Stories
Slash Boxes
Comments

SoylentNews is people

posted by Fnord666 on Saturday November 18 2017, @10:18PM   Printer-friendly
from the monkey-see-monkey-do dept.

The Freedom to Tinker has a post on using Javascript to facilitate the exfiltration of personal data by session-replay scripts.

You may know that most websites have third-party analytics scripts that record which pages you visit and the searches you make. But lately, more and more sites use "session replay" scripts. These scripts record your keystrokes, mouse movements, and scrolling behavior, along with the entire contents of the pages you visit, and send them to third-party servers. Unlike typical analytics services that provide aggregate statistics, these scripts are intended for the recording and playback of individual browsing sessions, as if someone is looking over your shoulder.

The stated purpose of this data collection includes gathering insights into how users interact with websites and discovering broken or confusing pages. However the extent of data collected by these services far exceeds user expectations [1]; text typed into forms is collected before the user submits the form, and precise mouse movements are saved, all without any visual indication to the user. This data can't reasonably be expected to be kept anonymous. In fact, some companies allow publishers to explicitly link recordings to a user's real identity.

Though the post refers to scripts added by the web server intentionally, if third party, such an ISP, competiting company, or government agency, is in control of a certificate already loaded into a target's browser, either overtly or covertly, a Man-in-the-Middle attack is trivial with SSL/TLS and exfiltration scripts can be sent as payload. If you want to see the latency burden that even ostensibly well-behaved scripts cause, press ctrl-shift-i in the browser, select "network" and then reload the page.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 0) by Anonymous Coward on Sunday November 19 2017, @07:06AM (1 child)

    by Anonymous Coward on Sunday November 19 2017, @07:06AM (#598868)

    Pascal doesn't care about case.

    Old-style programmers stick to UPPERCASENAMES. Decent modern programmers use lowercasenames, or even lower_case_names if the compiler allows it.

    Realistically, you can expect to find inconsistent case within a program: myVariableName MyVariableName MYVARIABLENAME myvariablename Myvariablename

  • (Score: 0) by Anonymous Coward on Sunday November 19 2017, @07:02PM

    by Anonymous Coward on Sunday November 19 2017, @07:02PM (#599007)

    You call it inconsistent, I call it coding style. UPPERCASE for #defines, camelCase for variables, and PascalCase for class names.