Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many popular iPhone apps are recording user sessions without asking

techcrunch.com

Post reply on HN
Print view View original

121–126 of 126 posts

Re: Many popular iPhone apps are recording user sessions without asking

#121

Post by eddieroger »

haukilup wrote: post #62
zaidf wrote: post #54

This is horrible reporting if by “record” they mean “log meta data like swipe coordinates and recreate it.” That is not the same as record.

> This is horrible reporting if by “record” they mean “log meta data like swipe coordinates and recreate it.” That is not the same as record. Is there much of a practical difference here? Employees at the company can essentially watch a video-like recreation of how you went through and used their app. This includes details that you might not expect such as which email you typed into a field before backspacing and cho…

> Is there much of a practical difference here?

Yes, because an app provider can know a dozen different ways what they're showing you already, but nothing else on your system. There is a world of difference between Tinder knowing i dismissed an incoming text alert because I swiped up at the top of the screen and knowing what the content of that text message was, to use your example. Tinder can already log the content of the messages you send in their platform,

Re: Many popular iPhone apps are recording user sessions without asking

#122

Post by writepub »

simonh wrote: post #87
HenryBemis wrote: post #83

One of the reasons why I switched from iPhone to Android is the firewall. On my jailbroken i-devices (all of them) I was always installing "Firewall IP", and when an app was running, for any connection not previously (or globally - meaning rule applies for all apps) approved I would get a pop-up message (screenshot of an earlier iOS Firewall IP)[1]. Now with the jailbreaks being less efficient, and the Firewall IP ap…

I think for most users Apple does a good job protecting them, but this is definitely one significant area of weakness for the platform. There are ways to implement similar controls using a VPN service[0], but of course then you need to trust the VPN operator. [0] https://techcrunch.com/2018/10/24/smart-firewall-guardian-ip...

Apple projects an aura of protection, and most of the protection it does really well, is of the bottom line, by crippling W3C compliance on Safari, and pushing devs and users to it's app store

Re: Many popular iPhone apps are recording user sessions without asking

#123

Post by JazzXP »

TeMPOraL wrote: post #95
JazzXP wrote: post #52

So if I'm understanding this right, the big issue they have is that they're not telling the customers that they're doing it. Can't any website do exactly the same thing in recording every keystroke written into it without a customer knowing? Does it really even matter if you're sending them your credit card details anyway?

> Does it really even matter if you're sending them your credit card details anyway? But are you sending them this info? I thought a lot of sites used third-party payment processors precisely in order not to handle this data themselves (and be liable for mishandling).

I guess in an app they could screen record that transaction, but if they're only storing fields and values, this is outside of what they can capture.

Re: Many popular iPhone apps are recording user sessions without asking

#124

Post by octocode »

somebodynew wrote: post #20
octocode wrote: post #16

Why does this article specifically single out iPhones? This happens on all platforms, even web apps.

Apple has enough of a history responding to things like this to make publishing an article about bad app behavior on iPhones a plausible way to bring it to an end. If your goal is to change app store policies, including Android phones is just going to dilute the possibility that Apple responds to an iPhone article for no additional gain because Google is unlikely to do anything.

"Apple tells app developers to disclose or remove screen recording code"

You win a medal!

Re: Many popular iPhone apps are recording user sessions without asking

#125

Post by vsl »

khalilravanna wrote: post #113
chaitanya wrote: post #63

A lot of people here are commenting that its no big deal that organizations are recording every screen, tap and swipe for their own apps. There are two problems with that: 1. As the article mentions, in some cases these apps end up leaking sensitive data like credit card detail and passwords. Generally, if you are taking snapshots of the user's screen instead of sending text metrics, it becomes much harder to mask se…

Are any of these apps used in the EU? If there’s no user consent for this privacy policy it strikes me that this isn’t GDPR compliant and these guys are just waiting to get fined. I wonder if they can get it around it by having their clients (Hotels.com, etc) essentially proxy this consent through their own privacy policies.

GDPR covers personal data. It is not universal magic dust for punishing everything you dislike.

Movement of your finger on the screen is not personal data. Screenshots most of the time aren’t either.

Re: Many popular iPhone apps are recording user sessions without asking

#126

Post by khalilravanna »

vsl wrote: post #125
khalilravanna wrote: post #113

Earlier quoted context omitted.

Are any of these apps used in the EU? If there’s no user consent for this privacy policy it strikes me that this isn’t GDPR compliant and these guys are just waiting to get fined. I wonder if they can get it around it by having their clients (Hotels.com, etc) essentially proxy this consent through their own privacy policies.

GDPR covers personal data. It is not universal magic dust for punishing everything you dislike. Movement of your finger on the screen is not personal data. Screenshots most of the time aren’t either.

I’m not sure how that’s true when the article mentions that they’re leaking users’ personal data like credit cards and so forth. Also it seems Apple just released a “cease and desist” due to privacy on this front.
Post reply on HN