Hacker News new | ask | show | jobs
by shock-value 4540 days ago
Screenshots are fine as long as they reliably show the last thing the user saw before switching from the app. It's up to the user to shut down the app or ensure it's not in a sensitive state if they need to. If your browser is resting on a page with your social security number on it, then that's the problem right there --- not that there also happens to be a screenshot of this on the switcher.

Some niche apps might benefit from employing a scheme like this to bolster security (I'm thinking for example a password manager which requires its own passcode whenever you switch to it), but the potential minor security drawback for these niche situations is definitely not sufficient to require this across all apps.

1 comments

Screenshots with sensitive info are not fine, that screenshot is stored on disk unencrypted. They also often outlive the running instance of the app. This bypasses any protection regularly used by the app for that information, and therefore the best practice is to blank out anything the typical user deems sensitive.