Connect with us

Mobile

Many popular iPhone apps secretly record your screen without asking – TechCrunch

Published

on

Many major companies, like Air Canada, Hollister and Expedia, are recording every tap and swipe you make on their iPhone apps. In most cases you won’t even realize it. And they don’t need to ask for permission.

You can assume that most apps are collecting data on you. Some even monetize your data without your knowledge. But TechCrunch has found several popular iPhone apps, from hoteliers, travel sites, airlines, cell phone carriers, banks and financiers, that don’t ask or make it clear — if at all — that they know exactly how you’re using their apps.

Worse, even though these apps are meant to mask certain fields, some inadvertently expose sensitive data.

Apps like Abercrombie & Fitch, Hotels.com and Singapore Airlines also use Glassbox, a customer experience analytics firm, one of a handful of companies that allows developers to embed “session replay” technology into their apps. These session replays let app developers record the screen and play them back to see how its users interacted with the app to figure out if something didn’t work or if there was an error. Every tap, button push and keyboard entry is recorded — effectively screenshotted — and sent back to the app developers.

Or, as Glassbox said in a recent tweet: “Imagine if your website or mobile app could see exactly what your customers do in real time, and why they did it?”

The App Analyst, a mobile expert who writes about his analyses of popular apps on his eponymous blog, recently found Air Canada’s iPhone app wasn’t properly masking the session replays when they were sent, exposing passport numbers and credit card data in each replay session. Just weeks earlier, Air Canada said its app had a data breach, exposing 20,000 profiles.

“This gives Air Canada employees — and anyone else capable of accessing the screenshot database — to see unencrypted credit card and password information,” he told TechCrunch.

In the case of Air Canada’s app, although the fields are masked, the masking didn’t always stick (Image: The App Analyst/supplied)

We asked The App Analyst to look at a sample of apps that Glassbox had listed on its website as customers. Using Charles Proxy, a man-in-the-middle tool used to intercept the data sent from the app, the researcher could examine what data was going out of the device.

Not every app was leaking masked data; none of the apps we examined said they were recording a user’s screen — let alone sending them back to each company or directly to Glassbox’s cloud.

That could be a problem if any one of Glassbox’s customers aren’t properly masking data, he said in an email. “Since this data is often sent back to Glassbox servers I wouldn’t be shocked if they have already had instances of them capturing sensitive banking information and passwords,” he said.

The App Analyst said that while Hollister and Abercrombie & Fitch sent their session replays to Glassbox, others like Expedia and Hotels.com opted to capture and send session replay data back to a server on their own domain. He said that the data was “mostly obfuscated,” but did see in some cases email addresses and postal codes. The researcher said Singapore Airlines also collected session replay data but sent it back to Glassbox’s cloud.

Without analyzing the data for each app, it’s impossible to know if an app is recording a user’s screens of how you’re using the app. We didn’t even find it in the small print of their privacy policies.

Apps that are submitted to Apple’s App Store must have a privacy policy, but none of the apps we reviewed make it clear in their policies that they record a user’s screen. Glassbox doesn’t require any special permission from Apple or from the user, so there’s no way a user would know.

Expedia’s policy makes no mention of recording your screen, nor does Hotels.com’s policy. And in Air Canada’s case, we couldn’t spot a single line in its iOS terms and conditions or privacy policy that suggests the iPhone app sends screen data back to the airline. And in Singapore Airlines’ privacy policy, there’s no mention, either.

We asked all of the companies to point us to exactly where in its privacy policies it permits each app to capture what a user does on their phone.

Only Abercombie responded, confirming that Glassbox “helps support a seamless shopping experience, enabling us to identify and address any issues customers might encounter in their digital experience.” The spokesperson pointing to Abercrombie’s privacy policy makes no mention of session replays, neither does its sister-brand Hollister’s policy.

“I think users should take an active role in how they share their data, and the first step to this is having companies be forthright in sharing how they collect their users data and who they share it with,” said The App Analyst.

When asked, Glassbox said it doesn’t enforce its customers to mention its usage in their privacy policy.

“Glassbox has a unique capability to reconstruct the mobile application view in a visual format, which is another view of analytics, Glassbox SDK can interact with our customers native app only and technically cannot break the boundary of the app,” the spokesperson said, such as when the system keyboard covers part of the native app, “Glassbox does not have access to it,” the spokesperson said.

Glassbox is one of many session replay services on the market. Appsee actively markets its “user recording” technology that lets developers “see your app through your user’s eyes,” while UXCam says it lets developers “watch recordings of your users’ sessions, including all their gestures and triggered events.” Most went under the radar until Mixpanel sparked anger for mistakenly harvesting passwords after masking safeguards failed.

It’s not an industry that’s likely to go away any time soon — companies rely on this kind of session replay data to understand why things break, which can be costly in high-revenue situations.

But for the fact that the app developers don’t publicize it just goes to show how creepy even they know it is.


Got a tip? You can send tips securely over Signal and WhatsApp to +1 646-755–8849. You can also send PGP email with the fingerprint: 4D0E 92F2 E36A EC51 DAAE 5D97 CB8C 15FA EB6C EEA5.

Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published.

Mobile

YouTube teases expansion of livestream shopping with new features arriving later this year – TechCrunch

Published

on

In recent years, YouTube has been working to transform its platform into more of a shopping destination with product launches like shoppable ads or more recently, the ability to shop directly from livestreams hosted by creators. Now, it’s furthering that investment with new features for live shopping experiences. At yesterday’s YouTube Brandcast event, where the company pitched itself to advertisers as a better place for their TV ad dollars, YouTube teased upcoming features that it claimed would make it easier for viewers to discover and buy from brands.

The company touted its forthcoming tools as offering advertisers a better way to engage viewers and make connections with their audience.

One new feature, explained YouTube, will allow two creators to go live at the same time to cohost a single live shopping stream. This could effectively double the draw for the event, as each creator would bring their own fanbase to the stream.

This feature arrives shortly after YouTube in March announced a pilot program called “Go Live Together,” a new mobile collaborative streaming feature that would enable creators to invite guests to their livestream with a link before going live together. This trial suggested YouTube had its eye on developing tools to better power joint livestreams — just as it’s now planning to introduce with its upcoming two-person live shopping streams. The addition could also make YouTube more competitive with Instagram which launched the ability for creators to go live with up to three people last year.

In addition to leveraging creators to build an audience for a live shopping event, YouTube’s shopping livestreams platform also offers other tools specifically designed to drive sales. The brand-integrated shopping experience actually allows viewers to shop the products shown in the video by tapping on a built-in “view products” button which then brings up a list of items featured by the creators.

The company says its new two-person live shopping feature will roll out sometime later this year.

Another upcoming option announced at Brandcast is something YouTube calls “live redirects.”

In this case, creators will be able to start a shopping livestream on their channel, then redirect their audience over to a brand’s channel for fans to keep watching. This allows brands to tap into the power of the creator’s platform and reach their fanbase, but then gives the brands themselves access to that audience — and the key metrics and analytics associated with their live event — directly on their own YouTube channel. This will also roll out sometime this year, says YouTube, but didn’t provide a timeframe.

YouTube’s announcements follow the broader growth of the live e-commerce market in the U.S. — a trend inspired by the livestream shopping activity surging in China, where streamers can pull in billions of dollars in a matter of hours. Today, a number of startups have also entered this space, including TalkShopLive, PopShop Live, NTWRK, Whatnot, ShopShops, Supergreat, and others. Klarna even added virtual shopping capabilities to connect its buy-now, pay-later customers with live product demos from retail partners.

Retailers, too, are getting in on the action. Nordstrom launched a live events platform, while Forever 21 and Macy’s are among those that added live shopping to their apps.

Meanwhile, big tech platforms are wooing brands by touting their wider reach.

Over the past year or so, we’ve seen Walmart pilot testing TikTok’s first livestreamed shopping experience; Facebook’s live shopping boosting sales for brands like Petco, Benefit, Samsung, Anne Klein, and others; and Instagram hosting live shopping events to cater to holiday crowds. Twitter even began to test livestream shopping, also with Walmart’s help on its pilot run — but it’s unclear where such initiatives will land if the Elon Musk buyout comes to pass.

While YouTube is certainly one of the largest creator platforms for video, there is some indication that it needs to catch up to its big tech rivals in livestream shopping, however. An eMarketer study from Jan. 2022 found that only 14.4% of survey respondents said YouTube’s platform drove them to purchase during a livestream event compared with 15.8% for TikTok, 45.8% for Instagram, and 57.8% for Facebook.

Image Credits: eMarketer/Insider Intelligence

YouTube’s new livestream features — and particularly the one that pushes a creator’s fanbase to a brand’s channel — could make its solution more compelling.

“People come to YouTube every day to make decisions about what to buy, and 87% of viewers say that when they’re shopping or browsing on YouTube, they feel like they can make a faster decision about what to purchase because of all the information that we have in videos,” said YouTube CEO Susan Wojcicki, speaking to the audience at the Brandcast live event last night. “We have so much shopping activity that is already happening on YouTube, so we are making it even easier for viewers to discover and to buy,” she said.

Continue Reading

Mobile

IROKO co-founder Bastian Gotter raises $3.2M seed for new venture, Bamba – TechCrunch

Published

on

In 2010, Bastian Gotter invested up to $200,000 into IROKOtv, an African video-on-demand company Jason Njoku, his friend and co-founder, launched in Lagos, Nigeria.

For the next couple of years, Gotter, as CFO, was instrumental in turning IROKO — after raising over $30 million from VCs, including Tiger Global — into a household name in Nigeria’s entertainment and tech scenes.

Gotter left the media company in 2017, an exit that afforded him the chance to take up angel investing full-time and pursue new projects. Gotter has cut checks in Paystack, Flutterwave and betPawa and co-runs Spark, an investment vehicle he launched with Njoku.

In 2018, he started a pre-school chain based in the U.K. and South Africa. Two years later, he became part of the founding team of Kenyan-based fintech PawaPay, whose API connects up to 25 telecom operators’ mobile money systems and allows merchants from 10 countries to receive and send payments between mobile money accounts.

Gotter is an investor and board member in PawaPay, roles that can be active and passive depending on who’s involved. For Gotter, it was more of the latter, and so this January, he began to explore other opportunities in the mobile money payments space, specifically relating to small businesses. This led him to start Bamba, a mobile-based enterprise software for African micro-merchants, that has raised $3.2 million.

After spending some time in Kenya (where he was now used to paying via mobile money and rarely cash), he noticed that businesses relied heavily on manual bookkeeping and didn’t have software to record their cash and mobile money transactions.

“They also recorded stock components and had some form of customer relationship management on WhatsApp. It wasn’t a coherent picture and was just a big mess,” he said on a call to TechCrunch. “And that’s where we ultimately saw an opportunity to launch Bamba.”

Micro, small and medium-sized businesses make up 90% of all businesses in sub-Saharan Africa. And there are new upstarts that provide digital bookkeeping services for a minute number of them in West Africa, such as Sabi Cash, Bumpa, Kippa and OZÉ. Bamba is a matching solution for Kenya and surrounding East African markets, where these merchants accepted over $200 billion in mobile money payments last year.

The platform comprises an enterprise management software and an Android application that provides tools for micro-merchants to run their businesses. Its features include managing customers, recording stock levels and receiving and making payments.

“Merchants can record what cash and mobile money transactions they collect and their cash and mobile money payouts. And through that initial record keeping, we have an entry point into the business,” said Gotter, who also mentioned that Bamba wants to improve cash collection for merchants primarily done via USSD and M-Pesa pay bill numbers at point-of-sale. 

“We have the inventory management components that tie in with how many and which goods are sold. Then the payments bit ultimately resulting in a point of sale type devices like Square or Yoco that lets you get a clearer picture of your business and your activities.”

Lack of credit is a thorn in merchants’ flesh globally; this holds more true in sub-Sahara Africa, where the credit gap for small businesses stands at over $300 billion. This is one prominent area bookkeeping digitization proves its utmost importance for merchants. And despite launching with various entry points into the market, startups in this space converge at that singular point. For Bamba, its solution, intersecting inventory, CRM and payments will allow it to provide merchants with cash advances against their future cash flow.

“These are businesses that have previously not been lent to as their credit score was insufficient to get the appropriate loans. But since we have a pretty accurate picture of our customers in terms of its cash and mobile money receivables, we can make accurate lending decisions to them in a way not done before,” the CEO stated.

Bamba is currently in stealth mode and is yet to launch. Gotter said the five-month-old startup is testing its platform with 30 merchants. Its revenue will come from two streams: a small payment fee paid by merchants and interests from its lending/cash advance product.

“We’re very deep in the research phase and quick iteration cycle to figure out the initial product we want to launch at a greater scale in 12 markets,” said the CEO who founded Bamba with Martin Schramm in January.

This seed funding is integral to speeding up this process of acquiring more users and scaling the engineering team behind the product. Berlin and San Francisco-based 468 Capital led the round, while Presight Ventures and Jigsaw VC participated alongside angel investors such as Laurin Hainy of FairMoney and Leonard Stiegeler of Pulse.

Ludwig Ensthaler, a partner at 468 Capital, in a statement, highlighted why his firm backed the Kenyan-based startup. He said the investment opportunities in enterprise software focused on African small businesses are largely untapped, and Bamba “is well placed with a great product and a solid founder to build a category-defining company.”

Continue Reading

Mobile

Apple reportedly testing E Ink outer display for upcoming foldable – TechCrunch

Published

on

Ming-Chi Kuo is one of a handful of Apple analysts whose reports always warrant a second look, regardless of how strange they might seem at first blush. We’ve heard plenty of reports that the company is testing its own version of a foldable device, in its customary style of being fashionably late to the party, while also being the best dressed there.

It stands to reason that the company is experimenting with all sorts of takes on the form factor. While companies like Samsung and Huawei have made great strides since the first generation of foldable devices, one can certainly make the argument that no one has perfectly cracked the code just yet. The screen technology has improved a good bit in recent years — and so, too, has E Ink technology.

“Apple is testing E Ink’s Electronic Paper Display (EPD) for future foldable device’s cover screen & tablet-like applications,” Kuo reported on Twitter earlier today. “The color EPD has the potential to become a mainstream solution for foldable devices’ must-have cover/second screen thanks to its excellent power-saving.”

Image Credits: Brian Heater (Samsung’s Galaxy Fold)

The last part is undeniable. One of E Ink’s biggest selling points is power saving. It’s a key part of the reason your Kindle’s battery life is rated in weeks, instead of hours. But the technology has traditionally had numerous drawbacks that have hampered mainstream adoption outside of a few select categories like e-readers.

Recent generations of E Ink’s electronic paper have added color and sped up the notoriously slow refresh rate and responsiveness. One imagines that there’s still a ways to go before Apple adopts such technology, even for a secondary, external display. Though, with the first of the company’s foldables rumored for a 2025 release (at earliest), perhaps that leaves enough time for the electronic paper technology to get up to speed.

As ever, one must take all of the above with a few grains of salt. It’s a long timeline, and even if the reports prove out, there’s a big gulf between testing and releasing. It’s also worth noting that these sorts of rumors have existed for nearly as long as the iPhone has. So, short term, maybe it’s best to focus on more attainable rumors like a USB-C iPhone.

Continue Reading

Trending