Is there a browser extension that warns you about the various tracker scripts a website is utilizing?
[deleted]
No boundaries: Exfiltration of personal data by session-replay scripts
51–57 of 57 posts
Re: No boundaries: Exfiltration of personal data by session-replay scripts
#52Earlier quoted context omitted.
Ok, here's a real example of how fullstory can help provide a better product. Bug reporting. A user gets a JS error on the page, but say my application is pretty complex, and the state machine I've built can't handle a particular state. Well, I can easily walk through the recording of what the user had done and reproduce the issue. I can actually hop on a call with this user and walk them through how to do something,…
+1 - having session recordings is a HUGE win to help track down hard-to-reproduce bugs. You can get the strangest bug reports, and by watching the session, as a dev, you can instantly translate it into the technical terms that the end user lacked and you can fix the problem. It's also great for ad-hoc usability testing to see how people are using your features, where they slow down to read, what elements they try to…
You guys are illustrating my point nicely. I have no doubt that session recording is very helpful in your debugging activity, and provides feedback for site design. The problem is that those capabilities are often used against the user as well. The people who enabled you to do that also enabled others to do bad things. The attack surface has been hugely increased in the name of convenience for developers. Remember, with the internet the whole world is on your doorstep and that doesn't consist of just developers trying to get their UX right.
Re: No boundaries: Exfiltration of personal data by session-replay scripts
#53Earlier quoted context omitted.
I was giving this matter some thought early today after getting some stupid malware popup on my phone (where the phone vibrates, says it has lots of viruses, etc) while using Chrome. It wasn't even on any kind of dodgy site, but most likely it was part of a banner rotation for an ad network. There has to be a way for website creators to sandbox content which comes from third parties. I think we have to accept that al…
There's some limited ways to sandbox with iframes. https://www.w3schools.com/tags/att_iframe_sandbox.asp
This is something I was hoping would be possible in the future, but didn't realize an implementation was already in place. I'm surprised I've never heard of it.
There's one problem though. Here's how it should be implemented, in my opinion.
I disagree with making security opt-in.
Re: No boundaries: Exfiltration of personal data by session-replay scripts
#54Earlier quoted context omitted.
Hi, one of the authors here. We discuss this in the last section of the post. uBlock Origin uses lists to determine which requests to block. We tested the two largest, EasyList and EasyPrivacy, and both fail to block scripts from FullStory, Smartlook, and UserReplay.
I checked the hosts file I normally use (MVPS) and they don't seem to be in there either, unless they serve the scripts from a non-obvious domain. Also fun fact, TurboTax uses SmartLook.
That doesn't seem very problematic to me. You are anyway trusting TurboTax with a bunch of sensitive information.
Re: No boundaries: Exfiltration of personal data by session-replay scripts
#55+1 for highlighting the privacy concerns, but -1 for blaming the software for not having strong enough defaults. As someone who has integrated FullStory into a production site, I spent several days doing a careful audit of our forms and redacting fields from being tracked. FullStory has an excellent, universal account setting to automatically redact fields based on any CSS selector, so it's very, very easy to tell it…
What would be the problem with making the default to collect nothing (so the dev would have to opt in for everything they wanted to collect)?
Re: No boundaries: Exfiltration of personal data by session-replay scripts
#56Earlier quoted context omitted.
I guess what I find frustrating is that it's the same class of problem as Captain Crunch's whistle, in-band control. But, I think we're getting to the point where it has to be sandboxes all the way down (running things in sandboxes, inside of VMs, with memory protection, etc). But it's still not enough. This class of problem must be extremely difficult to solve. How do you run Turing-complete code which might be host…
> How do you run Turing-complete code which might be hostile? That's the key problem that (almost) nobody wants to talk about. We've been trying to solve the decision problem for a long time, and we already know that even relatively simple problems are provably undecidable[1]. Any real program will be much more complex[2]. An unknown program could generate any output it wants and we cannot know that without running i…
You make a lot of good points. I agree, there's no going back. The websites we have today offer too much functionality to ever go back to the way things were. While I like the ability to turn off JavaScript on a page by page basis, and use the web mostly as a library, most people would be completely put off by a "dumb" Web.
Re: No boundaries: Exfiltration of personal data by session-replay scripts
#57Earlier quoted context omitted.
I checked the hosts file I normally use (MVPS) and they don't seem to be in there either, unless they serve the scripts from a non-obvious domain. Also fun fact, TurboTax uses SmartLook.
That doesn't seem very problematic to me. You are anyway trusting TurboTax with a bunch of sensitive information.
Yes, but you may not realize that SmartLook is also getting all that information.