11 ms·

Many popular iPhone apps are recording user sessions without asking

270 points by samaysharma 8y ago

YeahSureWhyNot 8y ago
sensationalist bs. how is ability to watch a screen recording of you using their app and typing in your credit card into THEIR app is different from the same app developer just pulling up your credit card info from their database? if you give the info to the app, the app owner will see your info. as discussed as that. the fact that its in a form of screen recording doesn't make it scary or dangerous.
- foobiekr 8y ago
  Well, one extremely important difference is that I might trust company X in part because they will want to preserve their brand but not trust poorly-run user-analytics company Y that a part of X uses which will give X plausible deniability for responsibility. The other is that PCI helps mitigate their handling on the CC side but those user analytics companies aren't part of that.
  - YeahSureWhyNot 8y ago
    yeah, actually good point. in cases when customer didnt trust the merchant enough with their financial data and used paypal or whatever but the shitty merchant still saw everything. definitely not compliant.
corbett3000 8y ago
Anyone have an idea for how to block this on your iphone? Perhaps content filtering glassboxdigital.com? Not sure if that would stop however it is that they're transmitting back to their servers.
- mcphage 8y ago
  If you can monitor it via a web proxy, then you should be able to block it the same way.
- AndrewConn 8y ago
  Possibly... I might try using Charles Proxy mobile app to observe what domains data is being sent/received from, then on your home network use something like Pi-Hole to block those domains.
  - crescentfresh 8y ago
    Does Charles (iOS) allow capturing traffic of any app launched? Is it like a "record" button for network traffic?
oth001 8y ago
Would be cool to see a non-TechCrunch link. TechCrunch shows blank pages on mobile for me
- sologuardsman2 8y ago
  https://outline.com/ZaJnG3 https://outline.com/ZaJnG3
katsura 8y ago
A two/three years ago I noticed that inspectlet (similar tech for the web) was happily sending the passwords in clear text to their servers, even though on their website they mentioned that passwords are never sent. I sent them an email and they eventually fixed it, but I wonder how many passwords and credit card CVC data did they collect before that?
- dominicr 8y ago
  A few years ago I was doing a security audit on a site and found this very problem. The marketing department had access to the Google Tag Manager account and added several (!) almost identical user tracking plug-ins. They were capturing all form fields, including credit card numbers, passwords, etc... The documentation talked about how to block this capture but that involved a developer getting involved and the developers didn't even know about the plug-in. Basically, don't add a third party service to any app or website without doing a secuity review, especially if marketing, product or UX have suggested it!
  - zimbatm 8y ago
    That's why it's good to separate the marketing website from the main product to different domains. When you can. * www.mydomain.com - install Google Tag Manager, let the marketing people go crazy * app.mydomain.com - all tracking request has to go through a developer That works well for SaaS type of products. Not so well for online stores where you want everything integrated.
    - mschuster91 8y ago
      > * www.mydomain.com - install Google Tag Manager, let the marketing people go crazy Even there, that's dangerous. Most marketing people are not trained in legal matters and install all kinds of shit with dubious legality. In addition the tons of trackers on websites make the user experience really slow. Approval by legal and tech should be the standard process, not "marketing has free rein to fuck over the company due to messing up GDPR compliance".
  - 8y ago
threatofrain 8y ago
> Apps like Abercrombie & Fitch, Hotels.com and Singapore Airlines also use Glassbox, a customer experience analytics firm, one of a handful of companies that allows developers to embed “session replay” technology into their apps. > These session replays let app developers record the screen and play them back to see how its users interacted with the app to figure out if something didn’t work or if there was an error. Every tap, button push and keyboard entry is recorded — effectively screenshotted — and sent back to the app developers.
- xenadu02 8y ago
  > effectively screenshotted IMHO that is deceptive. System alerts, notifications, etc are presented in a protect system context the application can't see so there is in fact a very big difference between recording button taps and "screenshott[ing]".
- deleted 8y ago
  [deleted]
fitzroy 8y ago
"Record the screen" could be more precise. I assumed the article was saying apps were literally recording a video of the screen, complete with alert popups etc (like the Screen Recorder app). I realize there isn't functionally much difference within an app. But unless I'm reading it incorrectly, it's not recording the screen it's just the UI of the app. That's not nothing, but I always assumed (sadly?) that a lot of apps have been doing that for years to hone their UX dark arts.
- jrockway 8y ago
  Yeah. An equally hysterical article could be written about web servers recording your IP address and what page you visited. Maybe this is a bit much, but developers do need some data as to how their app is performing in the real world. You might have some metrics that says 0% of visitors to your order checkout page on FooPhone 1.0 are completing orders successfully. With a screenshot, you can immediately see that that screen doesn't even work on that device. It doesn't sound like a tragic loss of privacy to me, but rather an important tool for developers to help smooth over the reality of massive device incompatibility.
  - kovrik 8y ago
    It is all good until you start sending credit card details and all other personal and sensitive information without even asking user about it. As a user, I don't care at all if it makes dev's life easier. I bought the app and don't want my personal info to be leaked.
    - kbenson 8y ago
      So, we're supposed to trust the application's main process to accept a credit card securely, but not trust their system which tracks UX? It might be one more place to screw up, but so is just having more actions your app can do. I'm not sure I see any difference between an app recording all I traction within it (for single purpose apps, but not browsers) and a store video recording everything in it.
paxys 8y ago
> Many major companies, like Air Canada, Hollister and Expedia, are recording every tap and swipe you make on their iPhone apps. In most cases you won’t even realize it. And they don’t need to ask for permission. The key phrases here are "recording every tap and swipe" and "on their iPhone apps". I'm not saying it is okay, but the sensationalist headline takes away from the real issue.
- regul8 8y ago
  Agreed, clickbait. But what else would you expect from pseudo-journalists at TechCrunch?
- cglace 8y ago
  I worked in this space and its definitly possible https://uxcam.com/ https://uxcam.com/ and https://appsee.com/ https://appsee.com/ are other players in the space. They record the full screen by default. Much like fullstory for desktop.
  - deleted 8y ago
    [deleted]
- userbinator 8y ago
  "Many popular iPhone apps record what you do with them" would be perfectly accurate and less sensationalist. I saw the title and thought "so the app is recording what's on the screen... which on a phone, is going to be itself... that's not such a big deal." As much as I don't like this sort of telemetry, it is in no way the sort of security issue the title appears to be insinuating.
  - ryanwhitney 8y ago
    How is that not a major privacy and security issue? A screen recording of your session would expose passwords in many cases as the characters show up one at a time before being masked.
    - 8y ago
sydli 8y ago
Reminds me of this research from Princeton, on the exfiltration of personal data via equivalent session-replay services for web: https://freedom-to-tinker.com/2017/11/15/no-boundaries-exfiltration-of-personal-data-by-session-replay-scripts/ https://freedom-to-tinker.com/2017/11/15/no-boundaries-exfil...
spicymaki 8y ago
Acquiring end-user telemetry by recording inputs and sending them to the app developer is not great especially if they don't ask for your permission. This is quite different than the sensational headline. update: fixed wording
- octocode 8y ago
  Telemetry implies capturing data in the form of measurements. Stuff like "touchscreen swipe: element, location, and duration". A click heat-map would be an example of telemetry. This isn't the same thing. This is an actual recording of a user's entire session. While it doesn't capture a rendered image like a "screen recorder" would do, it captures every change in real-time, so it can play it back perfectly, and the end result is the same: you can watch a video of your user's session. And I can personally confirm that people definitely stand around the water cooler and talk about the stuff they watched. It's creepy.
octocode 8y ago
Why does this article specifically single out iPhones? This happens on all platforms, even web apps.
- somebodynew 8y ago
  Apple has enough of a history responding to things like this to make publishing an article about bad app behavior on iPhones a plausible way to bring it to an end. If your goal is to change app store policies, including Android phones is just going to dilute the possibility that Apple responds to an iPhone article for no additional gain because Google is unlikely to do anything.
  - octocode 8y ago
    A fair point!
  - octocode 8y ago
    "Apple tells app developers to disclose or remove screen recording code" You win a medal!
- JustSomeNobody 8y ago
  Is it singling out Apple or did they just hear about it happening on Apple and decide to write that up? Sure they could have investigated to see if it happens on other platforms, but you gotta get the story out there fast otherwise someone else will.
MagicPropmaker 8y ago
Users are very bad at describing what they did when an app crashed. Recording application state and logging it is a wonderful aid to debugging. I did this routinely when deploying in-house applications.
- wmf 8y ago
  Maybe Apple should make this into a built-in iOS feature with proper privacy and data minimization.
  - saagarjha 8y ago
    Even when your app crashes, Apple gives you crash log and nothing else, so I don't see they providing a way to tag users more granularly than this.
    - wmf 8y ago
      But it's fine to allow third parties to do it?
- lawnchair_larry 8y ago
  I’m not sure what gave you the idea that you don’t need permission. Why don’t we go ahead and put a camera in your bathroom in case the plumber ever needs to diagnose a leak?
  - cordite 8y ago
    The same applies to web applications. Fullstory (developed by ex Googlers) and others are in this market too, but I don’t see them monetizing what they get to parties outside of charging the app maker.
crispytx 8y ago
People that complain about this stuff obviously have never launched an app before. If you don't record what people are doing with your app, then you're not going to have any idea if anyone is actually using it, or if it is any good, or if there is anything you need to fix.
- saagarjha 8y ago
  > If you don't record what people are doing with your app, then you're not going to have any idea if anyone is actually using it, or if it is any good, or if there is anything you need to fix. There are other ways to get information as to what to fix, and I have no need to know what people are doing in my app.
vlozko 8y ago
I’ve worked with a similar library before: appsee. While it does have a little bit of value in helping trace crash reports and provide heat maps, we ultimately got rid of it and for the better. It can be hard to find and “cover up” every single place where sensitive information can be displayed. That’s really up to the developer to manually do most of it, though some of it is done automatically (e.g. password fields). Even the most well intentioned developer can miss out on a label that shows th user’s email or a text field with address data. And that’s just the developers who know about this challenge and try to do something about it. I’d venture many don’t. Just as bad is the performance hit. Taking screenshots utilizes the main thread (no way around it) and it just kills any attempts at making buttery smooth animations throughout the app. Suffice to say, such libraries are just not worth it for the perceived value they allegedly provide.
jchw 8y ago
This has been done for many years on the web. The first one I can recall was Hotjar, which offered both heat maps and session replay. I have no comment regarding the ethical implications of this technology, but I can see why it is useful practically.
nerdile 8y ago
Ok. So what? Software and services have kept usage metrics and clickstream data for decades. They have privacy policies saying that they may collect data about how you use their product. This is that data. So, is this a surprise? If you don't want Abercrombie to know which items you looked at, don't look at them on the Abercrombie app, or at the Abercrombie store, or on the Abercrombie website.
- yeahSoNah 8y ago
  Yeah... but... I didn’t want to have to boycott a company that has something reasonably priced, and worth buying, just because they can’t control themselves, and feel an urgent need to stalk me, and help other stalkers stalk me, and maybe even know enough about me to affect employment opportunities, or help others learn about how much money they can make of me, whether they should insure me, rent an apartment to me, offer lines of credit, help me buy a home or property, offer up granular evidence of my whereabouts, which could inform on me during a forensic investigation, attempt to manipulate me according to sexuality and orientation, pretend their my friend...
- millstone 8y ago
  Abercrombie's data collection should start and end at the data I choose to send them, including the products I click on. I do not expect Abercrombie to "see what I do in real time," including where I position my mouse on my screen, text I type and then choose to delete, my physical location, etc.
  - kkarakk 8y ago
    then goto the mall? except wait, probably tracked on security cam there nowadays + credit card transactions are tracked + tracking movement in the store using multiple wifi APs + tracking what you purchase internally. the expectation of privacy when dealing with a business that can monetise the data about you in some way may be a dead thing already until the govt gets involved.
    - calgoo 8y ago
kankles 8y ago
Replaying user behaviour is not a privacy issue. Pretty much every mobile/web app connected to the internet is doing this with varying granularity. AFAIK it's a pretty standard practice in UX and product design. A&F might have analysed hours of your finger gesture activity, but I doubt they're gonna know what brand of toilet paper you wiped with this morning.
- millstone 8y ago
  > Replaying user behaviour is not a privacy issue. Pretty much every mobile/web app connected to the internet is doing this with varying granularity. All I hear is that every mobile/web app connected to the internet has significant privacy issues. Where I point my mouse is my business dammit.
- jimjimjim 8y ago
  Just because everyone does it doesn't make it right!
- TheChaplain 8y ago
  I would rather not having an app sending screenshots of the screen / record taps while I input my CC number. Nor of any alerts / notifications that are unrelated to the app itself. So I'd say it can be quite a privacy issue.
  - fasteddie 8y ago
    Many of these companies (e.g. FullStory, Hotjar) obfuscate all input fields for exactly this reason.
    - sbr464 8y ago
      I’m sorry but they don’t, at least in a sensible defaults, easy/reliable way. Unless they’ve changed recently. We did extensive testing and found it was up to the end user implementing the integrations, and their regard for this topic/privacy.
  - 8y ago
JazzXP 8y ago
So if I'm understanding this right, the big issue they have is that they're not telling the customers that they're doing it. Can't any website do exactly the same thing in recording every keystroke written into it without a customer knowing? Does it really even matter if you're sending them your credit card details anyway?
- TeMPOraL 8y ago
  > Does it really even matter if you're sending them your credit card details anyway? But are you sending them this info? I thought a lot of sites used third-party payment processors precisely in order not to handle this data themselves (and be liable for mishandling).
  - JazzXP 8y ago
    I guess in an app they could screen record that transaction, but if they're only storing fields and values, this is outside of what they can capture.
Theodores 8y ago
Screen recording apps are fine if you want to go over how a small group of people use your website however the data is hard to analyse. Plain old Google Analytics is a bigger deal when you think about it. Anyone that has this configured half decently where the IDs are provided by some backend server really has got the low down on how you use the website. Every aspect of 'engagement' can be recorded and reports made that don't entail watching through untold hours of 'user engagement'. It is a bit like spying in the modern age. In the olden days any intelligence agency could throw resources at tracking one individual of interest. However if you need a team of twenty people to stalk someone then getting the budget can be hard. They would have to be the 'Chairman of the Communist Leadership' or the leader of a striking union for that to be approved. In the modern era we all know how NSA et al. do it, surveillance on everyone and able to do a report on anyone deemed 'Communist' (or whatever). It isn't the 'everything on screen' you need to worry about as nobody except an intern is going to be looking at that. It is the half decent Google Analytics setups that are a far greater concern if you are terrified of marketing people. Yet nobody bats an eyelid to Google Analytics, the cookie notices say it is mostly harmless and just there for your own good. Luckily though very few companies are really that competent at Google Analytics. They may have people adding ever more bloat to Google Tag Manager for this to feed various things such as affiliate marketing schemes, however the people doing SEO are rarely familiar with web development and, not understanding the 'problem space', don't realise the possibilities.
zaidf 8y ago
This is horrible reporting if by “record” they mean “log meta data like swipe coordinates and recreate it.” That is not the same as record.
- haukilup 8y ago
  > This is horrible reporting if by “record” they mean “log meta data like swipe coordinates and recreate it.” That is not the same as record. Is there much of a practical difference here? Employees at the company can essentially watch a video-like recreation of how you went through and used their app. This includes details that you might not expect such as which email you typed into a field before backspacing and choosing another to sign up with. I want to believe that a product owner at companies like Tinder aren't watching videos of me sexting someone to "learn how we can improve the user experience". If the response is then to say "don't use Tinder!", start considering the alternatives - you end up having to trust someone, or do nothing digitally.
  - eddieroger 8y ago
    > Is there much of a practical difference here? Yes, because an app provider can know a dozen different ways what they're showing you already, but nothing else on your system. There is a world of difference between Tinder knowing i dismissed an incoming text alert because I swiped up at the top of the screen and knowing what the content of that text message was, to use your example. Tinder can already log the content of the messages you send in their platform,
chaitanya 8y ago
A lot of people here are commenting that its no big deal that organizations are recording every screen, tap and swipe for their own apps. There are two problems with that: 1. As the article mentions, in some cases these apps end up leaking sensitive data like credit card detail and passwords. Generally, if you are taking snapshots of the user's screen instead of sending text metrics, it becomes much harder to mask sensitive data at all times. 2. The bigger issue is that these services generally use third parties to record this, and their privacy policy is a big problem. For example, Glassbox explicitly mentions that it will share end user personal data with their "enterprise" clients (which I am guessing are basically ad companies): > From time to time, GLASSBOX grants certain of its enterprise clients a license or other rights to GLASSBOX’s proprietary software products and solutions (the “GLASSBOX Solutions”). Through their use of these GLASSBOX Solutions and/or through other means, enterprise clients of GLASSBOX may get access to, collect and use: (i) End User non-personally identifiable information; and (ii) End User Personal Data. > There are also times when we will combine such information with additional non-personal or de-identified information we obtain from other companies as well as End User Personal Data, in order for our enterprise clients to market directly to a certain person subject to requirements of applicable law. We typically analyze this information and organize it into user groups and audiences, based on factors such as age, gender, geography, interests and online actions. We and our enterprise clients then use these user groups and audiences, along with information about the possible relationships among different browsers and devices, to design and deliver customized advertising campaigns or other relevant content. https://www.glassboxdigital.com/privacy-policy/ https://www.glassboxdigital.com/privacy-policy/
- khalilravanna 8y ago
  Are any of these apps used in the EU? If there’s no user consent for this privacy policy it strikes me that this isn’t GDPR compliant and these guys are just waiting to get fined. I wonder if they can get it around it by having their clients (Hotels.com, etc) essentially proxy this consent through their own privacy policies.
  - vsl 8y ago
    GDPR covers personal data. It is not universal magic dust for punishing everything you dislike. Movement of your finger on the screen is not personal data. Screenshots most of the time aren’t either.
deleted 8y ago
[deleted]
HenryBemis 8y ago
One of the reasons why I switched from iPhone to Android is the firewall. On my jailbroken i-devices (all of them) I was always installing "Firewall IP", and when an app was running, for any connection not previously (or globally - meaning rule applies for all apps) approved I would get a pop-up message (screenshot of an earlier iOS Firewall IP)[1]. Now with the jailbreaks being less efficient, and the Firewall IP app not been updated for a few years, I switched to Android and I am using "NoRoot Firewall" [2] for the same exactly purpose. I globally block all FB, ads, trackers There is always the extra option for rooter/jailbroken phones to block things on the hosts file using host file selections from someonewhocares.org [3]. [1]: https://rdsbc.files.wordpress.com/2011/03/wall1.png https://rdsbc.files.wordpress.com/2011/03/wall1.png [2]: https://lh3.ggpht.com/fXRZfgSmArBemdjABjUDu0ibP9Gis3GV5YXTVj_Ix5-967CtoSvZFXxAx0mQdOj0Klc=w1000-h800 https://lh3.ggpht.com/fXRZfgSmArBemdjABjUDu0ibP9Gis3GV5YXTVj... [3]: https://someonewhocares.org/hosts/ https://someonewhocares.org/hosts/
- mangix 8y ago
  One annoyance is that SafetyNet pretty much prevents using Google Pay on a rooted or modified device.
  - 0x38B 8y ago
    Quoting https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445 https://forum.xda-developers.com/apps/magisk/official-magisk...: "Installing Magisk will give you ROOT, a super powerful Systemless Interface, Magisk Modules support, and hide from tons of integrity tests like SafetyNet!" My Pixel 2 is rooted with Magisk, and passes Safetynet. I use Google Pay all the time.
- simonh 8y ago
  I think for most users Apple does a good job protecting them, but this is definitely one significant area of weakness for the platform. There are ways to implement similar controls using a VPN service[0], but of course then you need to trust the VPN operator. [0]https://techcrunch.com/2018/10/24/smart-firewall-guardian-iphone-app-privacy-before-profits/ https://techcrunch.com/2018/10/24/smart-firewall-guardian-ip...
kaolti 8y ago
Not sure how long it's been there, but found this in Inspectlet's terms of service: 7. Disclosure. As soon as you begin to use Our Service, You agree to add a disclosure to either Your terms of use, user agreement and/or privacy policy to inform Your end-users and customers of Inspectlet’s access to their Personal Information through Your website, and adding a link to Our Privacy Policy which governs Our use of all such Personal Information accessed by Inspectlet through Your website or through Your use of Our Services.
epaga 8y ago
I'm seeing lots of "but this is super helpful to improve UI flow, and normally isn't nefarious!" Well, as long as the app 1. lets me know and 2. lets me choose whether to have this feature on or not, I don't have a problem with an app recording my usage of it in order to improve UI flow or what have you. The issue here is that 1. sensitive data is being transmitted via automated screenshots and 2. the users are not even being made aware of this fact, let alone being given a choice.
- iguy 8y ago
  Seems like a useful testing feature that ought only to be allowed on testing versions -- the ones for which there are already different rules & different certificates.
- ovi256 8y ago
  > lets me choose whether to have this feature on or not And that's why UX is optimized for people who don't care about privacy :)
- kgwxd 8y ago
  Options aren't good enough, the fact the code is even in there is scary and there's nothing to gurantee your selection is being respected. No telemetry code and open source to prove it is the only kind of software anyone should be installing. I'm starting to think distributing software like this should be akin to wire tapping.
  - bo1024 8y ago
    If you run someone's software on your device, you are giving them a huge amount of trust. So many privacy and security concerns stem from people hoping this weren't true.
z3t4 8y ago
Watching users via tracking and telemetry is very useful in order to learn about your users. But I also think it's also unethical. With the mindset that users are "lemings" ¹ where your job as a developer is to optimize profits from these "dumb fucks"². 1: https://en.wikipedia.org/wiki/Lemmings_(video_game) https://en.wikipedia.org/wiki/Lemmings_(video_game) 2: https://en.wikiquote.org/wiki/Mark_Zuckerberg https://en.wikiquote.org/wiki/Mark_Zuckerberg
coldcode 8y ago
Long ago a company I worked for had an iOS app and use some IBM product for the web version (Leaf? or something) and they forced us to use it in the app as well, it recorded the contents of each page basically (some fields were blanked out). It also crashed so much it was worthless. I never found it remotely useful to have such detailed info. Tagging service calls with a GUID was much more useful, as well as recording service errors and exceptions in Google Analytics. While we of course knew who the tag belonged to (after all they were our customer's orders) it was of no use to anyone listening in or watching the tags go by.
- JustSomeNobody 8y ago
  The problem with analytics is too much info or not enough info. At each employer, I usually do my best to get involved with the analytics portion of our applications. Apart from just finding it interesting, I also like to try and interject some sanity. I've seen managers walk in, puff our their chest and say, "Just collect everything. We'll sort through it here. Make it happen." After they walk out I engage everyone in conversation about that and try and let them know that we should actually be creating a list of questions we want answered and work from there. Collecting everything is almost always not the right idea.
polote 8y ago
I was in charge of building this kind of product for another analytics company, this technology is called session replay, and it is used for many use cases, like : UX improvement/ support/ bug detections ... Most of vendors record keyboard inputs and thus can record password as well as credit card information, there was an affair about it a few years ago [1]. To not have this issue, most of vendors provide a way to not record those information. It requires manual tagging of the website on the element that contains critical content. But many of session replays vendors have many clients, and don't force or don't verify that all the critical information are masked. This is not GDPR compliant, because when the GDPR apply you need to consent of the user to record his PII, and you are not even allowed to record information like password, sexual orientation, credit card even if you have the consent. Two things: - Nowadays on the web most of payment pages are not hosted on the client website, so those analytics tools are not included (but we still have many websites that don't use third party for that) - This data is not (most of the time) recorded in a structured way, data of inputs is recorded as some element of an HTML, and thus it is not super easy to extract the information at scale [1] https://freedom-to-tinker.com/2018/02/26/no-boundaries-for-credentials-password-leaks-to-mixpanel-and-session-replay-companies/ https://freedom-to-tinker.com/2018/02/26/no-boundaries-for-c...
ubermonkey 8y ago
I guess I'm not SUPER concerned about a given app reporting on what I do in that app back to the publisher. It might even be possible to convince me it's a reasonable way to figure out what the app does well and what it needs to improve. We could never get away with doing this for our (Windows) app, but sometimes I have conversations with people in my user base and I really, really wish I had some idea of how they got into some $random_weird_state. But yeah, it oughta be in the T&C if nothing else.

270 points by samaysharma 8y ago

sensationalist bs. how is ability to watch a screen recording of you using their app and typing in your credit card into THEIR app is different from the same app developer just pulling up your credit card info from their database? if you give the info to the app, the app owner will see your info. as discussed as that. the fact that its in a form of screen recording doesn't make it scary or dangerous.

foobiekr 8y ago
Well, one extremely important difference is that I might trust company X in part because they will want to preserve their brand but not trust poorly-run user-analytics company Y that a part of X uses which will give X plausible deniability for responsibility. The other is that PCI helps mitigate their handling on the CC side but those user analytics companies aren't part of that.
- YeahSureWhyNot 8y ago
  yeah, actually good point. in cases when customer didnt trust the merchant enough with their financial data and used paypal or whatever but the shitty merchant still saw everything. definitely not compliant.

corbett3000 8y ago

Anyone have an idea for how to block this on your iphone? Perhaps content filtering glassboxdigital.com? Not sure if that would stop however it is that they're transmitting back to their servers.

mcphage 8y ago
If you can monitor it via a web proxy, then you should be able to block it the same way.
AndrewConn 8y ago
Possibly... I might try using Charles Proxy mobile app to observe what domains data is being sent/received from, then on your home network use something like Pi-Hole to block those domains.
- crescentfresh 8y ago
  Does Charles (iOS) allow capturing traffic of any app launched? Is it like a "record" button for network traffic?

oth001 8y ago

Would be cool to see a non-TechCrunch link. TechCrunch shows blank pages on mobile for me

sologuardsman2 8y ago
https://outline.com/ZaJnG3 https://outline.com/ZaJnG3

katsura 8y ago

A two/three years ago I noticed that inspectlet (similar tech for the web) was happily sending the passwords in clear text to their servers, even though on their website they mentioned that passwords are never sent. I sent them an email and they eventually fixed it, but I wonder how many passwords and credit card CVC data did they collect before that?

dominicr 8y ago
A few years ago I was doing a security audit on a site and found this very problem. The marketing department had access to the Google Tag Manager account and added several (!) almost identical user tracking plug-ins. They were capturing all form fields, including credit card numbers, passwords, etc... The documentation talked about how to block this capture but that involved a developer getting involved and the developers didn't even know about the plug-in. Basically, don't add a third party service to any app or website without doing a secuity review, especially if marketing, product or UX have suggested it!
- zimbatm 8y ago
  That's why it's good to separate the marketing website from the main product to different domains. When you can. * www.mydomain.com - install Google Tag Manager, let the marketing people go crazy * app.mydomain.com - all tracking request has to go through a developer That works well for SaaS type of products. Not so well for online stores where you want everything integrated.
  - mschuster91 8y ago
    > * www.mydomain.com - install Google Tag Manager, let the marketing people go crazy Even there, that's dangerous. Most marketing people are not trained in legal matters and install all kinds of shit with dubious legality. In addition the tons of trackers on websites make the user experience really slow. Approval by legal and tech should be the standard process, not "marketing has free rein to fuck over the company due to messing up GDPR compliance".
- 8y ago

threatofrain 8y ago

> Apps like Abercrombie & Fitch, Hotels.com and Singapore Airlines also use Glassbox, a customer experience analytics firm, one of a handful of companies that allows developers to embed “session replay” technology into their apps. > These session replays let app developers record the screen and play them back to see how its users interacted with the app to figure out if something didn’t work or if there was an error. Every tap, button push and keyboard entry is recorded — effectively screenshotted — and sent back to the app developers.

xenadu02 8y ago
> effectively screenshotted IMHO that is deceptive. System alerts, notifications, etc are presented in a protect system context the application can't see so there is in fact a very big difference between recording button taps and "screenshott[ing]".
deleted 8y ago
[deleted]

fitzroy 8y ago

"Record the screen" could be more precise. I assumed the article was saying apps were literally recording a video of the screen, complete with alert popups etc (like the Screen Recorder app). I realize there isn't functionally much difference within an app. But unless I'm reading it incorrectly, it's not recording the screen it's just the UI of the app. That's not nothing, but I always assumed (sadly?) that a lot of apps have been doing that for years to hone their UX dark arts.

jrockway 8y ago
Yeah. An equally hysterical article could be written about web servers recording your IP address and what page you visited. Maybe this is a bit much, but developers do need some data as to how their app is performing in the real world. You might have some metrics that says 0% of visitors to your order checkout page on FooPhone 1.0 are completing orders successfully. With a screenshot, you can immediately see that that screen doesn't even work on that device. It doesn't sound like a tragic loss of privacy to me, but rather an important tool for developers to help smooth over the reality of massive device incompatibility.
- kovrik 8y ago
  It is all good until you start sending credit card details and all other personal and sensitive information without even asking user about it. As a user, I don't care at all if it makes dev's life easier. I bought the app and don't want my personal info to be leaked.
  - kbenson 8y ago
    So, we're supposed to trust the application's main process to accept a credit card securely, but not trust their system which tracks UX? It might be one more place to screw up, but so is just having more actions your app can do. I'm not sure I see any difference between an app recording all I traction within it (for single purpose apps, but not browsers) and a store video recording everything in it.

paxys 8y ago

> Many major companies, like Air Canada, Hollister and Expedia, are recording every tap and swipe you make on their iPhone apps. In most cases you won’t even realize it. And they don’t need to ask for permission. The key phrases here are "recording every tap and swipe" and "on their iPhone apps". I'm not saying it is okay, but the sensationalist headline takes away from the real issue.

regul8 8y ago
Agreed, clickbait. But what else would you expect from pseudo-journalists at TechCrunch?
cglace 8y ago
I worked in this space and its definitly possible https://uxcam.com/ https://uxcam.com/ and https://appsee.com/ https://appsee.com/ are other players in the space. They record the full screen by default. Much like fullstory for desktop.
- deleted 8y ago
  [deleted]
userbinator 8y ago
"Many popular iPhone apps record what you do with them" would be perfectly accurate and less sensationalist. I saw the title and thought "so the app is recording what's on the screen... which on a phone, is going to be itself... that's not such a big deal." As much as I don't like this sort of telemetry, it is in no way the sort of security issue the title appears to be insinuating.
- ryanwhitney 8y ago
  How is that not a major privacy and security issue? A screen recording of your session would expose passwords in many cases as the characters show up one at a time before being masked.
  - 8y ago

sydli 8y ago

Reminds me of this research from Princeton, on the exfiltration of personal data via equivalent session-replay services for web: https://freedom-to-tinker.com/2017/11/15/no-boundaries-exfiltration-of-personal-data-by-session-replay-scripts/ https://freedom-to-tinker.com/2017/11/15/no-boundaries-exfil...

spicymaki 8y ago

Acquiring end-user telemetry by recording inputs and sending them to the app developer is not great especially if they don't ask for your permission. This is quite different than the sensational headline. update: fixed wording

octocode 8y ago
Telemetry implies capturing data in the form of measurements. Stuff like "touchscreen swipe: element, location, and duration". A click heat-map would be an example of telemetry. This isn't the same thing. This is an actual recording of a user's entire session. While it doesn't capture a rendered image like a "screen recorder" would do, it captures every change in real-time, so it can play it back perfectly, and the end result is the same: you can watch a video of your user's session. And I can personally confirm that people definitely stand around the water cooler and talk about the stuff they watched. It's creepy.

octocode 8y ago

Why does this article specifically single out iPhones? This happens on all platforms, even web apps.

somebodynew 8y ago
Apple has enough of a history responding to things like this to make publishing an article about bad app behavior on iPhones a plausible way to bring it to an end. If your goal is to change app store policies, including Android phones is just going to dilute the possibility that Apple responds to an iPhone article for no additional gain because Google is unlikely to do anything.
- octocode 8y ago
  A fair point!
- octocode 8y ago
  "Apple tells app developers to disclose or remove screen recording code" You win a medal!
JustSomeNobody 8y ago
Is it singling out Apple or did they just hear about it happening on Apple and decide to write that up? Sure they could have investigated to see if it happens on other platforms, but you gotta get the story out there fast otherwise someone else will.

MagicPropmaker 8y ago

Users are very bad at describing what they did when an app crashed. Recording application state and logging it is a wonderful aid to debugging. I did this routinely when deploying in-house applications.

wmf 8y ago
Maybe Apple should make this into a built-in iOS feature with proper privacy and data minimization.
- saagarjha 8y ago
  Even when your app crashes, Apple gives you crash log and nothing else, so I don't see they providing a way to tag users more granularly than this.
  - wmf 8y ago
    But it's fine to allow third parties to do it?
lawnchair_larry 8y ago
I’m not sure what gave you the idea that you don’t need permission. Why don’t we go ahead and put a camera in your bathroom in case the plumber ever needs to diagnose a leak?
- cordite 8y ago
  The same applies to web applications. Fullstory (developed by ex Googlers) and others are in this market too, but I don’t see them monetizing what they get to parties outside of charging the app maker.

crispytx 8y ago

People that complain about this stuff obviously have never launched an app before. If you don't record what people are doing with your app, then you're not going to have any idea if anyone is actually using it, or if it is any good, or if there is anything you need to fix.

saagarjha 8y ago
> If you don't record what people are doing with your app, then you're not going to have any idea if anyone is actually using it, or if it is any good, or if there is anything you need to fix. There are other ways to get information as to what to fix, and I have no need to know what people are doing in my app.

vlozko 8y ago

I’ve worked with a similar library before: appsee. While it does have a little bit of value in helping trace crash reports and provide heat maps, we ultimately got rid of it and for the better. It can be hard to find and “cover up” every single place where sensitive information can be displayed. That’s really up to the developer to manually do most of it, though some of it is done automatically (e.g. password fields). Even the most well intentioned developer can miss out on a label that shows th user’s email or a text field with address data. And that’s just the developers who know about this challenge and try to do something about it. I’d venture many don’t. Just as bad is the performance hit. Taking screenshots utilizes the main thread (no way around it) and it just kills any attempts at making buttery smooth animations throughout the app. Suffice to say, such libraries are just not worth it for the perceived value they allegedly provide.

jchw 8y ago

This has been done for many years on the web. The first one I can recall was Hotjar, which offered both heat maps and session replay. I have no comment regarding the ethical implications of this technology, but I can see why it is useful practically.

nerdile 8y ago

Ok. So what? Software and services have kept usage metrics and clickstream data for decades. They have privacy policies saying that they may collect data about how you use their product. This is that data. So, is this a surprise? If you don't want Abercrombie to know which items you looked at, don't look at them on the Abercrombie app, or at the Abercrombie store, or on the Abercrombie website.

yeahSoNah 8y ago
Yeah... but... I didn’t want to have to boycott a company that has something reasonably priced, and worth buying, just because they can’t control themselves, and feel an urgent need to stalk me, and help other stalkers stalk me, and maybe even know enough about me to affect employment opportunities, or help others learn about how much money they can make of me, whether they should insure me, rent an apartment to me, offer lines of credit, help me buy a home or property, offer up granular evidence of my whereabouts, which could inform on me during a forensic investigation, attempt to manipulate me according to sexuality and orientation, pretend their my friend...
millstone 8y ago
Abercrombie's data collection should start and end at the data I choose to send them, including the products I click on. I do not expect Abercrombie to "see what I do in real time," including where I position my mouse on my screen, text I type and then choose to delete, my physical location, etc.
- kkarakk 8y ago
  then goto the mall? except wait, probably tracked on security cam there nowadays + credit card transactions are tracked + tracking movement in the store using multiple wifi APs + tracking what you purchase internally. the expectation of privacy when dealing with a business that can monetise the data about you in some way may be a dead thing already until the govt gets involved.
  - calgoo 8y ago

kankles 8y ago

Replaying user behaviour is not a privacy issue. Pretty much every mobile/web app connected to the internet is doing this with varying granularity. AFAIK it's a pretty standard practice in UX and product design. A&F might have analysed hours of your finger gesture activity, but I doubt they're gonna know what brand of toilet paper you wiped with this morning.

millstone 8y ago
> Replaying user behaviour is not a privacy issue. Pretty much every mobile/web app connected to the internet is doing this with varying granularity. All I hear is that every mobile/web app connected to the internet has significant privacy issues. Where I point my mouse is my business dammit.
jimjimjim 8y ago
Just because everyone does it doesn't make it right!
TheChaplain 8y ago
I would rather not having an app sending screenshots of the screen / record taps while I input my CC number. Nor of any alerts / notifications that are unrelated to the app itself. So I'd say it can be quite a privacy issue.
- fasteddie 8y ago
  Many of these companies (e.g. FullStory, Hotjar) obfuscate all input fields for exactly this reason.
  - sbr464 8y ago
    I’m sorry but they don’t, at least in a sensible defaults, easy/reliable way. Unless they’ve changed recently. We did extensive testing and found it was up to the end user implementing the integrations, and their regard for this topic/privacy.
- 8y ago

JazzXP 8y ago

So if I'm understanding this right, the big issue they have is that they're not telling the customers that they're doing it. Can't any website do exactly the same thing in recording every keystroke written into it without a customer knowing? Does it really even matter if you're sending them your credit card details anyway?

TeMPOraL 8y ago
> Does it really even matter if you're sending them your credit card details anyway? But are you sending them this info? I thought a lot of sites used third-party payment processors precisely in order not to handle this data themselves (and be liable for mishandling).
- JazzXP 8y ago
  I guess in an app they could screen record that transaction, but if they're only storing fields and values, this is outside of what they can capture.

Theodores 8y ago

Screen recording apps are fine if you want to go over how a small group of people use your website however the data is hard to analyse. Plain old Google Analytics is a bigger deal when you think about it. Anyone that has this configured half decently where the IDs are provided by some backend server really has got the low down on how you use the website. Every aspect of 'engagement' can be recorded and reports made that don't entail watching through untold hours of 'user engagement'. It is a bit like spying in the modern age. In the olden days any intelligence agency could throw resources at tracking one individual of interest. However if you need a team of twenty people to stalk someone then getting the budget can be hard. They would have to be the 'Chairman of the Communist Leadership' or the leader of a striking union for that to be approved. In the modern era we all know how NSA et al. do it, surveillance on everyone and able to do a report on anyone deemed 'Communist' (or whatever). It isn't the 'everything on screen' you need to worry about as nobody except an intern is going to be looking at that. It is the half decent Google Analytics setups that are a far greater concern if you are terrified of marketing people. Yet nobody bats an eyelid to Google Analytics, the cookie notices say it is mostly harmless and just there for your own good. Luckily though very few companies are really that competent at Google Analytics. They may have people adding ever more bloat to Google Tag Manager for this to feed various things such as affiliate marketing schemes, however the people doing SEO are rarely familiar with web development and, not understanding the 'problem space', don't realise the possibilities.

zaidf 8y ago

This is horrible reporting if by “record” they mean “log meta data like swipe coordinates and recreate it.” That is not the same as record.

haukilup 8y ago
> This is horrible reporting if by “record” they mean “log meta data like swipe coordinates and recreate it.” That is not the same as record. Is there much of a practical difference here? Employees at the company can essentially watch a video-like recreation of how you went through and used their app. This includes details that you might not expect such as which email you typed into a field before backspacing and choosing another to sign up with. I want to believe that a product owner at companies like Tinder aren't watching videos of me sexting someone to "learn how we can improve the user experience". If the response is then to say "don't use Tinder!", start considering the alternatives - you end up having to trust someone, or do nothing digitally.
- eddieroger 8y ago
  > Is there much of a practical difference here? Yes, because an app provider can know a dozen different ways what they're showing you already, but nothing else on your system. There is a world of difference between Tinder knowing i dismissed an incoming text alert because I swiped up at the top of the screen and knowing what the content of that text message was, to use your example. Tinder can already log the content of the messages you send in their platform,

chaitanya 8y ago

A lot of people here are commenting that its no big deal that organizations are recording every screen, tap and swipe for their own apps. There are two problems with that: 1. As the article mentions, in some cases these apps end up leaking sensitive data like credit card detail and passwords. Generally, if you are taking snapshots of the user's screen instead of sending text metrics, it becomes much harder to mask sensitive data at all times. 2. The bigger issue is that these services generally use third parties to record this, and their privacy policy is a big problem. For example, Glassbox explicitly mentions that it will share end user personal data with their "enterprise" clients (which I am guessing are basically ad companies): > From time to time, GLASSBOX grants certain of its enterprise clients a license or other rights to GLASSBOX’s proprietary software products and solutions (the “GLASSBOX Solutions”). Through their use of these GLASSBOX Solutions and/or through other means, enterprise clients of GLASSBOX may get access to, collect and use: (i) End User non-personally identifiable information; and (ii) End User Personal Data. > There are also times when we will combine such information with additional non-personal or de-identified information we obtain from other companies as well as End User Personal Data, in order for our enterprise clients to market directly to a certain person subject to requirements of applicable law. We typically analyze this information and organize it into user groups and audiences, based on factors such as age, gender, geography, interests and online actions. We and our enterprise clients then use these user groups and audiences, along with information about the possible relationships among different browsers and devices, to design and deliver customized advertising campaigns or other relevant content. https://www.glassboxdigital.com/privacy-policy/ https://www.glassboxdigital.com/privacy-policy/

khalilravanna 8y ago
Are any of these apps used in the EU? If there’s no user consent for this privacy policy it strikes me that this isn’t GDPR compliant and these guys are just waiting to get fined. I wonder if they can get it around it by having their clients (Hotels.com, etc) essentially proxy this consent through their own privacy policies.
- vsl 8y ago
  GDPR covers personal data. It is not universal magic dust for punishing everything you dislike. Movement of your finger on the screen is not personal data. Screenshots most of the time aren’t either.

deleted 8y ago

[deleted]

HenryBemis 8y ago

One of the reasons why I switched from iPhone to Android is the firewall. On my jailbroken i-devices (all of them) I was always installing "Firewall IP", and when an app was running, for any connection not previously (or globally - meaning rule applies for all apps) approved I would get a pop-up message (screenshot of an earlier iOS Firewall IP)[1]. Now with the jailbreaks being less efficient, and the Firewall IP app not been updated for a few years, I switched to Android and I am using "NoRoot Firewall" [2] for the same exactly purpose. I globally block all FB, ads, trackers There is always the extra option for rooter/jailbroken phones to block things on the hosts file using host file selections from someonewhocares.org [3]. [1]: https://rdsbc.files.wordpress.com/2011/03/wall1.png https://rdsbc.files.wordpress.com/2011/03/wall1.png [2]: https://lh3.ggpht.com/fXRZfgSmArBemdjABjUDu0ibP9Gis3GV5YXTVj_Ix5-967CtoSvZFXxAx0mQdOj0Klc=w1000-h800 https://lh3.ggpht.com/fXRZfgSmArBemdjABjUDu0ibP9Gis3GV5YXTVj... [3]: https://someonewhocares.org/hosts/ https://someonewhocares.org/hosts/

mangix 8y ago
One annoyance is that SafetyNet pretty much prevents using Google Pay on a rooted or modified device.
- 0x38B 8y ago
  Quoting https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445 https://forum.xda-developers.com/apps/magisk/official-magisk...: "Installing Magisk will give you ROOT, a super powerful Systemless Interface, Magisk Modules support, and hide from tons of integrity tests like SafetyNet!" My Pixel 2 is rooted with Magisk, and passes Safetynet. I use Google Pay all the time.
simonh 8y ago
I think for most users Apple does a good job protecting them, but this is definitely one significant area of weakness for the platform. There are ways to implement similar controls using a VPN service[0], but of course then you need to trust the VPN operator. [0]https://techcrunch.com/2018/10/24/smart-firewall-guardian-iphone-app-privacy-before-profits/ https://techcrunch.com/2018/10/24/smart-firewall-guardian-ip...

kaolti 8y ago

Not sure how long it's been there, but found this in Inspectlet's terms of service: 7. Disclosure. As soon as you begin to use Our Service, You agree to add a disclosure to either Your terms of use, user agreement and/or privacy policy to inform Your end-users and customers of Inspectlet’s access to their Personal Information through Your website, and adding a link to Our Privacy Policy which governs Our use of all such Personal Information accessed by Inspectlet through Your website or through Your use of Our Services.

epaga 8y ago

I'm seeing lots of "but this is super helpful to improve UI flow, and normally isn't nefarious!" Well, as long as the app 1. lets me know and 2. lets me choose whether to have this feature on or not, I don't have a problem with an app recording my usage of it in order to improve UI flow or what have you. The issue here is that 1. sensitive data is being transmitted via automated screenshots and 2. the users are not even being made aware of this fact, let alone being given a choice.

iguy 8y ago
Seems like a useful testing feature that ought only to be allowed on testing versions -- the ones for which there are already different rules & different certificates.
ovi256 8y ago
> lets me choose whether to have this feature on or not And that's why UX is optimized for people who don't care about privacy :)
kgwxd 8y ago
Options aren't good enough, the fact the code is even in there is scary and there's nothing to gurantee your selection is being respected. No telemetry code and open source to prove it is the only kind of software anyone should be installing. I'm starting to think distributing software like this should be akin to wire tapping.
- bo1024 8y ago
  If you run someone's software on your device, you are giving them a huge amount of trust. So many privacy and security concerns stem from people hoping this weren't true.

z3t4 8y ago

Watching users via tracking and telemetry is very useful in order to learn about your users. But I also think it's also unethical. With the mindset that users are "lemings" ¹ where your job as a developer is to optimize profits from these "dumb fucks"². 1: https://en.wikipedia.org/wiki/Lemmings_(video_game) https://en.wikipedia.org/wiki/Lemmings_(video_game) 2: https://en.wikiquote.org/wiki/Mark_Zuckerberg https://en.wikiquote.org/wiki/Mark_Zuckerberg

coldcode 8y ago

Long ago a company I worked for had an iOS app and use some IBM product for the web version (Leaf? or something) and they forced us to use it in the app as well, it recorded the contents of each page basically (some fields were blanked out). It also crashed so much it was worthless. I never found it remotely useful to have such detailed info. Tagging service calls with a GUID was much more useful, as well as recording service errors and exceptions in Google Analytics. While we of course knew who the tag belonged to (after all they were our customer's orders) it was of no use to anyone listening in or watching the tags go by.

JustSomeNobody 8y ago
The problem with analytics is too much info or not enough info. At each employer, I usually do my best to get involved with the analytics portion of our applications. Apart from just finding it interesting, I also like to try and interject some sanity. I've seen managers walk in, puff our their chest and say, "Just collect everything. We'll sort through it here. Make it happen." After they walk out I engage everyone in conversation about that and try and let them know that we should actually be creating a list of questions we want answered and work from there. Collecting everything is almost always not the right idea.

polote 8y ago

I was in charge of building this kind of product for another analytics company, this technology is called session replay, and it is used for many use cases, like : UX improvement/ support/ bug detections ... Most of vendors record keyboard inputs and thus can record password as well as credit card information, there was an affair about it a few years ago [1]. To not have this issue, most of vendors provide a way to not record those information. It requires manual tagging of the website on the element that contains critical content. But many of session replays vendors have many clients, and don't force or don't verify that all the critical information are masked. This is not GDPR compliant, because when the GDPR apply you need to consent of the user to record his PII, and you are not even allowed to record information like password, sexual orientation, credit card even if you have the consent. Two things: - Nowadays on the web most of payment pages are not hosted on the client website, so those analytics tools are not included (but we still have many websites that don't use third party for that) - This data is not (most of the time) recorded in a structured way, data of inputs is recorded as some element of an HTML, and thus it is not super easy to extract the information at scale [1] https://freedom-to-tinker.com/2018/02/26/no-boundaries-for-credentials-password-leaks-to-mixpanel-and-session-replay-companies/ https://freedom-to-tinker.com/2018/02/26/no-boundaries-for-c...

ubermonkey 8y ago

I guess I'm not SUPER concerned about a given app reporting on what I do in that app back to the publisher. It might even be possible to convince me it's a reasonable way to figure out what the app does well and what it needs to improve. We could never get away with doing this for our (Windows) app, but sometimes I have conversations with people in my user base and I really, really wish I had some idea of how they got into some $random_weird_state. But yeah, it oughta be in the T&C if nothing else.