every keystroke written into it without a customer knowing? Does it really even matter if you're sending them your credit card details anyway?

> Does it really even matter if you're sending them your credit card details anyway?

But are you sending them this info? I thought a lot of sites used third-party payment processors precisely in order not to handle this data themselves (and be liable for mishandling).

Re: Many popular iPhone apps are recording user sessions without asking

#96

Post by mschuster91 »

zimbatm wrote: post #91
dominicr wrote: post #86

Earlier quoted context omitted.

A few years ago I was doing a security audit on a site and found this very problem. The marketing department had access to the Google Tag Manager account and added several (!) almost identical user tracking plug-ins. They were capturing all form fields, including credit card numbers, passwords, etc... The documentation talked about how to block this capture but that involved a developer getting involved and the devel…

That's why it's good to separate the marketing website from the main product to different domains. When you can. * www.mydomain.com - install Google Tag Manager, let the marketing people go crazy * app.mydomain.com - all tracking request has to go through a developer That works well for SaaS type of products. Not so well for online stores where you want everything integrated.

> * www.mydomain.com - install Google Tag Manager, let the marketing people go crazy

Even there, that's dangerous. Most marketing people are not trained in legal matters and install all kinds of shit with dubious legality. In addition the tons of trackers on websites make the user experience really slow. Approval by legal and tech should be the standard process, not "marketing has free rein to fuck over the company due to messing up GDPR compliance".

Re: Many popular iPhone apps are recording user sessions without asking

#97

Post by 0x38B »

mangix wrote: post #85
HenryBemis wrote: post #83

One of the reasons why I switched from iPhone to Android is the firewall. On my jailbroken i-devices (all of them) I was always installing "Firewall IP", and when an app was running, for any connection not previously (or globally - meaning rule applies for all apps) approved I would get a pop-up message (screenshot of an earlier iOS Firewall IP)[1]. Now with the jailbreaks being less efficient, and the Firewall IP ap…

One annoyance is that SafetyNet pretty much prevents using Google Pay on a rooted or modified device.

Quoting https://forum.xda-developers.com/apps/magisk/official-magisk...: "Installing Magisk will give you ROOT, a super powerful Systemless Interface, Magisk Modules support, and hide from tons of integrity tests like SafetyNet!"

My Pixel 2 is rooted with Magisk, and passes Safetynet. I use Google Pay all the time.

Re: Many popular iPhone apps are recording user sessions without asking

#98

Post by Tsiklon »

dominicr wrote: post #86
katsura wrote: post #6

A two/three years ago I noticed that inspectlet (similar tech for the web) was happily sending the passwords in clear text to their servers, even though on their website they mentioned that passwords are never sent. I sent them an email and they eventually fixed it, but I wonder how many passwords and credit card CVC data did they collect before that?

A few years ago I was doing a security audit on a site and found this very problem. The marketing department had access to the Google Tag Manager account and added several (!) almost identical user tracking plug-ins. They were capturing all form fields, including credit card numbers, passwords, etc... The documentation talked about how to block this capture but that involved a developer getting involved and the devel…

I think that you should go one further - and do periodical or continuous security reviews of the third party services you're using on your app or website.

You're reliant on them behaving in the same manner consistently, and behaving ethically when they change their service's behaviour.

Re: Many popular iPhone apps are recording user sessions without asking

#99

Post by epanchin »

simonh wrote: post #87
HenryBemis wrote: post #83

One of the reasons why I switched from iPhone to Android is the firewall. On my jailbroken i-devices (all of them) I was always installing "Firewall IP", and when an app was running, for any connection not previously (or globally - meaning rule applies for all apps) approved I would get a pop-up message (screenshot of an earlier iOS Firewall IP)[1]. Now with the jailbreaks being less efficient, and the Firewall IP ap…

I think for most users Apple does a good job protecting them, but this is definitely one significant area of weakness for the platform. There are ways to implement similar controls using a VPN service[0], but of course then you need to trust the VPN operator. [0] https://techcrunch.com/2018/10/24/smart-firewall-guardian-ip...

One could easily host their own VPN and trust only themselves.

You could further connect to a vpn service if you wanted anonymity, although that would of course require trusting them.

Re: Many popular iPhone apps are recording user sessions without asking

#100

Post by epaga »

I'm seeing lots of "but this is super helpful to improve UI flow, and normally isn't nefarious!"

Well, as long as the app 1. lets me know and 2. lets me choose whether to have this feature on or not, I don't have a problem with an app recording my usage of it in order to improve UI flow or what have you.

The issue here is that 1. sensitive data is being transmitted via automated screenshots and 2. the users are not even being made aware of this fact, let alone being given a choice.

Post reply on HN