Customer Service Agents Can See What You're Typing in Real Time • Hacker News Board

Re: Customer Service Agents Can See What You're Typing in Real Time

#141

Post by ploxiln » Thu, Jan 24, 2019, 12:57 AM UTC

geofft wrote: post #129

ploxiln wrote: post #90

Earlier quoted context omitted.

It's healthy to not use autofill, and to not have your password manager integrate with your browser, and to use an ad blocker that blocks analytics stuff including intercom, segment, etc.

Having your password manager integrate with your browser is one of the best defenses against phishing, though. It will only fill the password if the origin matches.

... or if there's a bug, or if the bridge from the extension to the page content has a mistake that lets javascript on the page control it.

That's actually happened to all the major vendors like LastPass and OnePass, and to some of them it's happened the exact same way multiple times - a UI re-design re-introduces the same JS interop mistake.

some linky links: https://twitter.com/taviso/status/941711305668411393 https://twitter.com/taviso/status/769378052254015488

I've promoted password managers for a long time! Just not fancy convenient commercial ones, those are a huge mistake.

Re: Customer Service Agents Can See What You're Typing in Real Time

#142

Post by chrischen » Thu, Jan 24, 2019, 12:57 AM UTC

bcx wrote: post #4

Alupis wrote: post #2

I always suspected this. Particularly when you're typing something long-winded, and the agent's response is a bit too quick for having to read it all. Although, this will certainly depend on the Chat software used. Back when we used Olark at our company, there was no preview available, although we could "co-browse" and redirect the user's webpage, which was helpful in some cases.

We (Olark) specifically decided not to implement the "read-ahead" or "sneak-peak" feature because we thought it was creepy and broke customer expectations. When you are typing a message to customer service as a customer you should have a chance to compose your thoughts, and should have an expectation of privacy in whatever you are writing before hitting enter.

Just to add a counterpoint, I handle a lot of customer service and the service provider I use happens to have this feature by default, and it drastically helps me to respond faster to customers. To date I haven't had anyone consider this an issue (even when I've accidentally sent a response before they even sent their message! - they just end up deleting their text and saying "thank you")

Re: Customer Service Agents Can See What You're Typing in Real Time

#143

Post by retsibsi » Thu, Jan 24, 2019, 1:00 AM UTC

Finch2193 wrote: post #103

jacobsenscott wrote: post #70

Earlier quoted context omitted.

I don't think anyone is surprised, but it is still good to call out bad actors from time to time. Whenever there's a story like this every hn response is "always assume you are being watched at all times!" - but nobody can maintain that kind of hyper vigilance forever, and it isn't a healthy way to live.

>I don't think anyone is surprised I do. Nobody who goes on HN will be. But the layman who spends 80 hours a week working a minimum wage job who has no time for computers and just wants a Disney vacation for his kids, absolutely would be floored by this. It seems very reasonable to apply conventional logic to computers. You can write all you want on a piece of paper and then throw it away and nobody would see it. The…

> Nobody who goes on HN will be

I go on HN, and although I'm not surprised that this is possible, nor shocked that it's done, it is the kind of thing I could easily fail to think about, or assume is probably not actually being done by anyone I deal with.

Re: Customer Service Agents Can See What You're Typing in Real Time

#144

Post by chrischen » Thu, Jan 24, 2019, 1:01 AM UTC

somebodythere wrote: post #99

rhizome wrote: post #45

As I post this, every comment is "Derp if you're surprised, I mean this is how every site is. GOSH." However, you sure don't see this in the e.g. Munchery shutdown story. "90% (or whatever) of all startups fail, big whoop. Everybody with a decent understanding of business knows this."

It's not even true. This behaviour is not obvious at all. No consumer messaging application allows you to see what the other person is typing before they have sent it.

This is quite different from a consumer messaging application. It's a website's customer support chat.

Re: Customer Service Agents Can See What You're Typing in Real Time

#145

Post by tdaltonc » Thu, Jan 24, 2019, 1:02 AM UTC

jacobsenscott wrote: post #70

dpkonofa wrote: post #29

I wish that it was more prevalent for people to just assume and know that any website, regardless of whether or not it has a chat function, has the ability to record what you're saying (read: typing). Everyone out there should act like everything they type into their web browser has the potential to be seen by, at the very least, the website they're typing it on and, at worst, by everyone online. If you really need t…

I don't think anyone is surprised, but it is still good to call out bad actors from time to time. Whenever there's a story like this every hn response is "always assume you are being watched at all times!" - but nobody can maintain that kind of hyper vigilance forever, and it isn't a healthy way to live.

I don't think that the company "exposed" in the article is a bad actor. Seems like a helpful and reasonable thing to do.

Re: Customer Service Agents Can See What You're Typing in Real Time

#146

Post by chrischen » Thu, Jan 24, 2019, 1:03 AM UTC

purple_ducks wrote: post #119

lunaru wrote: post #85

Before rolling out this exact feature in our own chat product we resisted doing so because of the concerns being echoed here. However, it was becoming obvious from the demands from our users that this was make-or-break feature in a modern chat system. After rolling it out and enjoying this for ourselves as we handle our own customer support using our own software, it's become a "why didn't we do this earlier?" type o…

> "why didn't we do this earlier?" Because it's invasive. The user consents to sending you information when they hit Send(explicit). They can remove any incorrect or unrelated information from the text box before they do so. Especially if they paste in to the text box and inadvertently paste the wrong thing(be that sensitive info or similar).

I use a chat service that has this feature on by default (for real-time chat customer support, not for general messaging), and never in the history of its usage has a person complained about it. For every 10,000 people that may not have an issue with it, 1 may have an issue about it, and with these numbers it's really up to that 1 person to guard their privacy better (disable JS, never step outside their house, etc) than to inconvenience 9,999 other people from the benefits.

The experience is all in the context, and since this is only general behavior for customer service chats (where you're expected to send everything you type and the other end is simply trying to help resolve an issue), it's not really a realistic issue in terms of privacy. I agree that if facebook messenger started doing this and showed the other person what you are typing, this would be unexpected and potentially unwanted behavior, but the likelihood of unwanted behavior in a customer support context is extremely rare.

Re: Customer Service Agents Can See What You're Typing in Real Time

#147

Post by baroffoos » Thu, Jan 24, 2019, 1:04 AM UTC

btrettel wrote: post #128

abugheratwork wrote: post #112

Earlier quoted context omitted.

Password should be saved per-site. Like, I think they actually are.

You're right, that mitigates most of the risk. Firefox seems to save passwords per domain name. This may not be specific enough in certain cases. E.g., if I have a password on domain.com, but domain.com offers web hosting at domain.com/username, then my understanding is it would be relatively easy to obtain my credentials for domain.com with the right phishing site at domain.com/username. Correct me if I'm wrong.

The entire web security model breaks down in this case. No web hosting except the most hacked together system does this. They all provide sub domains or sanitize the content so it can't run any code. Like the sibling comment pointed out, you could just use JS to grab your login cookie from the other site.

Re: Customer Service Agents Can See What You're Typing in Real Time

#148

Post by chrischen » Thu, Jan 24, 2019, 1:08 AM UTC

AnimalMuppet wrote: post #28

sp821543 wrote: post #24

What an amazing opportunity for trolling support staff :)

It is. But... you're actually going to want help from them, so trolling them might not be in your best interest. A related maxim: "Never be rude to an airline gate agent."

Or any support person for that matter. What baffles me is people who think having a terrible attitude can get them what they want. The support person either has lee-way or not, and if they do, they probably will be less likely to help you if you're an asshole.

Re: Customer Service Agents Can See What You're Typing in Real Time

#149

Post by btrettel » Thu, Jan 24, 2019, 1:35 AM UTC

baroffoos wrote: post #147

btrettel wrote: post #128

Earlier quoted context omitted.

You're right, that mitigates most of the risk. Firefox seems to save passwords per domain name. This may not be specific enough in certain cases. E.g., if I have a password on domain.com, but domain.com offers web hosting at domain.com/username, then my understanding is it would be relatively easy to obtain my credentials for domain.com with the right phishing site at domain.com/username. Correct me if I'm wrong.

The entire web security model breaks down in this case. No web hosting except the most hacked together system does this. They all provide sub domains or sanitize the content so it can't run any code. Like the sibling comment pointed out, you could just use JS to grab your login cookie from the other site.

Good points. Unfortunately there are a lot of "hacked together" services out there.

I can think of one site I had to use recently for event registration which suffered from the flaw I mentioned. (Note that I have no choice over which service to use here, as I don't run the event.) The site puts each event under different directories, not subdomains as it should. Firefox saved my login details for one past event and wanted to use them for another event. I don't know the extent by which the event pages can be customized, but if you could put the right JS on one event page then it seems there are multiple approaches to getting credentials and potentially obtaining sensitive information. Fortunately in this case an attacker wouldn't obtain much of value best I can tell.

Re: Customer Service Agents Can See What You're Typing in Real Time

#150

Post by wongarsu » Thu, Jan 24, 2019, 1:56 AM UTC

Cacti wrote: post #37

dpkonofa wrote: post #29

I wish that it was more prevalent for people to just assume and know that any website, regardless of whether or not it has a chat function, has the ability to record what you're saying (read: typing). Everyone out there should act like everything they type into their web browser has the potential to be seen by, at the very least, the website they're typing it on and, at worst, by everyone online. If you really need t…

If the site is using SSL, there is a reasonable expectation that only the server will see that data, not the entire world.

If they log keystrokes (for security, UX research or whatever) there's a good chance that they send enough packets to allow an attacker to infer a lot just from observing frequency and length of packets.