Let me start here: have you tried Shazam on your iPhone? It’s amazing. It listens to music playing anywhere, somehow sends the data up to its home server (works over WiFi or cell networks) then tells you what the song is (artist, song title, album, etc.). They try to make money by selling you the song with affiliate links. It’s great for those times where you’re in your car thinking, “who sings this song, anyway?”

So here’s how it works: you click the button “tag now.” That’s it. It listens, and uploads the audio. It never asks your permission.

This made me think: could any app on the iPhone, while running, record ambient audio and upload it? As far as I can tell, the answer is “yes.”

Interestingly, Apple has been careful to include a warning when apps ask to determine your location on the iPhone. That’s a nice privacy control. But any app can listen in when it’s open. Seems like a hole waiting to be exploited.