Stories
Slash Boxes
Comments

SoylentNews is people

posted by Fnord666 on Saturday November 18 2017, @10:18PM   Printer-friendly
from the monkey-see-monkey-do dept.

The Freedom to Tinker has a post on using Javascript to facilitate the exfiltration of personal data by session-replay scripts.

You may know that most websites have third-party analytics scripts that record which pages you visit and the searches you make. But lately, more and more sites use "session replay" scripts. These scripts record your keystrokes, mouse movements, and scrolling behavior, along with the entire contents of the pages you visit, and send them to third-party servers. Unlike typical analytics services that provide aggregate statistics, these scripts are intended for the recording and playback of individual browsing sessions, as if someone is looking over your shoulder.

The stated purpose of this data collection includes gathering insights into how users interact with websites and discovering broken or confusing pages. However the extent of data collected by these services far exceeds user expectations [1]; text typed into forms is collected before the user submits the form, and precise mouse movements are saved, all without any visual indication to the user. This data can't reasonably be expected to be kept anonymous. In fact, some companies allow publishers to explicitly link recordings to a user's real identity.

Though the post refers to scripts added by the web server intentionally, if third party, such an ISP, competiting company, or government agency, is in control of a certificate already loaded into a target's browser, either overtly or covertly, a Man-in-the-Middle attack is trivial with SSL/TLS and exfiltration scripts can be sent as payload. If you want to see the latency burden that even ostensibly well-behaved scripts cause, press ctrl-shift-i in the browser, select "network" and then reload the page.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by Pino P on Sunday November 19 2017, @11:32PM (1 child)

    by Pino P (4721) on Sunday November 19 2017, @11:32PM (#599062) Journal

    If a page|site is completely useless without scripts, it's junk.

    Would you prefer a site that is functional with scripts but shows only a "Download our native app" notice without them?

    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2  
  • (Score: 1, Insightful) by Anonymous Coward on Monday November 20 2017, @12:54AM

    by Anonymous Coward on Monday November 20 2017, @12:54AM (#599080)

    I thought that I had already made it clear that I want an HTML page that will work in any browser.

    Download our native app

    That doesn't require a script.
    A plain old hyperlink will do.
    ...which is the whole point.

    Oh, wait. I remember you.
    You're one of those nitwits who think that an "intellectual property" owner is never wrong.

    -- OriginalOwner_ [soylentnews.org]