Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many popular iPhone apps are recording user sessions without asking

techcrunch.com

Post reply on HN
Print view View original

111–120 of 126 posts

Re: Many popular iPhone apps are recording user sessions without asking

#111

Post by kgwxd »

epaga wrote: post #100

I'm seeing lots of "but this is super helpful to improve UI flow, and normally isn't nefarious!" Well, as long as the app 1. lets me know and 2. lets me choose whether to have this feature on or not, I don't have a problem with an app recording my usage of it in order to improve UI flow or what have you. The issue here is that 1. sensitive data is being transmitted via automated screenshots and 2. the users are not e…

Options aren't good enough, the fact the code is even in there is scary and there's nothing to gurantee your selection is being respected. No telemetry code and open source to prove it is the only kind of software anyone should be installing. I'm starting to think distributing software like this should be akin to wire tapping.

Re: Many popular iPhone apps are recording user sessions without asking

#112

Post by coldcode »

Long ago a company I worked for had an iOS app and use some IBM product for the web version (Leaf? or something) and they forced us to use it in the app as well, it recorded the contents of each page basically (some fields were blanked out). It also crashed so much it was worthless. I never found it remotely useful to have such detailed info. Tagging service calls with a GUID was much more useful, as well as recording service errors and exceptions in Google Analytics. While we of course knew who the tag belonged to (after all they were our customer's orders) it was of no use to anyone listening in or watching the tags go by.

Re: Many popular iPhone apps are recording user sessions without asking

#113

Post by khalilravanna »

chaitanya wrote: post #63

A lot of people here are commenting that its no big deal that organizations are recording every screen, tap and swipe for their own apps. There are two problems with that: 1. As the article mentions, in some cases these apps end up leaking sensitive data like credit card detail and passwords. Generally, if you are taking snapshots of the user's screen instead of sending text metrics, it becomes much harder to mask se…

Are any of these apps used in the EU? If there’s no user consent for this privacy policy it strikes me that this isn’t GDPR compliant and these guys are just waiting to get fined. I wonder if they can get it around it by having their clients (Hotels.com, etc) essentially proxy this consent through their own privacy policies.

Re: Many popular iPhone apps are recording user sessions without asking

#114

Post by polote »

I was in charge of building this kind of product for another analytics company, this technology is called session replay, and it is used for many use cases, like : UX improvement/ support/ bug detections ...

Most of vendors record keyboard inputs and thus can record password as well as credit card information, there was an affair about it a few years ago [1]. To not have this issue, most of vendors provide a way to not record those information. It requires manual tagging of the website on the element that contains critical content.

But many of session replays vendors have many clients, and don't force or don't verify that all the critical information are masked. This is not GDPR compliant, because when the GDPR apply you need to consent of the user to record his PII, and you are not even allowed to record information like password, sexual orientation, credit card even if you have the consent.

Two things: - Nowadays on the web most of payment pages are not hosted on the client website, so those analytics tools are not included (but we still have many websites that don't use third party for that) - This data is not (most of the time) recorded in a structured way, data of inputs is recorded as some element of an HTML, and thus it is not super easy to extract the information at scale

[1] https://freedom-to-tinker.com/2018/02/26/no-boundaries-for-c...

Re: Many popular iPhone apps are recording user sessions without asking

#115

Post by bo1024 »

kgwxd wrote: post #111
epaga wrote: post #100

I'm seeing lots of "but this is super helpful to improve UI flow, and normally isn't nefarious!" Well, as long as the app 1. lets me know and 2. lets me choose whether to have this feature on or not, I don't have a problem with an app recording my usage of it in order to improve UI flow or what have you. The issue here is that 1. sensitive data is being transmitted via automated screenshots and 2. the users are not e…

Options aren't good enough, the fact the code is even in there is scary and there's nothing to gurantee your selection is being respected. No telemetry code and open source to prove it is the only kind of software anyone should be installing. I'm starting to think distributing software like this should be akin to wire tapping.

If you run someone's software on your device, you are giving them a huge amount of trust. So many privacy and security concerns stem from people hoping this weren't true.

Re: Many popular iPhone apps are recording user sessions without asking

#116

Post by ubermonkey »

I guess I'm not SUPER concerned about a given app reporting on what I do in that app back to the publisher. It might even be possible to convince me it's a reasonable way to figure out what the app does well and what it needs to improve.

We could never get away with doing this for our (Windows) app, but sometimes I have conversations with people in my user base and I really, really wish I had some idea of how they got into some $random_weird_state.

But yeah, it oughta be in the T&C if nothing else.

Re: Many popular iPhone apps are recording user sessions without asking

#117

Post by JustSomeNobody »

HenryBemis wrote: post #83

One of the reasons why I switched from iPhone to Android is the firewall. On my jailbroken i-devices (all of them) I was always installing "Firewall IP", and when an app was running, for any connection not previously (or globally - meaning rule applies for all apps) approved I would get a pop-up message (screenshot of an earlier iOS Firewall IP)[1]. Now with the jailbreaks being less efficient, and the Firewall IP ap…

The firewall would block the Glassbox IPs, but I can't see this doing any good for the apps that use this technique and don't use a third party like Glassbox to collect the data.

Re: Many popular iPhone apps are recording user sessions without asking

#118

Post by JustSomeNobody »

coldcode wrote: post #112

Long ago a company I worked for had an iOS app and use some IBM product for the web version (Leaf? or something) and they forced us to use it in the app as well, it recorded the contents of each page basically (some fields were blanked out). It also crashed so much it was worthless. I never found it remotely useful to have such detailed info. Tagging service calls with a GUID was much more useful, as well as recordin…

The problem with analytics is too much info or not enough info. At each employer, I usually do my best to get involved with the analytics portion of our applications. Apart from just finding it interesting, I also like to try and interject some sanity. I've seen managers walk in, puff our their chest and say, "Just collect everything. We'll sort through it here. Make it happen." After they walk out I engage everyone in conversation about that and try and let them know that we should actually be creating a list of questions we want answered and work from there. Collecting everything is almost always not the right idea.

Re: Many popular iPhone apps are recording user sessions without asking

#119

Post by JustSomeNobody »

octocode wrote: post #16

Why does this article specifically single out iPhones? This happens on all platforms, even web apps.

Is it singling out Apple or did they just hear about it happening on Apple and decide to write that up? Sure they could have investigated to see if it happens on other platforms, but you gotta get the story out there fast otherwise someone else will.

Re: Many popular iPhone apps are recording user sessions without asking

#120

Post by crescentfresh »

AndrewConn wrote: post #4
corbett3000 wrote: post #2

Anyone have an idea for how to block this on your iphone? Perhaps content filtering glassboxdigital.com? Not sure if that would stop however it is that they're transmitting back to their servers.

Possibly... I might try using Charles Proxy mobile app to observe what domains data is being sent/received from, then on your home network use something like Pi-Hole to block those domains.

Does Charles (iOS) allow capturing traffic of any app launched? Is it like a "record" button for network traffic?
Post reply on HN