Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No boundaries: Exfiltration of personal data by session-replay scripts

freedom-to-tinker.com

Post reply on HN
Print view View original

11–20 of 57 posts

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#11

Post by ggg9990 »

phkahler wrote: post #6

DAMMIT. Once again the question that immediately come to mind is "Why the FUCK do browsers facilitate this shit?" C'mon you stupid web devs on HN tell me again all your excuses to need these capabilities. Sorry to generalize to all those of you who don't do this, but many of you still want those capabilities that have opened the door. And those browser devs... It's like they compete to sell out the users by adding "f…

Browsers became a way to deliver general-purpose applications over the Internet rather than just structured documents. Once they did, then all of the features that are being maliciously used here have very useful applications like responding to mouse input.

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#12

Post by acqq »

phkahler wrote: post #6

DAMMIT. Once again the question that immediately come to mind is "Why the FUCK do browsers facilitate this shit?" C'mon you stupid web devs on HN tell me again all your excuses to need these capabilities. Sorry to generalize to all those of you who don't do this, but many of you still want those capabilities that have opened the door. And those browser devs... It's like they compete to sell out the users by adding "f…

It's not "the browsers" it's primarly the culture of including "whatever" on the pages one maintains. It's so easy as it typically doesn't affect negatively those who decide to do so.

And it's typically not a decision of one person.

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#13

Post by kevinconroy »

+1 for highlighting the privacy concerns, but -1 for blaming the software for not having strong enough defaults.

As someone who has integrated FullStory into a production site, I spent several days doing a careful audit of our forms and redacting fields from being tracked. FullStory has an excellent, universal account setting to automatically redact fields based on any CSS selector, so it's very, very easy to tell it to remove any sensitive information - or even all form fields! - if that's what the website publisher desires. Out of the box I found that it correctly blocked credit card fields and passwords correctly, and we were able to add additional fields that are sensitive.

Again, rightly so that a website publisher may want more information than you desire, but they could also store your info in plaintext in the database, making it easy for hackers to exfiltrate as well. Yes, this is another vector, but hardly the easiest one.

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#14

Post by mindslight »

Home Depot does this in a way that consumes my whole upload bandwidth, dragging down the entire connection (moved and haven't gotten around to reintegrating the proper router with tc(8)). As a result, I've moved towards using Lowes to spec things out, even though it's a 45 minute drive and their products are of generally inferior quality. Good job, surveillance parasites - you're starting to kill your hosts!

(I'm sure Lowes is or will be doing something similar, as faux-competition duopolies tend to move in lockstep. But the outright callous boneheaded execution still amazes me).

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#15

Post by JoshMnem »

seiferteric wrote: post #2

Does anyone know if ublock origin blocks this kind of stuff? Yet another reason to never disable it. I'm starting to realize it's a lot more than an ad blocker, but more like a firewall to protect the client against malicious sites with crypto miners, trackers and this stuff...

Try umatrix.

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#16

Post by JoshMnem »

inetknght wrote: post #5
tzahola wrote: post #4

Is there a browser extension that warns you about the various tracker scripts a website is utilizing?

The closest I know of would be use of umatrix and general knowledge of which sites do what activities

Umatrix is great.

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#17

Post by michrassena »

acqq wrote: post #12
phkahler wrote: post #6

DAMMIT. Once again the question that immediately come to mind is "Why the FUCK do browsers facilitate this shit?" C'mon you stupid web devs on HN tell me again all your excuses to need these capabilities. Sorry to generalize to all those of you who don't do this, but many of you still want those capabilities that have opened the door. And those browser devs... It's like they compete to sell out the users by adding "f…

It's not "the browsers" it's primarly the culture of including "whatever" on the pages one maintains. It's so easy as it typically doesn't affect negatively those who decide to do so. And it's typically not a decision of one person.

I was giving this matter some thought early today after getting some stupid malware popup on my phone (where the phone vibrates, says it has lots of viruses, etc) while using Chrome. It wasn't even on any kind of dodgy site, but most likely it was part of a banner rotation for an ad network.

There has to be a way for website creators to sandbox content which comes from third parties. I think we have to accept that all of these ad networks and third-party scripts aren't going away, so until everyone uses adblocking, what can be done in the meantime?

It's problematic that including content from elsewhere in your page (like in an iframe) would grant it "first class" behavior with equivalent privileges to one's page. I know it's opening a can of worms, but why not implement a way to show untrusted content?

On the other side of things, I'm using a relatively recent version Chrome. Why is it vulnerable to this dumb sort of popup alert? Why can't I escape from it easily? The back button doesn't work. The UI hangs so I can't close the tab. If I close and re-open my browser it just re-opens my tabs.

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#20

Post by cotillion »

mschuster91 wrote: post #9
phkahler wrote: post #6

DAMMIT. Once again the question that immediately come to mind is "Why the FUCK do browsers facilitate this shit?" C'mon you stupid web devs on HN tell me again all your excuses to need these capabilities. Sorry to generalize to all those of you who don't do this, but many of you still want those capabilities that have opened the door. And those browser devs... It's like they compete to sell out the users by adding "f…

> but many of you still want those capabilities that have opened the door Rest assured the majority of (web) developers does not like this crap a bit. Most of the pressure to add hundreds of analytics toolkits, trackers or these snoopers come from marketing - they (or worse, the C-level execs) get convinced that they need to integrate tool XYZ to "stay competitive" or "improve their customer retention" or whatever bu…

Sometimes its just laziness.

I was forced to add GTM to a site because it meant marketing could just hand over the GTM login and a pile of money to another company which could then provide them with pretty reports on what the customers were doing. The analytics company promised to not do anything bad so it was OK.

And that was after an incident where the entire site was turned purple by another external JavaScript...

Post reply on HN