How Bluesky draws its logo on screenshots
timmarinin.net
timmarinin.net
I actually really like this approach. The action button isn't relevant in this context, and it doesn't occlude the content.
There's certainly situations where you wouldn't want this (ie if you're developing the app and you want to redesign starting from a screenshot), but for the average user I think this isn't overly hostile. I understand that people are dogmatically opposed to intent being modified, but I think you need to balance nuance. I actually enjoy having an attributable source in shared elements, and I think this is a low-impact way of achieving that.
It's a classic case of someone discovering a feature and thinking "hell yeah, so much security" without understanding or caring about UX impications.
I've yet to see someone saying "oh, I'm so glad my screenshot was blacked-out because I didn't realize I was in a banking app". It feels patronizing.
Yes, this. Payment apps, government apps, IM communications.
The other day I almost rooted my phone in anger trying to get around this, before pausing and realizing that this would only cause even more problems with those apps, thanks to remote attestation "features".
My favorite recent case, I almost locked myself out of mobile government services when changing phones recently[0], and it would've made for a stellar bug report showing when "fail safe" design can easily become "fail deadly"[1], with UI view of access and invalidation history clearly showing the timeline of a problem... if only I could take a screenshot of it. But I can't, because "much sekhurity".
--
[0] - Well, it's not really that big of a deal. With government services, there's always a way back. Might involve walking to a local civil affairs office or, worst case, a police station or a notary, but there is a way back. Big cloud services, on the other hand...
[1] - Invalidating a certificate prior to issuing a new one sounds like a good security idea, but in the real world fails critically if the two operations aren't an atomic group. In my case, issuing a new certificate failed, and I ended up walking around for half a day with old one invalidated and not even knowing it.
Very frustrating.
This feeling usually hits me at airports, with my shoes off and water confiscated. The terrorists won.
I doubt most people have a second phone on hand, ready and able to capture actual screen shots when your phone is preventing screenhots.
The "useful device" is a laptop.
In my view that's a feature, not a bug. I refuse to use services that break under "reasonable" conditions (non-chrome, ublock, no widevine, rooted, etc, etc).
Banks are the canonical example - changing one is a huge hurdle, with consequences that can drag on for years. One by one, they're all ditching their websites (if they had one in the first place) in favor of apps. Even those with full-featured websites increasingly force you to use their app as the second factor to log in, confirm transactions, even confirm viewing some data. Some offer physical tokens, most don't advertise that, and it's only a matter of time before they convince regulators that Attested Phones are Safer and Everyone Has One, and that option will disappear. And because they want their app to be the second factor, they can argue it needs to be secure, creating demand for remote attestation, and boom - there goes your option to work around any other bullshit limitation they throw at you.
The day has only 24 hours, I don't want to spend them clearing bushes by walking off the beaten path wrt. every single important service - payment services, government services, IM services, ${whatever bullshit SaaS app I need right now because you're using it for the thing you just shared with me, and I need to view that}, etc. So I submit. So does everyone.
It's why I put blame on platforms here. Features protecting the device from the user should not be built in the first place - they always start justified by some legitimate security reason, and always end up broadly abused to serve business reasons.
Should the phone identify those things and automatically blur out all of the sensitive information in those photos too?
I’d prefer if my phone did neither that nor told the apps that a screenshot was being taken nor allowing the apps to hide anything that was on screen when a screenshot is taken.
It’s my phone, I want to decide what I take photos and screenshots of.
That's the crux.
Yes, it is unreasonable, because scams have proven to be just as effective at getting people to just read the details out over the phone line, and bank these days are not showing much sensitive information in the open anyways (my recent annoyance - someone thought it's a good idea to never show the full account number on screen, showing just first and last few digits, and an option to copy to clipboard...).
Meanwhile, those very apps tend to be ones people would most often want to screenshot for legitimate reasons - e.g. to communicate or make a record of specific transactions, accounts, their states, metadata, etc. None of which is copyable text in the app, and most of it isn't even properly exportable, so it's not like there's any other way.
Done.
Just do a security alert pop up "You are screenshotting potentially sensitive information, are you sure you want to continue".
And just as important: Help your friends and family to move as well, so they can have ad blockers, NewPipe etc. We need a critical mass of users invested in their freedom, otherwise its going to be crushed by malicious/dumb security measures of their banking apps, corporate greed ("oh, a simple misunderstanding, when you clicked 'buy' you rented a limited license. Did you not read the ToS?") and police overreach. It's a perpetual battle.
It's also patronizing to ask during setup or whatever if the user is dumb enough to get scammed like this, even though that is kinda the actual piece of information needed
WARNING: You are in violation of the My Fios app end user licensing agreement that prohibits duplication of this screen. Please immediately delete this from your device.
... apparently buried in the app T&Cs is a "Distribution of the technician's picture or information is prohibited". Even if there's no tech assigned, the screen with the picture of the grey fake man with a fake hat apparently causes a big old warning if you screenshot it.
https://i.ibb.co/hRnn4ssF/2026-08-18-12-48-25.jpg
So yeah, I have a screenshot of the generic technician's ID photo, I guess.
Later on it did populate an actual name and photo when a human was assigned, but still, yeah, I don't get why they didn't just automatically redact it and just throw you the stupidest bullshit warning error ever on the honor system.
It’s so if an app is showing a password or bank account number or other piece of sensitive information it doesn’t accidentally end up in a screenshot. I think there are other places sensitive information won’t show.
Bluesky, and apparently others, are abusing the functionality for advertising purposes.
I think it’s a good thing it’s there. This functionality should be easy for apps.
I’d say this is one for app review or an App Store rule. But we all know those are a total joke.
This exists for a very bad reason.
>It’s so if an app is showing a password or bank account number or other piece of sensitive information it doesn’t accidentally end up in a screenshot.
and also coincidentally if the app is showing something incorrect that you want to be able to verify and provide proof of now you can't.
>I think it’s a good thing it’s there. This functionality should be easy for apps.
I think it's a bad thing it's there. The functionality should be easy for me.
Your banking app probably has an option to disable that because it's a legal requirement in so many places: People who can't see need to use assistive tools, and that includes screenshots and friends. If you are using a tiny/stupid bank in the US, file a ADA claim and get some money. In the EU check your Ombudsman.
No, it's so you can't screen-record Netflix. The bank doesn't care about that because it's not a liability issue to them, just fetishism; no way they pay Apple and Google for this capability.
Apple and Google should step in and allow users to remove these shenanigans with a little button on the screenshot preview screen, but resist this because of Netflix et al.
As it is, it is just an annoyance that requires you to do stupid workarounds like taking a photo of your screen.
Imagine if a password manager didn't allow you to copy the password since you might accidentally paste it somewhere incorrect.
"Secure inputs" take many forms, and it doesn't feel like this is abuse in any meaningful way
They find a good reason for every little piece of control or privacy they take from you.
Whatsapp also does this shit. You can’t screenshot a conversation (it comes back black). I am going Chinese for my next phone.
Because I assume most people want to take a screenshot because they want to capture something they are seeing in the app, most people probably are even annoyed to have the system indicators visible there.
> and now some apps get a hook to insert their branding.
No, apps can already insert their branding anywhere they want. They're writing the app. If they want their logo to be visible in screenshots, they have infinite ways to do that.
This particular way seems basically prosocial. It's much more useful to me as a consumer of the screenshot to see that it came from Bluesky than to see that there was a "Follow" button. It's not what the feature they're using was intended for, but I can't call it an abuse of the feature. What they're actually doing is good.
The fact that you're getting unexpected behavior isn't good. Sometimes you want to create a picture of sensitive information. You should be able to override the app developer's security settings.
Personally, I wish iOS didn't even facilitate this.
edit: to be clear, I don't think iOS should notify the app at all. The app could register areas as "invisible to screenshots" perhaps - I'm torn on that functionality.
Do you/should you (we) really expect that though? I regularly use color filters on my apple devices— grayscale to avoid distractions during the day and red tint at night. More recently I’ve been using the motion dots. I don’t know that I can say with confidence that I never want any of those “personal-perceptional-modifiers” to appear in a screenshot, but for most folks, I would guess it’s approximately never.
It is often important to people that the screenshot is an accurate record of what was on the screen.
Yes.
While we're at it, this "share" containing the copy/paste flow is the exact same kind of thing. And screw whatever logic decides to copy the URL of an image instead of the actual image sometimes from Safari when I select to copy it!
I guess the Bluesky bros got inspired by Threads, again.
The text at the top of the screenshot is
> Eric Roston
> @eroston.bsky.social
So it's pretty easy to tell IMHO.
It somehow is perfect example of how modern software engineering feels to go astray for me. A feature in my device working completely in benefit of the one providing said software. I wish, and wish only I can, that this trend goes away at some point.
The app knowing I took a screenshot feels adjacent to me to a keylogger. Imagine how many apps are capturing that information silently. To my mind, a screenshot is something that is happening outside of the app context, the app knowing about it is a security flaw imo.
To my knowledge, this is a misunderstanding. The app does not know that you are taking a screenshot, rather iOS knows you are taking a screenshot (as it must) and is excluding an element on display that has been designated by the developer as sensitive information. This is the same technology that prevents you from accidentally screenshotting your password manager; the developer has simply performed a nifty trick to display a small icon behind where the “follow” button would otherwise be displayed.
There are plenty of instances where this sort of thing can be annoying, such as when you try to screenshot a streaming service app and DRM enforcement leaves you with a blank screenshot, but IMO this particular instance is actually very tasteful; seeing “follow” on every screenshotted post is just useless noise, but a small unobtrusive platform icon is a useful reminder that the post came from Bluesky and not another very visually similar service like X(cancel) or Mastodon.
Android does it too: https://developer.android.com/about/versions/14/features/scr...
I dislike this hijacking for that reason and wish there was a way to turn it off.
If you screenshot what you are listening to, after the screenshot is taken spotify will open a full-screen popup to "share" the song you are listening to. This is quite dumb, especially since if you wanted to share a song via the screenshot, you can do so in the OS-level screenshot UI, and then you would close it and see Spotify's own similar version of the same UI. Spotify just really wants you to use their own share button so that they can track you.
So in this instance, am I right in understanding that iOS posts a notification after the user has completed a screenshot, which would make it impossible for the developer to use this notification to trigger anything that would modify that screenshot? Hence the developer’s work around?
And that is reasonable, but it is also a surface where an app touches the OS, which should be a permission boundary that I can control. Allowing the option to opt-out of screenshot blocking with a proper double-confirm warning and biometric auth is also reasonable.
https://developer.apple.com/documentation/uikit/uiapplicatio...
They’re abusing an iOS text rendering control function handled by the OS. Before the screenshot is taken iOS swapped out the rendered text for “sensitive” fields and images that.
The replacement is supposed to be something like a masked account number, password asterisks, or just general blur.
Not a marketing logo.
Yes, and I would say it's a bad thing that the OS tries to prevent this.
> seeing “follow” on every screenshotted post is just useless noise, but a small unobtrusive platform icon is a useful reminder that the post came from Bluesky and not another very visually similar service like X(cancel) or Mastodon.
I would say it's a bad thing that Bluesky makes the screenshot look different from what was on screen for the user. If I cared about excluding the "useless noise" from a faithful depiction of the pixels on my screen, I could address that myself.
As someone who develops apps for confidential conversations, making it harder for people to screenshot the confidential stuff is a feature the sending party wants, that is why they send in your app as opposed to others. It doesn’t make things impossible, just hard enough that 95% of people won’t bother to take a copy.
Same for example with disappearing audio messages on whatsapp
What I don’t like is the app being informed that I took a screenshot. The OS can hide things in screenshots without this.
Another way to look at it is the OS makes certain guarantees to the developer around security. Giving control of this to the user would erode that guarantee from the OS to the developer. The result of that is that some developers would simply never display some information (e.g. due to their own contracts or reasonable concerns about fraud/abuse/etc.).
Very similar to the video pipelines in modern devices. Prior to video pipelines which the OS could attest could not be hijacked by the user, many content providers simply would not allow e.g. Netflix to release their content on certain platforms. That the OS does provide such an attestation option for developers allows uses that otherwise would not exist.
I should be able to screenshot anything I want, including my password manager. I should be able to opt-out at the OS level, or any other level that enforces it. That's why it's definitely a user hostile feature.
> accidentally screenshotting your password manager;
I could not think of a more useless justification for installing malware into the OS. Okay, you've accidentally screenshotted your password manager. So what? Are you going to accidentally upload it to the internet too? I'd much rather live in a world where people who are that stupid face minor consequences for their actions than one in which all of our own computers are used against us.
That is what this article is about and why you should read it before commenting. The whole point is that it doesn't need to know you're taking screenshots. That's why it's a clever trick.
Found in the HN commenting guidelines, linked at the bottom of most pages
If someone from Google Maps or LinkedIn team is here, please, when I take a screenshot it's because I want to a screenshot, not share the friggin location/post.
Not sure who got the idea that it was useful, it isn't.
If I'm sending a screenshot it's because I want to send exactly what I see on my screen and not have my recipient's gmaps instance happily recompute a route it thinks is better or leave out the routing information I included, or switch from biking to driving directions, or whatever else.
Ah... to imagine a world where you could just share a coordinate string and people could open it in whatever map app/page they wanted. Geo URI is probably the closest we have today but I don't think much of anything outside the OS Geo community accepts it.
It's not clear who it is protecting against, it does not seem to be effective at protecting against anything at all, it is actively annoying to the user, and has no way to disable. Perfect example of the usual "security theater" feature.
Just like their iCloud Keychain API that lets apps secretly track users across app reinstalls and device resets.
Oh wait it absolutely does.
Hijacking the screenshot process is a privilege that you ought to be able to revoke, it's insane to allow software to be given more control.
And don't tell me it's anything to do with security when it can be circumvented in any number of ways.
It should not exist as a control in the first place.
I know it may sound absolutist, but the way I see it: if you allow this as a user-revocable permission, then the very apps that need to be screenshotted by users most often will be the first to refuse to work at all unless you grant this permission.
Screenshotting is an system operations level feature. Apps should be neither aware of, nor able to interfere with, a screen capture being taken.
The toast shows up after the screenshot, but my phones's long screenshot feature captures the top part a second time, so the top part of the chat becomes unreadable.
You don't have to wish, in this scenario. Bluesky supports third-party clients, you can use one that has a more minimal featureset if you prefer.
Android and iOS should not let apps do this, because it can be (ab)used by apps that you can’t really choose not to use.
I know there’s a popular bank in my country that completely blocks screenshots and screen recordings on Android somehow.
It works! Unless:
- the person you’re linking it to doesn’t have an account on that platform
- you’re posting it in a chat, and the site doesn’t implement unfurls correctly
- the site shows a thumbnail on the link, but clicking on it gets hijacked by the “mAkE an aCcOuNt/ login here” shenanigans.
- you’re trying to link to something in context and the sites linking doesn’t support it
- the site is riddled with ads.
- the site is slow to load.
- you’re trying to save something and don’t want to have to load the site every single time in order to refer to it.
- any combination of the above.
Screenshots allows you to get a point in time reference to what you are sharing.
In 2026, we now know that the information can be edited, or completely removed for many reasons, some legitimate, and some nefarious.
Taking a screenshot is the easiest way to ensure the original is kept for folks to see. Frankly, it'd be even better if (a) the app can signal to the OS information about the url to the page for the screenshot, (b) timestamps were captured in the image and not cropped, and (c) the OS can authenticate the screen shot and digitally sign that it came from an unaltered device.
Screenshots are clunky and unideal, but at least they're fast and I know that they don't fail or break or send the wrong info to my contact.
If it were a one off message, this wouldn't be an issue, but if you zoom out on the issue and see you're sending up to a hundred messages a day, points of failure become major life frictions and you're trained out of using things like links in messaging apps.
and then when it does send I have no control over the presentation on the other side. Sites love to add some cringe "I love this app SOOOO much hearteyesemoji fire fire fire... sent from my iPhone, made with love in san cupertino" nonsense in my own voice - literally sending their words into my chats using my account, as though I had written their marketing dreck
Of course this is doable on open source OSes like GrapheneOS, it just sucks that you have to keep modifying the OS every time they release a new version
At least it's open source, so maybe one can add root access and screenshot blocking to it.
That was the expectation of using the product so it fits and isn’t anything like this discussion.
This deserves a longer rant, but the very premise of Snapchat was always poisonous, and is largely responsible for why, 20 years later, we're now facing extreme proposals for regulating electronic communication.
I generally disagree with the whole line of criticism techies get for "solving social problems with technology", but if there's one unambiguous case where I'd agree it was plain stupid, it's the concept of screenshot prevention, that became prominent with Snapchat. Controlling whether your recipient gets to keep the message you sent them is a purely social problem, and the answer to that in the real world has always, for good reasons, been "once sent, it's no longer yours; once received, it belongs to recipient to do with as they please".
Wdym? Hooking (primarily underage) people onto "daily streaks" of sharing (often inappropriate) pictures of themselves to (sometimes random) other people via likely insecure servers is a _great_ business model!
Great customer retention. Lots and lots of engagement. So much shareholder value.
Oh and just think about how vulnerable they are. _Perfect_ for ads.
Yellow.
They fuckin did it. Not construction not a warning of some type. Not yellow pages. Yellow - cool looking yellow.
Is what I said to myself as a 20-something product designer
"Forget watermarks, I'm just going to let the person know! Ha!"
Each time I tried to take a screenshot of a password, the password was missing from the screenshot - even when I kept the control centre pulled down far enough that the Password app was starting to look blurry.
At least on rooted Android devices you can bypass that.
Having a follow button on the screenshot brings nothing and a logo is helpful when sharing (“hey it’s not twitter, I know it looks like it but it’s bluesky”) and looks subtle.
It’s just it’s a forum so people say things for discussions sake and get outraged by anything that a platform they don’t like is doing.
42 of their 56 active users might not care about a watermark but god dammit do they respect it
And so should you
One bad thing is pointing the finger at the wrong person. It lets the person doing the bad things get away with doing bad things.
Their product UI kind of looks like X, so it's helpful to know the source of a post
I’m worried that switching apps and screenshots _doesn’t_ put the logo in. If the point of the switch is privacy, isn’t that a bug? Shouldn’t it apply the privacy screen during any screenshot? What if there was sensitive information on there when you were switching and taking the screenshot?
Second - I hate when my device keeps me from anything. I'm used to have control over my computer, and this is outrageous that I can't take screenshots of anything I want. There should be a god mode or something like that.
Sent from my Ryobi Riding Lawnmower
I also have no issue with the API, people here are definitely overreacting to it’s existence.
I agree this can be defined as cool and very very likely someone did this on their free time/prompted Claude on the side.
https://github.com/GrapheneOS/os-issue-tracker/issues/664
Upvote the issue if so.
Does this indicate that the privacy feature has a gap, where you could reveal the length of your password if you take a screenshot mid app switch?
That said, operating systems should turn this into a user choice, and present a dialog to select the “protected” version or not.
It seems more appropriate for Claude to do it seeing as it generated the image, all Bluesky did is provide the platform to post it.
Oh, so you can take screenshots of the content that tries to avoid it if you do it mid-switch?
If it's reliable and WONTFIX, that's almost enough to get me to switch away from Android.
Screenshot taking prevention is harmful and should not have ever been allowed to become a platform-level feature in the first place. Because if there's one rule of platform/client interaction, is that if you add a feature that can be abused against customers for stupid reasons, it will be. There's a number of apps I have on my Android phone that block screenshots for dubious reasons, that can be maaaybe charitably explained by calling them "growth hacking pretending to be a security feature", but in some cases even that's a stretch.
This feature should never have existed in the first place.
(At least Bluesky is open about it, both by being Open Source and calling out the "growth hack" by name in source code.)
What does the author mean by this? I checked the repo and the project seems to be MIT licensed, which makes it open source.
When iPhone shipped, any time you emailed a photo it would append "Sent from my iPhone" to try to virally market. Same or at least similar slimey tactics
https://github.com/mozzius/expo-privacy-sensitive/blob/main/...
The workaround is letting that person take a photo of my phone, which is lower quality.
(a) the freedom to screenshot any content on your own device (b) the freedom to share content with others that cannot be screenshotted
It can be annoying when DRM or privacy features block a screenshot, but I think it can also benefit the platform ecosystem that you participate in as a user too. Idk!
Many people would find it inconvenient to find another device to take a picture with. And that manual picture would then have baked-in evidence that it was taken surreptitiously.
Locks keep honest people honest, as long as the app is up front about it and lets users make the choice, I don’t mind.