Electronic Arts is opting all users out of the “real name sharing” option on its Origin gaming service following complaints that some users may have been entered into the program without their consent.

The option to “show my real name on my profile” (as opposed to just sharing an online handle) is buried in the privacy settings for every EA Origin account, as it is for many other gaming networks. But Randi Lee Harper, the founder of the nonprofit Online Abuse Prevention Initiative, recently noted in a Twitter thread that her real name was being shared via the account without any opt-in.

Harper said anecdotal reports and spot checks of others with Origin accounts showed that the setting “has been seemingly randomly enabled” for a number of other Origin users. Accounts created between 2013 and 2015 seem to have more likelihood of having the option enabled by default, Harper said, but she added that she “can’t find any kind of commonality in the data. It seems so random.” (New accounts created today default the real name sharing to be off.)

“I’m of the opinion that there is never a situation that you want to make it possible for a random stranger to link your gaming account to your real name,” Harper wrote. “People that you voluntarily friend, OK, that’s a different story. That this was defaulted to ‘on’ for some people… EA, what the fuck.”

In response to these reports, EA said it is opting all Origin players out of real-name sharing and investigating what, if anything, happened to cause the reported privacy breach in the first place.

“Player privacy is of the utmost importance to us,” EA said in a statement provided to Ars. “We’ve recently began hearing from some of our players that their Origin accounts defaulted to share real names associated with their account. That should be an opt-in setting… It’s important to us that real names are shared only by players who truly want to. We appreciate the community’s engagement on this, and we apologize to our players for any disruption or extra steps this may cause.”

EA’s problem mirrors one faced by Microsoft early last year, when some users complained their Xbox Live accounts were sharing their real names without consent. After investigating, Microsoft said in a short statement provided to Mashable at the time that “we’ve addressed the issue some users may have experienced with their profile.”

Whatever the results of EA’s investigation, this should serve as a timely reminder to always double-check the privacy settings on all of your online accounts to make sure they match your preferences. You never know when the “default” sharing options may not match up with what you (or even the corporations behind those accounts) think they should be.

https://arstechnica.com/?p=1459553

British lawmakers issued a scathing report Monday that calls for tougher rules to keep Facebook and other tech firms from acting like “digital gangsters” and intentionally violating data privacy and competition laws.

The report on fake news and disinformation on social media sites followed an 18-month investigation by Parliament’s influential media committee. The committee recommended that social media sites should have to follow a mandatory code of ethics overseen by an independent regulator to better control harmful or illegal content.

The report called out Facebook in particular, saying that the site’s structure seems to be designed to “conceal knowledge of and responsibility for specific decisions.”

“It is evident that Facebook intentionally and knowingly violated both data privacy and anti-competition laws,” the report said. It also accused CEO Mark Zuckerberg of showing contempt for the U.K. Parliament by declining numerous invitations to appear before the committee.

“Companies like Facebook should not be allowed to behave like ‘digital gangsters’ in the online world, considering themselves to be ahead of and beyond the law,” the report added.

U.K. parliamentary committee reports are intended to influence government policy, but are not binding. The committee said it hoped its conclusions would be considered when the government reviews its competition powers in April.

The government said it welcomed the “report’s contribution towards our work to tackle the increasing threat of disinformation and to make the U.K. the safest place to be online. We will respond in due course.”

While the U.K. is part of the 28-country European Union, it is due to leave the bloc in late March, so it is unclear whether any regulatory decisions it takes could influence those of the EU.

Facebook said it shared “the committee’s concerns about false news and election integrity” and was open to “meaningful regulation.”

“While we still have more to do, we are not the same company we were a year ago,” said Facebook’s U.K. public policy manager, Karim Palant.

“We have tripled the size of the team working to detect and protect users from bad content to 30,000 people and invested heavily in machine learning, artificial intelligence and computer vision technology to help prevent this type of abuse.”

Facebook and other internet companies have been facing increased scrutiny over how they handle user data and have come under fire for not doing enough to stop misuse of their platforms by groups trying to sway elections.

The report echoes and expands upon an interim report with similar findings issued by the committee in July . And in December , a trove of documents released by the committee offered evidence that the social network had used its enormous trove of user data as a competitive weapon, often in ways designed to keep its users in the dark.

Facebook faced its biggest privacy scandal last year when it emerged that Cambridge Analytica, a now-defunct British political data-mining firm that worked for the 2016 Donald Trump campaign, had accessed the private information of up to 87 million users.

Conservative lawmaker Damian Collins, who heads the media committee, said “democracy is at risk” from malicious, targeted disinformation campaigns, often directed from countries such as Russia and spread on Facebook and other social networks.

“We need a radical shift in the balance of power between the platforms and the people,” he said. “The age of inadequate self-regulation must come to an end.”

http://feedproxy.google.com/~r/Securityweek/~3/smMwIrIIo0I/digital-gangsters-uk-wants-tougher-rules-facebook

Feb 18, 2019 Marco Schiaffino Gestione dati, In evidenza, Leaks, News, Privacy, RSS, Vulnerabilità 0

---

Si presenta come una concorrente di Whatsapp e Telegram, ma gli utenti lanciano l’allarme in Rete: “nessuna protezione dei dati inviati”.

Applicazioni come Whatsapp e Telegram hanno relegato gli SMS nel campo dell’archeologia della comunicazione, consentendo a chiunque abbia uno smartphone di inviare e ricevere messaggi senza spendere un euro.

Rispetto ai vecchi “messaggini” hanno però un limite: permettono l’invio di testo solo quando è presente una connessione Internet.

Perché non inventare un sistema che consenta l’invio gratuito di messaggi testuali anche quando non si ha accesso alla rete? L’idea è venuta a IF Inspreifon, una società attiva in Italia, Spagna e nell’est Europa (Russia, Ucraina e Azerbaijan) che ha lanciato un’app dedicata chiamata Dostupno.

L’applicazione in questione, però, è rapidamente finita al centro di una furibonda polemica alimentata da alcuni utenti che hanno denunciato l’assenza di qualsiasi misura di sicurezza o tutela della privacy e che in breve tempo, è degenerata in una vera rivolta contro gli sviluppatori culminata con un “attacco informatico” che ha cancellato il database sfruttato dalla piattaforma.

Andiamo con ordine: come funziona Dostupno? La logica di funzionamento dell’applicazione è piuttosto originale. Si basa, in pratica, sull’utilizzo di un set di 10 messaggi predefiniti che vengono memorizzati su un database.

Per inviarne uno al destinatario, l’app usa la funzione di chiamata dello smartphone, “tarandone” la durata in maniera da identificare quale messaggio deve essere visualizzato. In pratica: una chiamata di 5 secondi corrisponde al messaggio 1, una di 10 secondi al messaggio 2 e via dicendo.

Come ha fatto notare u/Lo_acker, un utente Reddit che ha pubblicato un lungo post riguardo il funzionamento di Dostupno, si tratta di un escamotage decisamente creativo, ma che ha qualche pecca in termini di praticità.

Per citarne solo qualcuna, il corretto funzionamento dell’app richiede che la segreteria telefonica sia disattivata e che il destinatario intuisca che si tratta di una chiamata di Dostupno e non risponda alla telefonata.

Secondo u/Lo_acker, però, i limiti di carattere pratico sono un aspetto marginale rispetto a quelli legati alla sicurezza dell’applicazione.

Il download del database di messaggi (ne esiste uno per ogni interlocutore) verrebbe infatti aggiornato tramite una pagina in PHP che consentirebbe di inviare qualsiasi query. Al suo interno sarebbero presenti i database in chiaro di tutti i messaggi impostati dagli utenti.

In pratica: chiunque potrebbe scaricarsi non solo i messaggi, ma anche i numeri di telefono degli utenti che hanno installato e utilizzato l’applicazione. Nel dettaglio stiamo parlando di qualche migliaio di utenze (su Google Play l’app risulta essere stata installata più di 50.000 volte) che sarebbero rimaste esposte per un periodo indefinito di tempo.

In seguito alla pubblicazione del post, qualcuno ha pensato bene di accedere al server in questione e cancellare tutto il database. Un’azione che molti utenti hanno commentato positivamente, considerandola una forma di “autodifesa” nei confronti di una gestione inadeguata dei dati.

Dopo una serie di scambi su Reddit e sulla pagina di Google Play (che qui vi risparmiamo) sembra che dalle parti di IF Inspreifon abbiano cambiato qualcosa nel sistema. Tutto a posto quindi? Non proprio.

Secondo un altro utente Reddit (u/d4rksnow) il server sarebbe stato spostato semplicemente a un altro indirizzo e il database codificato in base64. Risultato: messaggi e numeri di telefono sarebbero ancora accessibili a chiunque.

A conferma di quanto sostiene, u/d4rksnow ha pubblicato al corredo del suo post un’immagine che sarebbe estratta dal database in questione.

Contatta da Security Info, IF Insprefion ha promesso di inviare un commento che riporteremo  integralmente non appena possibile.

---

---

---

https://www.securityinfo.it/2019/02/18/dostupno-lapp-di-messaggistica-espone-i-dati-degli-utenti-su-internet/

A US investigation into privacy violations by Facebook could result in a record fine running to billions of dollars, media reports said Friday.

The Federal Trade Commission is negotiating the terms of the penalty stemming from its investigation into whether Facebook violated a 2011 settlement with the regulator on protecting user data, the Washington Post and New York Times said, citing unnamed sources.

The FTC reopened its investigation following revelations last year that personal data from tens of millions of Facebook users was hijacked by the political consultancy Cambridge Analytica as it worked on Donald Trump’s presidential campaign.

The 2011 court-approved agreement required Facebook to notify users when it shares data with third parties and bars the social network from deceptive practices.

According to the Times, the penalty for violating the agreement could be some $41,000 per violation, and that the FTC may potentially levy that amount for each individual affected.

The Post said the settlement could be in the range of $2 billion.

A settlement would need to be negotiated by the FTC staff and then approved by the commissioners. If there is no agreement the parties could contest the matter in court.

Until now, the biggest fine imposed by the FTC was $22.5 million against Google for violations of an agreement to protect consumer data, according to the reports.

Privacy activists have pressed for a hefty penalty against Facebook to demonstrate that the regulator is serious about enforcing its consent agreements.

Facebook did not respond to an AFP query on the reports.

http://feedproxy.google.com/~r/Securityweek/~3/tZkew_TNgMw/us-facebook-fine-over-privacy-could-be-billions-reports

Feb 15, 2019 Marco Schiaffino In evidenza, Leaks, News, Privacy, RSS, Scenario, Vulnerabilità 0

---

Il database contiene informazioni di milioni di cittadini di origine musulmana tenuti sotto controllo attraverso i sistemi di sorveglianza di riconoscimento facciale.

Lo sappiamo da qualche tempo: nella corsa allo sviluppo dell’intelligenza artificiale, la Cina è uno dei paesi più avanzati al mondo. Allo stesso modo, sappiamo che una delle applicazioni dell’AI che va per la maggiore dalle parti di Pechino è quella del riconoscimento facciale, utilizzato in chiave di controllo dei cittadini.

La conferma arriva dalla segnalazione di Victor Gevers, un ricercatore olandese specializzato nella “caccia” ai database lasciati incustoditi su Internet.

Come raccontano in un articolo i colleghi di ZDNet, Gevers questa volta si è imbattuto in qualcosa di molto particolare.

Il server che ha individuato, infatti, contiene un database MongoDB con informazioni personali di 2.565.724 persone, raccolte presumibilmente per conto del governo cinese.

Il server, gestito dalla società cinese SenseNets (specializzata in riconoscimento facciale e analisi dei video) era accessibile senza che fosse necessaria alcuna autenticazione. Una tipo di “dimenticanza” che i ricercatori di sicurezza riscontrano sempre più spesso.

Questa volta, però, Gevers non si è trovato di fronte al solito database di utenti con informazioni più o meno sensibili raccolti da qualche azienda commerciale.

Secondo il ricercatore, infatti, tutti i cittadini cinesi registrati nel database farebbero parte della minoranza musulmana Uiguri residente nella regione dello Xinjiang.

Insomma: si tratterebbe di un server dedicato alla schedatura di quelli che, secondo il governo di Pechino, sarebbero potenziali “terroristi”. La componente indipendentista dell’etnia Uiguri, infatti, è da tempo finita nel mirino delle forze di polizia e la cronaca negli anni passati ha registrato violenti scontri tra la minoranza musulmana e le autorità.

All’interno del database, il ricercatore olandese ha trovato ogni genere di informazioni: dati anagrafici, residenza, fotografie, dati dei documenti di identità e del loro impiego.

Non solo: il server contiene anche una serie di rilevamenti GPS che, secondo Gevers, rappresenterebbero una minuziosa ricostruzione degli spostamenti dei cittadini schedati ottenuta tramite le videocamere di sicurezza che in Cina stanno spuntando come funghi più o meno ovunque.

I rilevamenti sono associati a descrizioni dei luoghi piuttosto esplicite, come “moschea”, “stazione di polizia”, Internet Cafè” e simili.

Ora il server non è più raggiungibile. Gevers ha infatti seguito il solito protocollo, contattando SenseNets per avvisarli del fatto che il server fosse esposto su Internet senza protezioni, prima di realizzare che cosa contenesse.

La scoperta è l’ennesima conferma di ciò che molti gruppi di attivisti per i diritti umani denunciano da anni: l’uso da parte del governo cinese di sistemi di sorveglianza per schedare minoranze e oppositori politici. Anche, scopriamo ora, utilizzando contractors privati.

---

---

---

https://www.securityinfo.it/2019/02/15/server-di-una-societa-cinese-esposto-su-internet-con-i-dati-dei-cittadini-schedati/

Eleven organizations are asking major retailers in the United States to stop selling Internet-connected devices that don’t meet minimum security and privacy requirements.

It’s estimated that the number of active Internet of Things (IoT) devices will reach 10 billion by 2020, but several incidents have shown that many such products can pose serious security and privacy risks, including for children. The CloudPets leak from 2017 and the EU’s recent recall of a children’s smartwatch are just two examples.

In an effort to avoid such problems, nearly a dozen privacy and security advocates on Thursday sent a letter to big U.S. retailers asking them to publicly endorse minimum security and privacy guidelines, and use these guidelines to vet the IoT devices they sell to customers.

The letter is addressed to Target, Walmart, Best Buy and Amazon, and it was signed by Mozilla, the Internet Society, Consumers International, ColorOfChange, Open Media & Information Companies Initiative, Common Sense Media, Story of Stuff, the Center for Democracy and Technology, the Consumer Federation of America, 18 Million Rising, and Hollaback.

The guidelines focus on five main requirements: using encryption for all network communications, on-by-default and automatic security updates, the use of strong passwords for remote authentication, a vulnerability management program maintained by the vendor, and the inclusion of a privacy policy.

“While many products can and should be expected to meet a high set of privacy and security standards, these minimum requirements are a strong start that every reputable consumer company must be expected to meet,” Mozilla said.

The use of encryption ensures that communications between the device and servers are protected against eavesdropping or unauthorized modifications. Automatic security updates help protect users against attacks exploiting known vulnerabilities.

The use of strong passwords and forcing users to change default passwords during the initial setup of the device is also good for protecting IoT products against attacks.

Vulnerability management is also important. Vendors should make it easy for researchers to report vulnerabilities found in their products, and they should have an internal process in place to handle these reports.

Finally, the privacy policy accompanying every product should be easily accessible and written so that it can be understood by the targeted customer category.

“At a minimum, users should be notified about substantive changes to the policy,” Mozilla said. “If data is being collected, transmitted or shared for marketing purposes, that should be clear to users and, in line with the EU’s General Data Protection Regulation (GDPR), there should be a way to opt-out of such practices. Users should also have a way to delete their data and account. Additionally, like in GDPR, this should include a policy setting standard retention periods wherever possible.”

Related: Why it’s So Hard to Implement IoT Security

Related: As IoT Grows, Confidence in Security Remains Low

Related: Industrial Internet Consortium Develops New IoT Security Maturity Model

Related: Security in an IoT World – Your Big Data Problem is Getting Bigger

http://feedproxy.google.com/~r/Securityweek/~3/HL7YGWxHvO0/mozilla-others-want-big-retailers-pledge-minimum-iot-security

Facebook gathers intelligence from its platform to identify people who threaten the firm or its workers, the social network said Thursday in response to media reports of the security tactic.

CNBC reported that it interviewed more than a dozen former Facebook security employees, some of whom questioned the ethics of what was portrayed as an unclearly defined practice at the leading social network.

Facebook spokesman Anthony Harrison told AFP that the company’s physical security team exists to keep workers safe and that strict processes are in place to protect people’s privacy.

“Any suggestion our on-site physical security team has overstepped is absolutely false,” Harrison said.

“They use industry-standard measures to assess and address credible threats of violence against our employees and our company, and refer these threats to law enforcement when necessary.”

Facebook keeps a routinely updated list of people that members of its security team should “be on lookout” for due to threatening statements, according to CNBC.

The so-called “BOLO” list purportedly includes former employees whose actions at the social network came under scrutiny.

Facebook mines the social network for threats against the company or its workers, and its watch list can even feature photos of people, CNBC reported.

For cases in which threats against Facebook or its workers seem credible, the security team was said to be capable of tracking those behind them using location data from the social network’s apps or websites.

Facebook is adamant that its security processes are designed to protect people’s privacy and adhere to data privacy laws, as well as the social network’s terms of service.

In cases of credible threats of violence against an employee, Facebook uses publicly available data and industry practices to determine how close someone behind a threat is to the worker or company offices, according to the social network.

http://feedproxy.google.com/~r/Securityweek/~3/hHHPpbdhupI/facebook-taps-user-data-defend-workers-threat

United States senators have voiced concerns over the use of foreign-made Virtual Private Network (VPN) applications within the Department of Homeland Security (DHS). 

VPN services promise improved security and privacy when browsing the Internet by routing all of the user’s traffic through the provider’s servers, and a large number of people, including mobile users, have adopted such services for increased online privacy.

Furthermore, users are also adopting data-saving apps, including mobile browsers such as Dolphin, Yandex, and Opera, which route traffic through their servers and compress it before serving them to the user, to provide data-saving functionality.

It is the growing adoption of mobile apps that could expose U.S. government employees’ web browsing data and the routing of users’ traffic on foreign servers is worrisome, Senators Marco Rubio (R-FL) and Ron Wyden (D-OR) told Cybersecurity and Infrastructure Security Agency (CISA) Director Christopher Krebs in a letter dated February 7. 

“We are particularly concerned about the potential threat posed by foreign-made apps that are affiliated with countries of national security concern and urge you to examine the national security risk they pose,” the letter reads (PDF). 

The Senators point out that some of these applications, many which have been downloaded by millions of users, are developed by “foreign companies in countries that do not share American interests or values.”

“Because these foreign apps transmit users’ web-browsing data to servers located in or controlled by countries that have an interest in targeting U.S. government employees, their use raises the risk that user data will be surveilled by those foreign governments. The compromise of that data could harm U.S. national security,” the Senators say. 

The letter also notes that the U.S. government has already recognized the national security risks posed the use of foreign technologies. 

The House Intelligence Committee has already recommended the U. S. should view with suspicion the increased presence of Chinese companies on the U.S. telecommunications market and the DHS last year ordered all federal agencies to remove products from Kaspersky Lab from their networks, the Senators say.

“If U.S. intelligence experts believe Beijing and Moscow are leveraging Chinese and Russian-made technology to surveil Americans, surely DHS should also be concerned about Americans sending their web browsing data directly to China and Russia,” the letter reads. 

The Sens. urge for “a threat assessment on the national security risks associated with the continued use by U.S. government employees of VPNs, mobile data proxies, and other similar apps that are vulnerable to foreign government surveillance.”

Furthermore, the Senators say that, should these services be found to pose a risk to the national security, a Binding Operational Directive should be issued, to prohibit their use on federal government smartphones and computers.

Related: Marco Rubio Proposes New Federal Data Privacy Bill

Related: Senator Urges Federal Agencies to Ditch Adobe Flash

http://feedproxy.google.com/~r/Securityweek/~3/GIk8Uw0FOC8/senators-concerned-over-dhs-employees-using-foreign-vpns

A survey conducted by the Ponemon Institute on behalf of security solutions provider TUV Rheinland OpenSky analyzes the security, safety and privacy challenges and concerns related to the convergence between information technology (IT), operational technology (OT), and industrial internet of things (IIoT).

Industrial systems are increasingly sophisticated and automation plays a critical role in ensuring efficiency, which has led to IT, OT and IIoT systems becoming increasingly integrated. However, there are several challenges and concerns that need to be addressed to achieve convergence.

The study conducted by TUV and Ponemon is based on responses from over 650 individuals from organizations of all sizes, representing sectors such as automotive, oil and gas, energy, healthcare, industrial manufacturing, logistics and transportation, consumer goods and retail, and telecommunications. A vast majority of the companies (99%) have employees in the United States, but many also have employees in Canada (67%), Europe (69%), the APAC region (58%), Latin America (54%), and the Middle East and Africa (35%).

Roughly two-thirds of respondents said they believe IT and OT convergence is a good thing and that it’s being driven by digitalization. Over 60% of respondents believe convergence is important for achieving a more mature security posture, and nearly half believe it’s an important factor for improving the trust and confidence of supply chain partners.

However, according to the study, many believe convergence cannot be achieved without support from the company’s chief information officer (CIO) and other C-level executives. At least half of respondents also said convergence is not possible without strict safeguards for critical operations data, and it’s not possible if the organization has a long history of silos and turf issues.

“Conflicts created by turf and silo issues are a significant organizational barrier to successful convergence. The creation of a cross-functional team to manage cyber risk across IT and OT systems will help eliminate this problem,” the report says.

At least half of respondents claimed their organization is highly effective in achieving various tasks that are crucial for convergence, including safety program management, cybersecurity planning, leadership and governance, security program management, awareness and training, incident preparedness, testing and assessment, and threat and risk analysis. Fewer companies claim to be good in areas such as third-party risk management, compliance with regulations and standards, and privacy program management.

Respondents said they believe resilience, agility, a strong security posture, and expert staff are the most critical factors for ensuring a successful convergence process.

This process is in many cases managed through a combination of in-house and outsourced expertise (46%), followed by only in-house teams (34%), and only external service providers (20%).

When it comes to budgets allocated for convergence, 45% of respondents said they have a budget, but 50% said they do not have a budget for it.

The inability to overcome turf and silo issues has been cited by more than half of respondents as a barrier to the successful convergence of cybersecurity, functional safety and data privacy. Other barriers cited by a significant number of respondents include the inability to control security, safety and privacy initiatives, the inability to secure assets and infrastructure, the inability to ensure the free flow of information, and the lack of in-house expertise.

The lack of skilled employees is considered the most common problem for a strong convergence process, along with insufficient risk assessment.

Many organizations believe that mobile and IIoT devices have the most negative impact on convergence.

The study found that while safety objectives are in many cases at least partially aligned with business objectives, privacy objectives and cybersecurity objectives are less likely to be aligned. On the other hand, over 70% said cybersecurity is the most influential to their company’s business strategy, while privacy is the least influential.

While security is considered important during the convergence process, many organizations don’t appear to be able to maintain a strong cybersecurity posture, but they are more confident in their ability to maintain a strong safety posture.

The complete report, “Safety, Security & Privacy in the Interconnected World of IT,OT& IIoT,” is available for download in PDF format.

http://feedproxy.google.com/~r/Securityweek/~3/KKDl7udV-Ew/study-analyzes-challenges-concerns-itot-convergence

Apple has begun notifying developers who use screen-recording code in their apps to either properly disclose it to users or remove it entirely if they want to keep their apps in the App Store. The move comes after a TechCrunch report showed that many apps do not disclose such activity to users at all, and some sensitive user data has been compromised through screen recordings.

“Protecting user privacy is paramount in the Apple ecosystem,” an Apple spokesperson told TechCrunch. “Our App Store Review Guidelines require that apps request explicit user consent and provide a clear visual indication when recording, logging, or otherwise making a record of user activity.”

The initial report highlighted third-party analytics code used by Air Canada, Expedia, Hotels.com, Hollister and other companies in their mobile apps that allows them to record the screens of users while they navigate the app. These “session replays” are designed to help developers work out kinks, make informed UI decisions, and better inform them on how users are interacting with their apps in general.

However, many apps do not tell users that their activity is being monitored by screen-recording code. Also, some session replays reportedly compromised sensitive user information. While they are designed to mask such data, TechCrunch reported that Air Canada’s app was not properly masking information such as users’ passport and credit card numbers.

Insights or invasions?

In the cases cited in the original report, the analytics firm Glassbox provided the third-party code that allows apps to record every tap, swipe, and gesture that a user makes in an app. While the primary goal of the company’s technology is to give developers more information about how users interact with an app, Glassbox “doesn’t enforce” a policy that its customers disclose to app users that their activity will be recorded.

“Glassbox and its customers are not interested in ‘spying’ on consumers,” Glassbox told The Verge in a statement. “Our goals are to improve online customer experiences and to protect consumers from a compliance perspective… We are strong supporters of user privacy and security. Glassbox provides its customers with the tools to mask every element of personal data. We firmly believe that our customers should have clear policies in place so that consumers are aware that their data is being recorded—just as contact centers inform users that their calls are being recorded.”

In contrast, Apple demands a certain level of disclosure from all app developers with programs in the App Store. Just last week, the iPhone maker revoked both Facebook’s and Google’s enterprise app certifications for distributing iOS apps outside of the app store to non-employees. Facebook and Google created “research” apps that they were using to obtain a ton of user information, including browsing history, app usage habits, and even message contents.

Apple’s response to this screen-recording controversy shows that its primary concern isn’t necessarily the analytics code itself but the disclosure to users that such technology is being used. By properly notifying users that such code is in place, it allows the users to decide whether or not they want to use the app in question.

According to TechCrunch’s newest report, Apple began notifying developers who use screen-recording technology yesterday that they must properly disclose the feature or remove it entirely. Developers only have one day or so to follow Apple’s instructions, and if they don’t, their apps will be removed from the App Store until they do.

https://arstechnica.com/?p=1453321