Hacker News

> I've yet to see someone saying "oh, I'm so glad my screenshot was blacked-out because I didn't realize I was in a banking app". It feels patronizing.

Yes, this. Payment apps, government apps, IM communications.

The other day I almost rooted my phone in anger trying to get around this, before pausing and realizing that this would only cause even more problems with those apps, thanks to remote attestation "features".

My favorite recent case, I almost locked myself out of mobile government services when changing phones recently[0], and it would've made for a stellar bug report showing when "fail safe" design can easily become "fail deadly"[1], with UI view of access and invalidation history clearly showing the timeline of a problem... if only I could take a screenshot of it. But I can't, because "much sekhurity".

--

[0] - Well, it's not really that big of a deal. With government services, there's always a way back. Might involve walking to a local civil affairs office or, worst case, a police station or a notary, but there is a way back. Big cloud services, on the other hand...

[1] - Invalidating a certificate prior to issuing a new one sounds like a good security idea, but in the real world fails critically if the two operations aren't an atomic group. In my case, issuing a new certificate failed, and I ended up walking around for half a day with old one invalidated and not even knowing it.

Software that intentionally subverts the intent of the user is malware. We now live in a world where most financial institutions literally ship malware as their primary or only interference to access their systems.

I understand the sentiment, but think about the non-technical user. Every time I use my mothers or any elderlies phone there are a lot of screenshots in the gallery, because they accidentally click the combo. How many people get scammed using screen sharing? It isn't that unreasonable to prevent this vector just to be more safe, especially if the bank might be partially at fault if a scam happens.

Hoping to not sound like a broken record, this is why having full ownership of your device and OS is important. My stock Pixel Android recently told me something along the line of "A security policy blocks screenshots for this app. Talk to your administrator if you want to change the policy". I looked in the mirror and my administrator said "time for a policy change, we're moving to GrapheneOS".

And just as important: Help your friends and family to move as well, so they can have ad blockers, NewPipe etc. We need a critical mass of users invested in their freedom, otherwise its going to be crushed by malicious/dumb security measures of their banking apps, corporate greed ("oh, a simple misunderstanding, when you clicked 'buy' you rented a limited license. Did you not read the ToS?") and police overreach. It's a perpetual battle.

“Security” that makes ordinary sharing unusable is often just UX debt wearing a security badge. The right fix is selective redaction, not disabling screenshots everywhere.

I went to screenshot my upcoming Verizon Fios fiber install out of excitement and got an immediate warning dialog.

WARNING: You are in violation of the My Fios app end user licensing agreement that prohibits duplication of this screen. Please immediately delete this from your device.

... apparently buried in the app T&Cs is a "Distribution of the technician's picture or information is prohibited". Even if there's no tech assigned, the screen with the picture of the grey fake man with a fake hat apparently causes a big old warning if you screenshot it.

It's not about the logo. It's about abusing a platform feature that arguably shouldn't exist in the first place.

I don't have an issue with BSky's use, but I regularly run into the functionality's abuse elsewhere, such as multiple of the biggest Thai banks' apps where every screen in the app entirely blocks screenshots (iOS). Doing a P2P money transfer and want to send a screenshot to the recipient for them to confirm their info before you hit submit on a non-reversible transfer? Blocked. Want to screenshot a promotion's terms for proof or a personal reminder? Blocked. It's even worse as multiple of the biggest brick-and-mortar Thai banks wholly dropped web access and are now smartphone-only. (Or more obscure, want to translate a single-language screen into another language? Blocked.) Etc.

I want to take a screen shot of the transaction I just did. Can't because some ahole decided for me that it's too sensitive information and blacks out the whole screen. this API is stupid without control in settings of the os

>This exists for a very good reason.

This exists for a very bad reason.

>It’s so if an app is showing a password or bank account number or other piece of sensitive information it doesn’t accidentally end up in a screenshot.

and also coincidentally if the app is showing something incorrect that you want to be able to verify and provide proof of now you can't.

>I think it’s a good thing it’s there. This functionality should be easy for apps.

I think it's a bad thing it's there. The functionality should be easy for me.

OTOH, I might very well want to take a screenshot of my own bank details, transactions, or other sensitive information. It's annoying that my information is being protected from myself.

Then it's a bad solution to a real problem. A better solution would be exposing a hook that apps can call when a screenshot is initiated that tells the OS to warn the user before saving the screenshot. This way the user is actually educated on the risk while still respecting their right to control the outcome.

The OS could draw an ugly censoring block over the sensitive information. That would protect the user's privacy when needed but also prevent apps mis-using the feature like this.

It's MY phone that I paid over $1000 for. Let me choose what is exposed and what is not.

> it doesn’t accidentally end up in a screenshot

Your banking app probably has an option to disable that because it's a legal requirement in so many places: People who can't see need to use assistive tools, and that includes screenshots and friends. If you are using a tiny/stupid bank in the US, file a ADA claim and get some money. In the EU check your Ombudsman.

No, it's so you can't screen-record Netflix. The bank doesn't care about that because it's not a liability issue to them, just fetishism; no way they pay Apple and Google for this capability.

Apple and Google should step in and allow users to remove these shenanigans with a little button on the screenshot preview screen, but resist this because of Netflix et al.

I don't think they're abusing functionality at all. I don't think screenshotting a skeet should, by default, leak the follow state of the user taking the screenshot, which is what would happen without the secure input swap

"Secure inputs" take many forms, and it doesn't feel like this is abuse in any meaningful way

"accidentally end up in a screenshot" --- how often do you even take a screenshot on a phone, much less accidentally?

Account numbers appear on checks. They are not exactly secret, and if I want to take a screenshot of one, I should be able to.

But how can I take a screenshot that intentionally shows the password or whatever?

If it's to prevent accidents, it should just prompt user to confirm saving the screenshot with sensitive information.

As it is, it is just an annoyance that requires you to do stupid workarounds like taking a photo of your screen.

Imagine if a password manager didn't allow you to copy the password since you might accidentally paste it somewhere incorrect.

If a dev forgot to obfuscate the password and rendered it as plain text on the screen, then what are the chances they remember to program the blur into this screenshot api hook. Or why not add an alert, “what me to blur sensitive info? Yes/No”

I can always just pull out my second phone to bypass all this shit.

Which is why everyone should root the their phone to turn this kind of shit off.

The app doesn't know. It just produces a widget tree, and the OS-provided renderer renders it this way or that way. In particular, it chooses not to render controls marked as "security-sensitive" when the rendering is intended for a screenshot; it could instead put empty boxes in their place, etc. The app has no idea and no control, AFAIK.

Reddit has a toggle in its settings to disable it. X, too, I think.

Personally, I wish iOS didn't even facilitate this.

edit: to be clear, I don't think iOS should notify the app at all. The app could register areas as "invisible to screenshots" perhaps - I'm torn on that functionality.

iOS allows something similar because this is iOS. iOS allows something exactly the same because this article is about iOS.

No, it's about saving the bank money - and what costs them a lot of money is the average person being fooled into sending people their account information easily.

I want those things included, at least by default. A screenshot normally captures the user’s screen size, brightness, zoom level, font choices, etc.

It is often important to people that the screenshot is an accurate record of what was on the screen.

The effects of cramming 2 separate workflows and 5 features into one thing called "screenshot" because anything else would end up with something too complicated for users to understand the interaction (sarcasm that figuring out what the behavior is locked to in these scenarios is just as confusing).

While we're at it, this "share" containing the copy/paste flow is the exact same kind of thing. And screw whatever logic decides to copy the URL of an image instead of the actual image sometimes from Safari when I select to copy it!

what happens when it’s a custom handle like @example.com?

> The app knowing I took a screenshot feels adjacent to me to a keylogger.

To my knowledge, this is a misunderstanding. The app does not know that you are taking a screenshot, rather iOS knows you are taking a screenshot (as it must) and is excluding an element on display that has been designated by the developer as sensitive information. This is the same technology that prevents you from accidentally screenshotting your password manager; the developer has simply performed a nifty trick to display a small icon behind where the “follow” button would otherwise be displayed.

There are plenty of instances where this sort of thing can be annoying, such as when you try to screenshot a streaming service app and DRM enforcement leaves you with a blank screenshot, but IMO this particular instance is actually very tasteful; seeing “follow” on every screenshotted post is just useless noise, but a small unobtrusive platform icon is a useful reminder that the post came from Bluesky and not another very visually similar service like X(cancel) or Mastodon.

> The app knowing I took a screenshot feels adjacent to me to a keylogger.

That is what this article is about and why you should read it before commenting. The whole point is that it doesn't need to know you're taking screenshots. That's why it's a clever trick.

but you didn't read the part where the mechanism is explained? it doesn't do anything like capturing information. it just marks a button "sensitive" causing it to be hidden in a screenshot, thus revealing an icon that was put there underneath the button.

Did you read the article? Bluesky doesn't know you're taking a screenshot, iOS just hides the follow button in the screenshot (consequently making the Bluesky logo visible).

I would happily use the Google Maps "share" feature, but I've yet to encounter any but the simplest of scenarios where it actually preserves the entire context of what I'm trying to share: the viewport, the start and destination, stops along the way, route choice, the time of day, all of it.

If I'm sending a screenshot it's because I want to send exactly what I see on my screen and not have my recipient's gmaps instance happily recompute a route it thinks is better or leave out the routing information I included, or switch from biking to driving directions, or whatever else.

It's not about what you want. It's about increasing engagement with the Google platform

Today I noticed that Amazon Pharmacy decided to blank out my prescription info that I was screenshotting to send to my doctor. WTF.

Blame Apple for even allowing apps to be aware of the user taking a screenshot.

Just like their iCloud Keychain API that lets apps secretly track users across app reinstalls and device resets.

How else are they gonna track you? Think of the big tech

Good thing if you have GMaps open to the directions list while driving and tell Siri to take a screenshot, it doesn’t throw up a full page of nonsense over your directions that only Voice Control (not Siri alone) or a [potentially nonexistent] passenger could close.

Oh wait it absolutely does.

> Hijacking the screenshot process is a privilege that you ought to be able to revoke, it's insane to allow software to be given more control.

It should not exist as a control in the first place.

I know it may sound absolutist, but the way I see it: if you allow this as a user-revocable permission, then the very apps that need to be screenshotted by users most often will be the first to refuse to work at all unless you grant this permission.

Screenshotting is an system operations level feature. Apps should be neither aware of, nor able to interfere with, a screen capture being taken.

Did you read the post? Nothing is hijacked, but its a trick where they render the normal button in a ui element for secret data, which is blanked by the system on screenshot, revealing the logo underneath. Its a reasonable feature, so its hard for apple to control it better or remove this.

Yup, that's by design. They want to force you to "share" so they can both track who you interact with, and also try to convert the other person into a paying customer.

> Many a time, a share button simply works

It works! Unless:

- the person you’re linking it to doesn’t have an account on that platform

- you’re posting it in a chat, and the site doesn’t implement unfurls correctly

- the site shows a thumbnail on the link, but clicking on it gets hijacked by the “mAkE an aCcOuNt/ login here” shenanigans.

- you’re trying to link to something in context and the sites linking doesn’t support it

- the site is riddled with ads.

- the site is slow to load.

- you’re trying to save something and don’t want to have to load the site every single time in order to refer to it.

- any combination of the above.

Screenshots are much better for archival. So many times you go back to a url/link you shared, and poof it's gone or the content has changed from when you sent it.

Screenshots allows you to get a point in time reference to what you are sharing.

In the case of sharing a link I have to remember/find where it is in each app, likely scroll through a long list of messaging (and for some reason non-messaging apps) to find the correct app, select the contact, and then pray that the link sent actually works for them and contains the correct information I'm seeing (very often the link will actually direct them to a web version of the app I'm using, then put a modal popup in front of the information asking them to use the app, then either send them to the app store, or send them to the app but strip out the actual information I linked and send them to a blank map).

Screenshots are clunky and unideal, but at least they're fast and I know that they don't fail or break or send the wrong info to my contact.

If it were a one off message, this wouldn't be an issue, but if you zoom out on the issue and see you're sending up to a hundred messages a day, points of failure become major life frictions and you're trained out of using things like links in messaging apps.

The ideal "World Wide Web" envisioned by it's original design, was that a URI was a durable pointer to an immutable piece of information.

In 2026, we now know that the information can be edited, or completely removed for many reasons, some legitimate, and some nefarious.

Taking a screenshot is the easiest way to ensure the original is kept for folks to see. Frankly, it'd be even better if (a) the app can signal to the OS information about the url to the page for the screenshot, (b) timestamps were captured in the image and not cropped, and (c) the OS can authenticate the screen shot and digitally sign that it came from an unaltered device.

I totally disagree - the few times I accidentally use a share button, or are forced to use one, the experience is so desperately miserable I am forcibly reminded why I never use them. It's always several clicks, choosing the social platform I need from the millions-long-list which is paginated into pages of like 4 icons at a time (I just want a URL! but you broke your website to force users into the app!) and from there choosing a specific chat or group or whatever from a poorly ordered list that starts with some person I met at a bar twelve years ago rather than the chat I was literally just typing in two seconds ago...

and then when it does send I have no control over the presentation on the other side. Sites love to add some cringe "I love this app SOOOO much hearteyesemoji fire fire fire... sent from my iPhone, made with love in san cupertino" nonsense in my own voice - literally sending their words into my chats using my account, as though I had written their marketing dreck

GrapheneOS doesn't allow for it. You'd need a rooted device to bypass screenshot blocking

For Bluesky, sure. I think the comment was aimed at the trend.

Android and iOS should not let apps do this, because it can be (ab)used by apps that you can’t really choose not to use.

I know there’s a popular bank in my country that completely blocks screenshots and screen recordings on Android somehow.

Yes. And because of the platforms deciding to enable that business model, we're now in a bullshit reality where the very apps that need to be screenshotted most often, are first to abuse platform features and prevent screenshots from being taken.

This deserves a longer rant, but the very premise of Snapchat was always poisonous, and is largely responsible for why, 20 years later, we're now facing extreme proposals for regulating electronic communication.

I generally disagree with the whole line of criticism techies get for "solving social problems with technology", but if there's one unambiguous case where I'd agree it was plain stupid, it's the concept of screenshot prevention, that became prominent with Snapchat. Controlling whether your recipient gets to keep the message you sent them is a purely social problem, and the answer to that in the real world has always, for good reasons, been "once sent, it's no longer yours; once received, it belongs to recipient to do with as they please".

That plus product design.

Yellow.

They fuckin did it. Not construction not a warning of some type. Not yellow pages. Yellow - cool looking yellow.

Is what I said to myself as a 20-something product designer

have you never encountered the plague of apps saying "don't screenshot, our content looks so much better when you share it, see:" and then displaying a picture of the stupidest looking thing youve ever seen in your life as though you would ever consider showing that to your friends instead of the most personal thing - literally showing them what youre seeing with your own eyes

It's all "security" and all until your banking app has a bug that breaks exporting bank statements and the only way to get it out is to take screenshots - which are blocked as well. Oh, and you need to submit it by today.

At least on rooted Android devices you can bypass that.

Until the big players agree on a watermark that their cameras will refuse to photograph.

> a significant percent of Bluesky users

42 of their 56 active users might not care about a watermark but god dammit do they respect it

And so should you

Okay? Is the purpose bad? Leading to bad things? What's the problem

Or, in the case of X, into the outside of the wall of the garden with no way through

Different underlying mechanism. The LinkedIn one (and almost all ads on Instagram/Facebook these days) use a gain map to increase the brightness of the image. Here's a site demoing the tasteful application of this [0], you can see the difference viewing it live versus taking a screenshot of the result.

[0]: https://gregbenzphotography.com/hdr-gain-map-gallery/

This is correct. I was tired of Bluesky screenshots looking bland, no culture of fear needed

Implementing a watermark isn't a thing anyone thinks is a cool feature they want to try out.

It's probably silly to make OP's judgement of any of these implementations in isolation, but you can sense a real fear about the growth (or lack thereof) inside Bluesky. Fiddling with the presented metrics (likes count getting moved ahead of reposts), promoting total user signups while being silent on collapsing DAUs. They are promising a lot at once with AI custom feeds from Attie and subreddit-style communities that smells like feature creep.

Adding a watermark, how radical, dude

And such engineer would have enough organizational clout to just ship it without going through anyone?

I know you don't think it's bluesky, but which app do you think is better at putting its logo on screenshots?

Saying @dang has no effect; it does not activate a batsignal or any other mechanism of mod summoning. The only way to be sure a mod see this is to email them; see the contact link in the footer and include a link to the comment.

Locks can be picked. We still make and use locks.