A recent report from TechCrunch found that some popular iPhone apps can record everything you do on your phone’s screen, often without first asking for permission.
Apps like Air Canada, Hollister, Expedia, and Hotels.com, along with the help of analytics company App Analyst, uses technology from Glassbox, a company that creates “session replays.” It lets the app owners see precisely what their customers are doing when they are using the app. Every single tap, button push, and keyboard entry is recorded and sent back to the app developers to see if there are any errors in the app.
As Glassbox said in a recent tweet: “Imagine if your website or mobile app could see exactly what your customers do in real time, and why they did it?”
What’s worse, many of these apps are not masking specific fields, and therefore exposing sensitive information like credit card data or passport numbers.
Recently, Air Canada reported that its app had a data breach, exposing more than 20,000 profiles.
The App Analyst, a mobile expert who writes about popular apps on his blog, said to TechCrunch, “This gives Air Canada employees — and anyone else capable of accessing the screenshot database — to see unencrypted credit card and password information.”
Not every app uses Glassbox was leaking masked data, but none of the apps tested by TechCrunch and the App Analyst said that they were recording a user’s screen.
That could be a problem if any of Glassbox’s customers aren’t properly masking data, The App Analyst said in an email to TechCrunch. “Since this data is often sent back to Glassbox servers I wouldn’t be shocked if they have already had instances of them capturing sensitive banking information and passwords,” he said.
Air Canada responded to TechCrunch’s story, saying, “After this story published, Air Canada responded: “Air Canada uses customer provided information to ensure we can support their travel needs and to ensure we can resolve any issues that may affect their trips,” said a spokesperson. “This includes user information entered in, and collected on, the Air Canada mobile app. However, Air Canada does not—and cannot—capture phone screens outside of the Air Canada app.”
