Be careful what you send

getty

If you have an iPhone and a Mac, there’s a worrying glitch that has not yet become a thing — but it will. Your iPhone blocks screenshots of “view once” images and passwords. But open up iPhone mirroring on your Mac, and nothing is blocked. All those disappearing images and passwords on your iPhone can now be saved.

If you try to take a screenshot of a view once image in WhatsApp for example, your iPhone will show a full screen warning instead: "Screen capture blocked," it says. But if you use Apple’s new iPhone Mirroring app on a Mac, and open the message there instead, the screenshot is captured just fine. The app shows a similar warning, that “screenshots are blocked for added privacy,” but they’re not. The screenshot is captured and saved to the Mac. The “view once” fails.

“Once you send a view once photo,” WhatsApp says, “any photos or videos you send won’t be saved to the recipient’s Photos or Gallery.The recipient also can’t take a screenshot of anything you send using view once.”

Ironically, the WhatsApp app on the Mac doesn’t display view once images even once. “You received a view once message,” it says. “For added privacy, you can only open it on your iPhone.” That’s exactly how it should work.

WhatsApp does warn that “there are other ways your view once media or voice message can be saved or recorded. For example, recipients can take a photo or video of your view once media with a camera or other device before it disappears.”

ForbesApple Changes iPhone After 15 Years—Why You Should ‘Stop Texting’By Zak Doffman

More alarmingly, Apple also blocks screenshots of passwords in its own password manager. If you try to screenshot an entry in Passwords on your iPhone with the password visible, the image blanks the password line.

But if you use the mirror on a Mac, the screenshot protection fails. This is an issue where the screenshot behavior differs between the iPhone and its mirror. If an app has decided to block screenshots, the mirror should not be a workaround — especially if it’s a security app developed by Apple.

Echoes here of the battle between Signal and Microsoft, when the secure messenger used a DRM setting in Windows to stop the creepy Recall platform compromising Signal security with its staccato screenshots.

If you own an iPhone and a Mac, these security and privacy issues are manageable. You can set the mirror to require biometric device security when it connects. It will ask for the same when it opens a secure app on the iPhone. You’re not exposed to any data compromise, because the security of Apple’s cross-platform OS is very good and designed with security in mind.

But if you view a password on the mirror or send a “view once” image on WhatsApp or similar, there’s a risk. This is a clash, where an OS overrides an app’s security, and it comes about because the app is built for one OS but is being viewed on another. Vulnerabilities and even glitches lead to compromises. Apple could prevent Mac screenshots capturing the iPhone mirror to resolve this.

I have reached out to Apple and WhatsApp for comment.