Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Didn’t answer the question just skirted around it. How is Apple supposed to determine your interactions with an iPhone as within their developer terms of service, when a dev uses a legitimate api. They can’t and this has come up before.

Using your logic of apple really cared about our privacy they would ban the Facebook app and Facebook from the browser. Because once you type something into the screen(that is not under Apple control) it goes to the internet and then who knows where.

But as I said I’m not worried about the digital representation of my Face ID, cc info etc

I did not skirt around your question at all:
Apple is indeed not capable of (or does not want to) "determining your interactions with an iPhone as within their developer terms of service" (your statement above). I thought I already implied that in my answer. But yet Apple makes big claims about privacy which they can not (or don't want to) uphold.

You are not turning this into a semantic discussion are you? Cause I have better things to do than playing word games ;)
 
Last edited:
Vote with you finger folks. I only had the Expedia App on the Apps listed. Use to use it a lot, now deleted and won't use them again, will switch to lastminute instead.

They do it too. All major sites have analytics hooks integrated into both their website and mobile apps. All are capable of recreating your user session, what you clicked, where you hovered your mouse, etc. These are standard CX tools that have been around for years. This isn’t an Apple thing.
 
I had two of those apps installed, and I used to use their services... Uninstalled, and I'll never user their services again...
 
I always wonder if some adblockers collect information. Once I used Ghostery and immediately after I received junk emails that suspiciously seemed to be linked. I then discovered the Ghostery adblocker was actually owned by an ad company. I uninstalled.

Install Gasmask App + a blocker list, works like a charm, you can have multiple lists, so even empty ones that pass through everything, it changes the Host file on the fly.
Most people don't know this but there's a built in blocker, it's data is in the hosts file located in /Private/etc/
It can only be written by root user but installing Gasmask makes that process easy and accessible in the menubar as a Menu Extra.

And....wait for it....it's free.
 
Wait how is this a big deal ? You are in fact using the app, so they in fact know everything your doing. Remember only the app you are using can grab your screen, what’s the issue ? The developer built the app, knows what it looks like, knows what your pressing.. why is this news ? Is the information being transferred outside of the app developers control ? If so then I see it as a concern. This is no different than google analytics. It only captures that’s specific app. And this SDK is not specific to iPhone, it’s available for various platforms, including android. The good think about apples store is they can actually detect and remove all apps who are using this if they wanted too. Especially if this is not disclosed to a user

Because people don’t like it. Instant big deal.
And, after Radio Shack, we now know that whoever buys said entity in the future can try to retroactively change any privacy policy in place.
 
Here are some of the Glassbox's customers. Not all maybe guilty of recording data, but why take a chance?

I suspect this page will be gone soon, so here are some of the major clients.

Banking and Investment:
  • Bank Fideuram
  • Bank Hapoalim
  • Bank Leumi
  • Citibank
  • ING
  • Investec
  • Israel Discount Bank
  • JP Morgan Chase
  • Santander
Insurance
  • Admiral
  • Amica
  • Direct Seguros
  • Guardian
  • The Hartford
  • UnipolSai
  • Zurich
Travel
  • Air Canada
  • Expedia
  • Hotels.com
  • Singapore Airlines
  • Yatya
Telecom
  • Tracfone
Retail
  • Abercrombie & Fitch
  • Hollister

ING international or just ING, wish I could have stayed with my old bank but this "shady" bank "forced" me to open an account there, the good news was it saves me money.
 
I did not skirt around your question at all:
Apple is indeed not capable of (or does not want to) "determining your interactions with an iPhone as within their developer terms of service" (your statement above). I thought I already implied that in my answer. But yet Apple makes big claims about privacy which they can not (or don't want to) uphold.

You are not turning this into a semantic discussion are you? Cause I have better things to do than playing word games ;)
This is to me not a dichotomy. It’s not like Facebook making bold claims about your privacy, which they do. Apple itself makes claims and they seem to be in line with the privacy stance. Maybe a narrow interpretation but they are better than most.

they have a code of ethics for the developers, and my guess is there is no way to police all code branches in an app to see what they are doing. If the developer is a rotten apple(pun intended), they should be dealt with.
 
Wake up. Apple's privacy assurances are limited to their apps. And Apple's app vetting is limited to finding things that hurt Apple.

While we're on the subject of privacy, here's a revealing infographic detailing the information that the bigger tech players collect according to their TOSs. You'll be surprised who seeks the most detail.
 
It’s obvious you aren’t a developer, haven’t gone thru any submission process, and you don’t know what you’re really talking about.
When you ASS-U-ME, you generally get things wrong. And no surprise, wrong again.

If Apple allows an API, it means they are allowing a hook to using their sandbox for whatever means. Apps can function being offline. It’s just now you are undoing all the technological progression and pushing devs to a more free form ecosystem
It doesn’t have to be an api it could be a simple name and address form.

Yes, every app dev is expected to have a privacy policy to adhere too, but the inherent submission process is what Apple uses to ensure everything is regulated. Ethically it’s on the developer, but Apple is the single point of entry for ensuring standards are followed. You said it yourself: it’s a mandate from the top.
Back to the question about Facebook totally being banned from the ecosystem. I trust apple with my personal data, but it’s been shown time and time again for many years, apps, programs and websites can be used for nefarious purposes. Apple can’t police the internet.

The great thing about these forums is it also allows us to profile the varying assumptions people have

It’s not an easy task, but you would need to do an audit report with the developer/company on every network request. And yes they can, but obviously no dev or Apple wants to go thru a stringent audit report
Even if the tech exists any interaction with the phone via app or website can be saved. Again, Apple can’t force a developer to be honest.
 
What tech bloggers should be doing is directing their questions to Glassbox. Glassbox is the one providing the tools to the apps. Are they using public APIs to do this? Or are they using private APIs, and if they did, then report them to Apple. Simply breaking news like this without anything other than naming Apple and saying somebody doing “secret” stuff is extremely clickbait.

You have it backwards. Apple should be the one warning users.
 
  • Like
Reactions: WatchFromAfar
everyone does it one way or another, especially in marketing. Below an example. It’s worse if you implement a Facebook pixel in your app. You can see in the ads dashboard how people behave even if they don’t have Facebook themselves
 

Attachments

  • 7764F2E2-794D-4929-B434-BA401BD0D3B3.jpeg
    7764F2E2-794D-4929-B434-BA401BD0D3B3.jpeg
    216.2 KB · Views: 169
There’s no App Store guideline that prohibits collecting usage information. To the contrary, Apple permits collection of usage information if the user consents.

Apple’s arrogance is the reason why Expedia collects user data? Okay.

If they put that in their guideline. There will be less app for the App Store.
 
People wanted free apps. Well this is what you get when you use free apps. Massive invasions of privacy for the purpose of mining and monetizing your personal information.

All the apps mentioned in the article get money (and a lot of money) selling flights, rooms and more to us.
They are just greedy and till we give them a real lesson it will keep going that way

Look at Facebook or Google: they are giving you "free stuff" and they make billions.
 
The second you send a packet of data through port 80 you don’t have privacy. The notion people do this or that to retain “privacy” or don’t use apps is cute and super naive. Your digital fingerprint is everywhere the moment you touch the internet. That’s the fact of life. It’s easier once you’re resigned to it until the wider system gets better and actually grapples with it.
 
I think Session Replay is pretty much an industry standard. I am not surprised many Apps were using it. I am actually surprised by how many people thought this wasn't done before. ( And many website uses Session Replay too, to test if their new features or design are working as well as expected )

What is a potentially a violation though, is the recording of Keyboard Input information to a third party. I.e If the tech is self hosted and the Server is on the App Developers, they already has all the information you have given them, how they are handling it, is entirely their responsibility. But if these information is going to a third party like Glassbox before having user's consent, then this is clearly wrong.

Edit: Just read the report the files are not going to Glassbox. Which is there is no violation. However a lot could be said about the obfuscation of password.
 
Last edited:
This is partially why I use as few apps as possible. I’ll go on a website on my desktop with proper blockers in place if I need to. My phone is a minimal use device these days.

There are plenty of session-recording services for websites, too. Your concerns about mobile being easy to compromise are misplaced. The risks are everywhere. We need to shut down any of these companies that fail to disclose.
 
They do it too. All major sites have analytics hooks integrated into both their website and mobile apps. All are capable of recreating your user session, what you clicked, where you hovered your mouse, etc. These are standard CX tools that have been around for years. This isn’t an Apple thing.
No-one said it was "an Apple thing", Apple are'nt the ones doing it. However Apple sets rules in it's app store that allow other companies to do this.

Surely you can see why some people are bitter when they see Apple spouting non-sense about "privacy"?
 
  • Like
Reactions: AndyMacAndMic
This is not fundamentally Apple's wrongdoing; it's common UX analytics practice, provided by third parties. Unfortunately, it's not something that has crossed anybody's radar as constituting dodgy privacy practice, until now, so nobody's done anything about it. Aside from key logging, I don't see anything particularly worrisome about logging taps and gestures...
I suppose Apple could beef up their store requirements to either exclude this kind of tracking, or to require masking out of sensitive data (preferable), but that's about all they could do. As I say, I think key loggers should be off-limits. And screen capturing any text should be verboten... I suppose Apple could perhaps do something about the latter by having a mechanism to clear any user-editable text views prior to capturing screenshots. Dunno... seems like it might be possible... ??
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.