Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many popular iPhone apps are recording user sessions without asking

techcrunch.com

Post reply on HN
Print view View original

101–110 of 126 posts

Re: Many popular iPhone apps are recording user sessions without asking

#101

Post by antnisp »

dominicr wrote: post #86
katsura wrote: post #6

A two/three years ago I noticed that inspectlet (similar tech for the web) was happily sending the passwords in clear text to their servers, even though on their website they mentioned that passwords are never sent. I sent them an email and they eventually fixed it, but I wonder how many passwords and credit card CVC data did they collect before that?

A few years ago I was doing a security audit on a site and found this very problem. The marketing department had access to the Google Tag Manager account and added several (!) almost identical user tracking plug-ins. They were capturing all form fields, including credit card numbers, passwords, etc... The documentation talked about how to block this capture but that involved a developer getting involved and the devel…

And legal.

Re: Many popular iPhone apps are recording user sessions without asking

#102

Post by iguy »

epaga wrote: post #100

I'm seeing lots of "but this is super helpful to improve UI flow, and normally isn't nefarious!" Well, as long as the app 1. lets me know and 2. lets me choose whether to have this feature on or not, I don't have a problem with an app recording my usage of it in order to improve UI flow or what have you. The issue here is that 1. sensitive data is being transmitted via automated screenshots and 2. the users are not e…

Seems like a useful testing feature that ought only to be allowed on testing versions -- the ones for which there are already different rules & different certificates.

Re: Many popular iPhone apps are recording user sessions without asking

#103

Post by z3t4 »

Watching users via tracking and telemetry is very useful in order to learn about your users. But I also think it's also unethical. With the mindset that users are "lemings" ¹ where your job as a developer is to optimize profits from these "dumb fucks"².

1: https://en.wikipedia.org/wiki/Lemmings_(video_game) 2: https://en.wikiquote.org/wiki/Mark_Zuckerberg

Re: Many popular iPhone apps are recording user sessions without asking

#104

Post by jannes »

ryanwhitney wrote: post #42
userbinator wrote: post #33

Earlier quoted context omitted.

"Many popular iPhone apps record what you do with them" would be perfectly accurate and less sensationalist. I saw the title and thought "so the app is recording what's on the screen... which on a phone, is going to be itself ... that's not such a big deal." As much as I don't like this sort of telemetry, it is in no way the sort of security issue the title appears to be insinuating.

How is that not a major privacy and security issue? A screen recording of your session would expose passwords in many cases as the characters show up one at a time before being masked.

How exactly is it a surprise that an app has access to the contents of the framebuffer that it just generated?

I assume you are against their choice to send a log of their drawing commands in the form of images.

Re: Many popular iPhone apps are recording user sessions without asking

#105

Post by SmellyGeekBoy »

katsura wrote: post #6

A two/three years ago I noticed that inspectlet (similar tech for the web) was happily sending the passwords in clear text to their servers, even though on their website they mentioned that passwords are never sent. I sent them an email and they eventually fixed it, but I wonder how many passwords and credit card CVC data did they collect before that?

But as long as the site's using HTTPS you have nothing to worry about, right? /s

Re: Many popular iPhone apps are recording user sessions without asking

#106

Post by SmellyGeekBoy »

o10449366 wrote: post #69
LearnProg17 wrote: post #66

Earlier quoted context omitted.

But you do agree that Spotify can read private messages, if it wants to. The news may not be clear about this, but we do need tighter permissions.

No, I don't. https://newsroom.fb.com/news/2018/12/facebooks-messaging-par... I don't want this to devolve into an argument of semantics, but given NYT's editorial resources there's no doubt they carefully scrutinized how the "read" and "write" would be interpreted by their readership in the context of a negative report about Facebook.

Well if Facebook say "nothing to see here" then I'll definitely take their word for it.

Re: Many popular iPhone apps are recording user sessions without asking

#107

Post by SmellyGeekBoy »

kkarakk wrote: post #79
millstone wrote: post #67

Earlier quoted context omitted.

Abercrombie's data collection should start and end at the data I choose to send them, including the products I click on. I do not expect Abercrombie to "see what I do in real time," including where I position my mouse on my screen, text I type and then choose to delete, my physical location, etc.

then goto the mall? except wait, probably tracked on security cam there nowadays + credit card transactions are tracked + tracking movement in the store using multiple wifi APs + tracking what you purchase internally. the expectation of privacy when dealing with a business that can monetise the data about you in some way may be a dead thing already until the govt gets involved.

This is an explanation but definitely not a justification.

Re: Many popular iPhone apps are recording user sessions without asking

#108

Post by suvelx »

morpheuskafka wrote: post #64
paxys wrote: post #11

> Many major companies, like Air Canada, Hollister and Expedia, are recording every tap and swipe you make on their iPhone apps. In most cases you won’t even realize it. And they don’t need to ask for permission. The key phrases here are "recording every tap and swipe" and "on their iPhone apps". I'm not saying it is okay, but the sensationalist headline takes away from the real issue.

This. The only real issue is that the teams implementing this decided not to do a data security assessment and are violating PCI-DSS and similar by recording things that are supposed to be stored securely or not at all (ex. CCV). Also, as I recall, banks legitimately "track" user interactions as a means of fraud detection.

Banks will also introduce imperfections into their UI, and correlate how you interact with it to determine if you're human.

Effectively an invisible captcha.

Re: Many popular iPhone apps are recording user sessions without asking

#109

Post by ovi256 »

epaga wrote: post #100

I'm seeing lots of "but this is super helpful to improve UI flow, and normally isn't nefarious!" Well, as long as the app 1. lets me know and 2. lets me choose whether to have this feature on or not, I don't have a problem with an app recording my usage of it in order to improve UI flow or what have you. The issue here is that 1. sensitive data is being transmitted via automated screenshots and 2. the users are not e…

> lets me choose whether to have this feature on or not

And that's why UX is optimized for people who don't care about privacy :)

Re: Many popular iPhone apps are recording user sessions without asking

#110

Post by DavideNL »

epanchin wrote: post #99
simonh wrote: post #87

Earlier quoted context omitted.

I think for most users Apple does a good job protecting them, but this is definitely one significant area of weakness for the platform. There are ways to implement similar controls using a VPN service[0], but of course then you need to trust the VPN operator. [0] https://techcrunch.com/2018/10/24/smart-firewall-guardian-ip...

One could easily host their own VPN and trust only themselves. You could further connect to a vpn service if you wanted anonymity, although that would of course require trusting them.

> easily

it's a lot more difficult/leaky, for example it's not possible to block a certain app from accessing the internet;

Sure, you can gather all the domains it connects to and block those, but those domains and/or ip addresses can change over time. And when they do, you will not notice, and the app will be able to access the internet until maybe one day you notice and start blocking the new domains/ip addresses.

Post reply on HN