Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many popular iPhone apps are recording user sessions without asking

techcrunch.com

Post reply on HN
Print view View original

51–60 of 126 posts

Re: Many popular iPhone apps are recording user sessions without asking

#51

Post by ikeboy »

Alterlife wrote: post #50
paxys wrote: post #11

> Many major companies, like Air Canada, Hollister and Expedia, are recording every tap and swipe you make on their iPhone apps. In most cases you won’t even realize it. And they don’t need to ask for permission. The key phrases here are "recording every tap and swipe" and "on their iPhone apps". I'm not saying it is okay, but the sensationalist headline takes away from the real issue.

Another key paragraph is this one: “This gives Air Canada employees — and anyone else capable of accessing the screenshot database — to see unencrypted credit card and password information,” he told TechCrunch. The takeaway is that some companies are capturing things that they shouldn't be storing, and the article has exposed atleast one instance where this information has been sent to a third party without masking.…

Could they lose PCI compliance then?

Re: Many popular iPhone apps are recording user sessions without asking

#52

Post by JazzXP »

So if I'm understanding this right, the big issue they have is that they're not telling the customers that they're doing it. Can't any website do exactly the same thing in recording every keystroke written into it without a customer knowing?

Does it really even matter if you're sending them your credit card details anyway?

Re: Many popular iPhone apps are recording user sessions without asking

#53

Post by Theodores »

Screen recording apps are fine if you want to go over how a small group of people use your website however the data is hard to analyse.

Plain old Google Analytics is a bigger deal when you think about it. Anyone that has this configured half decently where the IDs are provided by some backend server really has got the low down on how you use the website. Every aspect of 'engagement' can be recorded and reports made that don't entail watching through untold hours of 'user engagement'.

It is a bit like spying in the modern age. In the olden days any intelligence agency could throw resources at tracking one individual of interest. However if you need a team of twenty people to stalk someone then getting the budget can be hard. They would have to be the 'Chairman of the Communist Leadership' or the leader of a striking union for that to be approved. In the modern era we all know how NSA et al. do it, surveillance on everyone and able to do a report on anyone deemed 'Communist' (or whatever).

It isn't the 'everything on screen' you need to worry about as nobody except an intern is going to be looking at that. It is the half decent Google Analytics setups that are a far greater concern if you are terrified of marketing people. Yet nobody bats an eyelid to Google Analytics, the cookie notices say it is mostly harmless and just there for your own good.

Luckily though very few companies are really that competent at Google Analytics. They may have people adding ever more bloat to Google Tag Manager for this to feed various things such as affiliate marketing schemes, however the people doing SEO are rarely familiar with web development and, not understanding the 'problem space', don't realise the possibilities.

Re: Many popular iPhone apps are recording user sessions without asking

#55

Post by statictype »

wmf wrote: post #44
ryanwhitney wrote: post #42

Earlier quoted context omitted.

How is that not a major privacy and security issue? A screen recording of your session would expose passwords in many cases as the characters show up one at a time before being masked.

When an app records itself it only has access to passwords that it already has access to. The issues are (1) these recordings go to a separate company, not the app developer and (2) developers (should) know to treat passwords as sensitive data but they didn't think to treat these recordings the same way.

If its doing actual screen recording (is this even possible) then it presumably can record the password you type into the Google Oauth screen that the app pops open.

Re: Many popular iPhone apps are recording user sessions without asking

#56

Post by monocasa »

ikeboy wrote: post #51
Alterlife wrote: post #50

Earlier quoted context omitted.

Another key paragraph is this one: “This gives Air Canada employees — and anyone else capable of accessing the screenshot database — to see unencrypted credit card and password information,” he told TechCrunch. The takeaway is that some companies are capturing things that they shouldn't be storing, and the article has exposed atleast one instance where this information has been sent to a third party without masking.…

Could they lose PCI compliance then?

Probably not. PCI compliance is a joke. Target was certifies PCI compliant two weeks before their massive breach.

Re: Many popular iPhone apps are recording user sessions without asking

#57

Post by YeahSureWhyNot »

foobiekr wrote: post #40
YeahSureWhyNot wrote: post #39

sensationalist bs. how is ability to watch a screen recording of you using their app and typing in your credit card into THEIR app is different from the same app developer just pulling up your credit card info from their database? if you give the info to the app, the app owner will see your info. as discussed as that. the fact that its in a form of screen recording doesn't make it scary or dangerous.

Well, one extremely important difference is that I might trust company X in part because they will want to preserve their brand but not trust poorly-run user-analytics company Y that a part of X uses which will give X plausible deniability for responsibility. The other is that PCI helps mitigate their handling on the CC side but those user analytics companies aren't part of that.

yeah, actually good point. in cases when customer didnt trust the merchant enough with their financial data and used paypal or whatever but the shitty merchant still saw everything. definitely not compliant.

Re: Many popular iPhone apps are recording user sessions without asking

#58

Post by sexyrouter »

paxys wrote: post #11

> Many major companies, like Air Canada, Hollister and Expedia, are recording every tap and swipe you make on their iPhone apps. In most cases you won’t even realize it. And they don’t need to ask for permission. The key phrases here are "recording every tap and swipe" and "on their iPhone apps". I'm not saying it is okay, but the sensationalist headline takes away from the real issue.

Hotjar invented this.

And some porn sites also ask for camera access.

I think you are measuring video engagement/scoring from your reactions to video using your facial expressions.

It's a very good approach for bypassing fake views.

Re: Many popular iPhone apps are recording user sessions without asking

#59

Post by millstone »

kankles wrote: post #47

Replaying user behaviour is not a privacy issue. Pretty much every mobile/web app connected to the internet is doing this with varying granularity. AFAIK it's a pretty standard practice in UX and product design. A&F might have analysed hours of your finger gesture activity, but I doubt they're gonna know what brand of toilet paper you wiped with this morning.

> Replaying user behaviour is not a privacy issue. Pretty much every mobile/web app connected to the internet is doing this with varying granularity.

All I hear is that every mobile/web app connected to the internet has significant privacy issues.

Where I point my mouse is my business dammit.

Re: Many popular iPhone apps are recording user sessions without asking

#60

Post by _s »

o10449366 wrote: post #41
paxys wrote: post #11

> Many major companies, like Air Canada, Hollister and Expedia, are recording every tap and swipe you make on their iPhone apps. In most cases you won’t even realize it. And they don’t need to ask for permission. The key phrases here are "recording every tap and swipe" and "on their iPhone apps". I'm not saying it is okay, but the sensationalist headline takes away from the real issue.

I've been seeing the same sensationalist language even in "respected" publications like the NYT lately. For example, they recently published a story where it was implied that because Spotify's Messenger plugin has standard read/write permissions (necessary to ensure basic functionality like sharing songs) that it could also actively monitor, store, and modify your private messages. In smaller publications, some shodd…

I doubt the sinister / political motives - these headlines and articles are nothing more than to drive traffic / revenue.

Pick a popular company / product / service, find something that they could be doing, throw up an article suggesting that's what they could be doing but have the title inferring that it is what they are actually doing. Rinse / repeat.

Post reply on HN