Customer Service Agents Can See What You're Typing in Real Time • Hacker News Board

Re: Customer Service Agents Can See What You're Typing in Real Time

#111

Post by jacobsenscott » Wed, Jan 23, 2019, 11:06 PM UTC

ploxiln wrote: post #90

jacobsenscott wrote: post #70

Earlier quoted context omitted.

I don't think anyone is surprised, but it is still good to call out bad actors from time to time. Whenever there's a story like this every hn response is "always assume you are being watched at all times!" - but nobody can maintain that kind of hyper vigilance forever, and it isn't a healthy way to live.

It's healthy to not use autofill, and to not have your password manager integrate with your browser, and to use an ad blocker that blocks analytics stuff including intercom, segment, etc.

Yes. Do all that stuff. You're still being watched at all times.

Re: Customer Service Agents Can See What You're Typing in Real Time

#112

Post by abugheratwork » Wed, Jan 23, 2019, 11:07 PM UTC

btrettel wrote: post #93

baroffoos wrote: post #69

Earlier quoted context omitted.

Firefox does it for passwords if you pick to save your password but other fields I just have to double click the field and it drops down with a list of things I have put in it before.

Is there a way to change Firefox's behavior for passwords so that I need to click to fill them in? I couldn't find anything in a quick Google search.

Password should be saved per-site. Like, I think they actually are.

Re: Customer Service Agents Can See What You're Typing in Real Time

#113

Post by stordoff » Wed, Jan 23, 2019, 11:08 PM UTC

noxToken wrote: post #33

sbuttgereit wrote: post #10

I'm confused why this is news or surprising? At least for the audience here. I remember plugins for various IM clients would do the same thing in a chat window some decades ago. And I remember my days as a sysop in the good old single line dial up BBS days. You could watch users browse and type all the way back in the mid-80's and I'm sure this has existed about as long as multi-user computers have. If you're typing…

The older IM clients (AIM, MSN, Yahoo, et al.) could tell you if someone was typing or entered unsent text, but it never previewed what had been typed. At least that wasn't a default option back then.

Modern IM clients do the same. I noticed WhatsApp saying "+44... is typing..." earlier.

Re: Customer Service Agents Can See What You're Typing in Real Time

#114

Post by laumars » Wed, Jan 23, 2019, 11:08 PM UTC

lolc wrote: post #100

laumars wrote: post #83

Earlier quoted context omitted.

People give off all kinds of messages they don’t realise; from facial expressions and other forms of body language to the tone and volume of their speech. We are forever communicating far more information then we ever intend to and people who deal with customers are trained how to read those tells so they can better handle customers temperament as well as their spoken requirements. You lose so much with typed text wh…

You don't sneakily access other people's draft thoughts without very explicitly asking for permission. The eavesdroppers are not reciprocating and sharing their typing either. They're not only creating an asymmetry: they're actively hiding it!

It's not the sort of environment you want asymmetry. You want the customer services to be infallible - and by "you" I don't just mean company execs but also us customers who want to feel like we've been treated appropriately.

Anyone who's ever done a stint on 1st line tech support will understand just how much of a thankless job it is. If this helps them to serve me better then I welcome it.

I think the real complaint being made is that you didn't realise they were using these visual clues. But that's why I keep coming back to how other forms of customer services are trained to read vocal tones and body language. Would you also feel cheated if you learned your favourite high street store's customer services team had training on reading body language while you hadn't so they have an advantage in gauging your temperament but they didn't let on they had that training?

Don't get me wrong, I do see and understand your point. I'm very privacy minded so this is the kind of thing I'd normally get annoyed by as well. But at least this time the anti-privacy tools are genuinely being used to improve customer experience rather than just to monetise them (yes I know good customer experience can lead to repeat custom - but more often than privacy is sold to the detriment of customer experience)

Re: Customer Service Agents Can See What You're Typing in Real Time

#115

Post by bradknowles » Wed, Jan 23, 2019, 11:10 PM UTC

lucb1e wrote: post #109

Cacti wrote: post #37

Earlier quoted context omitted.

If the site is using SSL, there is a reasonable expectation that only the server will see that data, not the entire world.

TLS has very little to do with it. Some intermediary parties may be able to read the plaintext, but that's different from putting it on pastebin for everyone to see. I've never heard of ISPs or transit providers publishing privacy-sensitive data or otherwise snooping on it. (Assuming non-business / non-VPN / non-proxy connections. Just an ordinary internet connection.) The author probably meant if the site gets/is ha…

Many high-profile commercial carriers will do deep packet inspection of the traffic from their end users, so that they can do insertion of their own ads into whatever content you may be surfing. Including on your webmail pages.

And their ad networks might well be infected with malware. But because of deep packet inspection and editing, you can't tell that the malvertising in question actually came from AT&T or Spectrum instead of Gmail.

Re: Customer Service Agents Can See What You're Typing in Real Time

#116

Post by bradknowles » Wed, Jan 23, 2019, 11:11 PM UTC

jacurtis wrote: post #60

Cacti wrote: post #37

Earlier quoted context omitted.

If the site is using SSL, there is a reasonable expectation that only the server will see that data, not the entire world.

Well you aren't wrong. I mean technically speaking if there is an SSL certificate, than in fact you are directly connected to the server and no one is in between. The difference is that if I own the server, I can see your information even though it was a direct server connection. You directly fed the information to me. That is what is happening in these scenerios.

Nah, there are hundreds of CAs out there. People could get their SSL certs from any one of them and MITM all your supposedly secure web traffic.

And plenty of ISPs will do exactly that, if you give them half a chance.

Re: Customer Service Agents Can See What You're Typing in Real Time

#117

Post by csours » Wed, Jan 23, 2019, 11:12 PM UTC

WestCoastJustin wrote: post #61

Jerry2 wrote: post #47

Another thing people don't realize is that if your browser/extension prefills/autofills certain fields (say, name, email, address, etc), those things can be easily sent to the website even if you don't press the submit button. https://www.theguardian.com/technology/2017/jan/10/browser-a...

Had this happen about 2 weeks ago when I was booking a hotel. This was not a chat window, like the article, but a hotel booking form. I had a few tabs open and filled in the booking information but found something a little more convenient. So, I did not submit the form and closed the tab. About 2-3 minutes later my phone started to ring. It was a customer service agent from that incomplete booking website asking if I…

I had a workmate mock order some stickers and put in their boss's email, but did not submit. That evening, the boss got an email with the order, and the boss bought them (they were previously informed of the idea), thinking the employee had sent the order over.

Re: Customer Service Agents Can See What You're Typing in Real Time

#118

Post by bradknowles » Wed, Jan 23, 2019, 11:13 PM UTC

russley wrote: post #43

sbuttgereit wrote: post #10

I'm confused why this is news or surprising? At least for the audience here. I remember plugins for various IM clients would do the same thing in a chat window some decades ago. And I remember my days as a sysop in the good old single line dial up BBS days. You could watch users browse and type all the way back in the mid-80's and I'm sure this has existed about as long as multi-user computers have. If you're typing…

I think a lot of it has to do with consumer expectations. We can all sit here and laugh and act unsurprised, but technology has conditioned users that the response isn't sent until you press "Send". Its bad (and I'd argue harmful) UX. Imagine this scenario: Copying and pasting a debug log, realizing it contains personal or important information (such as password, SSN, or anything else) and it is sent to the agent bef…

Of course it's malicious. But it's so profitable!

Re: Customer Service Agents Can See What You're Typing in Real Time

#119

Post by purple_ducks » Wed, Jan 23, 2019, 11:20 PM UTC

lunaru wrote: post #85

Before rolling out this exact feature in our own chat product we resisted doing so because of the concerns being echoed here. However, it was becoming obvious from the demands from our users that this was make-or-break feature in a modern chat system. After rolling it out and enjoying this for ourselves as we handle our own customer support using our own software, it's become a "why didn't we do this earlier?" type o…

> "why didn't we do this earlier?"

Because it's invasive.

The user consents to sending you information when they hit Send(explicit). They can remove any incorrect or unrelated information from the text box before they do so.

Especially if they paste in to the text box and inadvertently paste the wrong thing(be that sensitive info or similar).

Re: Customer Service Agents Can See What You're Typing in Real Time

#120

Post by abugheratwork » Wed, Jan 23, 2019, 11:22 PM UTC

russley wrote: post #43

sbuttgereit wrote: post #10

I'm confused why this is news or surprising? At least for the audience here. I remember plugins for various IM clients would do the same thing in a chat window some decades ago. And I remember my days as a sysop in the good old single line dial up BBS days. You could watch users browse and type all the way back in the mid-80's and I'm sure this has existed about as long as multi-user computers have. If you're typing…

I think a lot of it has to do with consumer expectations. We can all sit here and laugh and act unsurprised, but technology has conditioned users that the response isn't sent until you press "Send". Its bad (and I'd argue harmful) UX. Imagine this scenario: Copying and pasting a debug log, realizing it contains personal or important information (such as password, SSN, or anything else) and it is sent to the agent bef…

I think you're right. I also think the browser, as your agent, should enforce expectations. "This website wants to upload data. Allow? [Once] [Always] [No] [Click here to see the data.]"