This has been the case since at least 2003... The agents also see you page history, search terms, can cobrowse with you to show you things. Anything to make them quicker and more effective is implemented.
Customer Service Agents Can See What You're Typing in Real Time
101–110 of 174 posts
Re: Customer Service Agents Can See What You're Typing in Real Time
#102Earlier quoted context omitted.
I don't think anyone is surprised, but it is still good to call out bad actors from time to time. Whenever there's a story like this every hn response is "always assume you are being watched at all times!" - but nobody can maintain that kind of hyper vigilance forever, and it isn't a healthy way to live.
It's healthy to not use autofill, and to not have your password manager integrate with your browser, and to use an ad blocker that blocks analytics stuff including intercom, segment, etc.
Blocking intercom? Intercom doesn’t do creepy stuff.
Re: Customer Service Agents Can See What You're Typing in Real Time
#103I wish that it was more prevalent for people to just assume and know that any website, regardless of whether or not it has a chat function, has the ability to record what you're saying (read: typing). Everyone out there should act like everything they type into their web browser has the potential to be seen by, at the very least, the website they're typing it on and, at worst, by everyone online. If you really need t…
I don't think anyone is surprised, but it is still good to call out bad actors from time to time. Whenever there's a story like this every hn response is "always assume you are being watched at all times!" - but nobody can maintain that kind of hyper vigilance forever, and it isn't a healthy way to live.
>I don't think anyone is surprised
I do. Nobody who goes on HN will be. But the layman who spends 80 hours a week working a minimum wage job who has no time for computers and just wants a Disney vacation for his kids, absolutely would be floored by this. It seems very reasonable to apply conventional logic to computers. You can write all you want on a piece of paper and then throw it away and nobody would see it. The same doesn't apply on the internet, but it's not a big leap for people who barely know how to log in.
Re: Customer Service Agents Can See What You're Typing in Real Time
#104Earlier quoted context omitted.
CSS can send HTTP requests without JavaScript? How does that work?
Yes, it can. Consider https://www.smashingmagazine.com/2014/10/css-only-solution-f... for example.
Thanks!
That page does say this:
The problem with this kind of CSS UI tracking is that we get only the first occurrence of the event. For example, take the :active pseudo class example. The request for the background image is fired only once. If we need to capture every click then, we have to change the URL, which is not possible without JavaScript.
It's also not clear to me how you could capture any keystrokes with this technique. Still, I did find it interesting.
Re: Customer Service Agents Can See What You're Typing in Real Time
#105Earlier quoted context omitted.
CSS can send HTTP requests without JavaScript? How does that work?
Yes, it can. Consider https://www.smashingmagazine.com/2014/10/css-only-solution-f... for example.
Actually, it appears CSS is getting a new `attr` function, it looks like with that you might be able to just completely break security, consider...
input[value] {
background-image: attr(value url, 'no-input');
}
Re: Customer Service Agents Can See What You're Typing in Real Time
#106This is not a problem
That's not a very insightful comment.
Re: Customer Service Agents Can See What You're Typing in Real Time
#107When doing support over chat it is nice to see ahead of time what they are saying to allow for a faster response.
Would be cool if one could be informed about it, though.
Imagine if on the phone, you would have to hold down a button to talk. At the end of the recording, you're given the change to edit any mumblings, rephrase things, or start all over. If it later turned out that the other end can hear every word, that is probably surprising to the vast majority of people.
Re: Customer Service Agents Can See What You're Typing in Real Time
#108Earlier quoted context omitted.
It's amazing this still works in Chrome. Open https://anttiviljami.github.io/browser-autofill-phishing/ , enter some auto-fill info, click "Submit" and monitor your "Network" tab requests. You'll find your browser leaked way more info than those 2 information...
scary... is there any valid scenario where user expects browser to auto-fill the hidden fields?
Just pretty difficult to ensure a field really is visible to the user, the problem is it'll always have some weaknesses and those who would abuse it will find those weaknesses
Re: Customer Service Agents Can See What You're Typing in Real Time
#109I wish that it was more prevalent for people to just assume and know that any website, regardless of whether or not it has a chat function, has the ability to record what you're saying (read: typing). Everyone out there should act like everything they type into their web browser has the potential to be seen by, at the very least, the website they're typing it on and, at worst, by everyone online. If you really need t…
If the site is using SSL, there is a reasonable expectation that only the server will see that data, not the entire world.
TLS has very little to do with it. Some intermediary parties may be able to read the plaintext, but that's different from putting it on pastebin for everyone to see. I've never heard of ISPs or transit providers publishing privacy-sensitive data or otherwise snooping on it. (Assuming non-business / non-VPN / non-proxy connections. Just an ordinary internet connection.)
The author probably meant if the site gets/is hacked, or if they are later bought by another company, or if a new employee joins and you can see chat history... etc.
Re: Customer Service Agents Can See What You're Typing in Real Time
#110Perhaps it's time for more granular Javascript blocking. Since forever it's been 'Enable Javascript yes / no'. This makes no real world sense to me anymore (if it ever did). Could there be an end-user friendly way to tell a browser to block Javascript that transmits your 'pre-submit' activity on a web site without breaking the site?
No (imo). It'll be impossible to tell that apart from legitimate usage. JS can access the input fields, garble them, and send to the server. How would you tell that apart from say, a ticker request to update real-time prices?