News for hackers. Stuff that matters.

A comment on Apple tells app developers to disclose or remove screen recording code. Parent comment

Re: Apple tells app developers to disclose or remove screen ... by randormie on Thursday February 07, 2019 @06:26PM (#19109719)
It's creepy indeed. Not only do they collect all your actions (key presses included) but I believe they also send the activity to their servers via HTTP, rendering the SSL on the page that includes their script, useless.
[ Parent | on HN ]
Re: Apple tells app developers to disclose or remove screen ... by CraftThatBlock on Thursday February 07, 2019 @06:28PM (#19109731)
If it's a HTTPS page, wouldn't that be blocked due to mixed content though? Or is HTTP requests from a HTTPS-loaded script allowed?
[ Parent | on HN ]
Re: Apple tells app developers to disclose or remove screen ... by djsumdog on Thursday February 07, 2019 @06:31PM (#19109754)
Modern browsers should block all backend/javascript http communication if the main request is made over HTTPS, unless you specifically disable it with a Content Security Policies.
[ Parent | on HN ]
Re: Apple tells app developers to disclose or remove screen ... by inetknght on Friday February 08, 2019 @12:40AM (#19111830)
Better to just disable javascript altogether. Sure, there's no dynamic loading of garbage, but I didn't want that anyway. If your back-end server can't render HTML then you need to build an app.

At least with native desktop apps I can put that garbage into a VM or container. Load whatever you want. I can then apply my own firewall/containerization/VM rules.

[ Parent | on HN ]
Re: Apple tells app developers to disclose or remove screen ... by jeromegv on Thursday February 07, 2019 @06:34PM (#19109777)
According to their documentation it is sent in https

https://help.hotjar.com/hc/en-us/articles/115011639887-Data-...

[ Parent | on HN ]