Mobile application session replay and masking

[Conal_Buchanan1]

For some context I've been requested to configure a mobile application in 2 situations.

In the dev or low environment the app will have no masking.

In production the app should have full masking enabled.

We've configured an application with full masking using these settings:

gradle:

userActions { namePrivacy true }

kotlin

val config: MaskingConfiguration = Safest()

I've attached a screenshot of what the recording looks like in session replay.

 

I would like to confirm if this is what we would expect to see.

Are there any components that should be visible in the Safest() configuration?

Are production setup's typically configured in Safe() mode?

[Patrick_H · Accepted solution]

Yes, in safest all labels, fields etc. are blacked out. There is no typical production setup as it depends on what the customers and end users privacy needs. E.g. if most elements do not contain any PII (like OK buttons, general not user related text) or if the view contains lots of PII (think of a listing of your bank account)

[Conal_Buchanan1]

Ok thanks, wanted to make sure it's not a bug in our configuration.

Will try reducing the masking level.

[paul_kapeller]

FYI: we described the masking configurations you can make in our documentation.

For example for Android: https://www.dynatrace.com/support/help/platform-modules/digital-experience/session-replay/session-re...

[Conal_Buchanan1]

Thank you for the documentation.

There are a few points I'm unsure of.

I've noticed in testing that sometimes the recording doesn't show the settings I've used.
For instance I set safe() mode but the recording is still masking at safest() level.

Is there a way to read what the current configuration is?
Is it better to call at startup or when the user opts in?

[carlos_munoz · Accepted solution]

As documented:

• Safest—all the editable texts fields, images, labels, web views, and switches are masked.
• Safe—all the editable texts fields are masked.
• Custom—by default, masks the same elements as Safest, but you can decide exactly which app components or views should be masked.

If you set the masking at the middle of a session, the first half will be SAFEST and the second half will be the new configuration. So the masking is only applied for events produced since the set of the new configuration, but not backwards.

It's not possible to read the current Masking configuration. There can be only set. Sorry for that.
We usually recommend to set up the masking at the very beginning of the startup. You can also wait for the opt in and apply the masking based on it.