Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No boundaries: Exfiltration of personal data by session-replay scripts

freedom-to-tinker.com

Post reply on HN
Print view View original

21–30 of 57 posts

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#21

Post by ptaffs »

acqq wrote: post #12
phkahler wrote: post #6

DAMMIT. Once again the question that immediately come to mind is "Why the FUCK do browsers facilitate this shit?" C'mon you stupid web devs on HN tell me again all your excuses to need these capabilities. Sorry to generalize to all those of you who don't do this, but many of you still want those capabilities that have opened the door. And those browser devs... It's like they compete to sell out the users by adding "f…

It's not "the browsers" it's primarly the culture of including "whatever" on the pages one maintains. It's so easy as it typically doesn't affect negatively those who decide to do so. And it's typically not a decision of one person.

Agreeing with you. Customer service sites are prime targets for solutions where JavaScript is used to enable training, screen sharing, user tracking and advertising, and the up-side is so compelling, especially to non-technical customer service operations managers "those who decide to do so", that they can't conceive of how this little widget can scrape the whole screen, or worse, be maliciously tipped to steal or inject information. The site owners are at fault, but also the browsers should make it easier to disable active content. We can presume that most users aren't discerning, but I'd switch to both plain text e-mail and plain-text browsing, if possible, switching to bloated sites when i can't find an alternative, and like the other comment here, using Lowes instead of Home Depot because their site is less awful. I'll be sharing the link to No Boundaries page next time i'm talking with someone who wants to add a tracking feature to a page.

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#22

Post by mschuster91 »

cotillion wrote: post #20
mschuster91 wrote: post #9

Earlier quoted context omitted.

> but many of you still want those capabilities that have opened the door Rest assured the majority of (web) developers does not like this crap a bit. Most of the pressure to add hundreds of analytics toolkits, trackers or these snoopers come from marketing - they (or worse, the C-level execs) get convinced that they need to integrate tool XYZ to "stay competitive" or "improve their customer retention" or whatever bu…

Sometimes its just laziness. I was forced to add GTM to a site because it meant marketing could just hand over the GTM login and a pile of money to another company which could then provide them with pretty reports on what the customers were doing. The analytics company promised to not do anything bad so it was OK. And that was after an incident where the entire site was turned purple by another external JavaScript...

> And that was after an incident where the entire site was turned purple by another external JavaScript...

lol, what was the root cause? Defacement/scriptkiddie attack or a "background covering" ad that did not recognize the content area and paint over the whole screen instead?

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#23

Post by phkahler »

michrassena wrote: post #17
acqq wrote: post #12

Earlier quoted context omitted.

It's not "the browsers" it's primarly the culture of including "whatever" on the pages one maintains. It's so easy as it typically doesn't affect negatively those who decide to do so. And it's typically not a decision of one person.

I was giving this matter some thought early today after getting some stupid malware popup on my phone (where the phone vibrates, says it has lots of viruses, etc) while using Chrome. It wasn't even on any kind of dodgy site, but most likely it was part of a banner rotation for an ad network. There has to be a way for website creators to sandbox content which comes from third parties. I think we have to accept that al…

Several parts of your comment resonate with me:

>> There has to be a way for website creators to sandbox content which comes from third parties.

The whole 3rd party thing came about because advertisers needed to establish both ad-distribution and trust (they rightly don't want to pay for ads unless they're actually shown etc...).

>> It's problematic that including content from elsewhere in your page (like in an iframe) would grant it "first class" behavior with equivalent privileges to one's page.

I agree, this one is on the browser devs and the standard creators. Safety by default is the way to go but then people have nifty ideas that would not be possible with limitations.

>> I know it's opening a can of worms, but why not implement a way to show untrusted content?

That's exactly what the browser is supposed to be in the first place.

>> Why can't I escape from it easily? The back button doesn't work.

Because browser devs decided there was some reason the content should be able to alter or override the design of the viewer. I can think of no legitimate (to the user) use case for this. The list of stuff like this is long and ridiculous. They keep doubling down on it too. First we had cookies, but that wasn't enough so now there's a whole client-side database...

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#24

Post by scarmig »

itissid wrote: post #18

Read the article. Noob Q. Surely not ALL the browser tabs are vulnerable to the getting recorded? In other words only the tabs that are connected to websites that contain these recording JS scripts are vunerable, correct?

Correct. I think there's a caveat if the two different tabs render two different documents but on the same domain, interactions on each could be recorded by either tab.

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#25

Post by cotillion »

mschuster91 wrote: post #22
cotillion wrote: post #20

Earlier quoted context omitted.

Sometimes its just laziness. I was forced to add GTM to a site because it meant marketing could just hand over the GTM login and a pile of money to another company which could then provide them with pretty reports on what the customers were doing. The analytics company promised to not do anything bad so it was OK. And that was after an incident where the entire site was turned purple by another external JavaScript...

> And that was after an incident where the entire site was turned purple by another external JavaScript... lol, what was the root cause? Defacement/scriptkiddie attack or a "background covering" ad that did not recognize the content area and paint over the whole screen instead?

The script was for a yearly user survey run by a small company. It has an awards ceremony attached so I think thats why some marketing people like it. After the survey ended the script was not removed of course.

Around a year later the site changed color when their script started injecting a new stylesheet into our site. They never really said what happened only that they had restored the old version of the script. Maybe some developer pushed dev code to the old production url or maybe they were hacked.

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#26

Post by dsr_ »

dylz wrote: post #10
pmoriarty wrote: post #7

Earlier quoted context omitted.

How about NoScript, RequestPolicy, and Privoxy? Were the blocking capabilities of any of these tested by your team?

Assuming it's used correctly ,noscript/requestpolicy should block these as they are 3rd party s

RequestPolicy appears to have been killed by FF57.

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#27

Post by michrassena »

phkahler wrote: post #23
michrassena wrote: post #17

Earlier quoted context omitted.

I was giving this matter some thought early today after getting some stupid malware popup on my phone (where the phone vibrates, says it has lots of viruses, etc) while using Chrome. It wasn't even on any kind of dodgy site, but most likely it was part of a banner rotation for an ad network. There has to be a way for website creators to sandbox content which comes from third parties. I think we have to accept that al…

Several parts of your comment resonate with me: >> There has to be a way for website creators to sandbox content which comes from third parties. The whole 3rd party thing came about because advertisers needed to establish both ad-distribution and trust (they rightly don't want to pay for ads unless they're actually shown etc...). >> It's problematic that including content from elsewhere in your page (like in an ifram…

I guess what I find frustrating is that it's the same class of problem as Captain Crunch's whistle, in-band control. But, I think we're getting to the point where it has to be sandboxes all the way down (running things in sandboxes, inside of VMs, with memory protection, etc). But it's still not enough. This class of problem must be extremely difficult to solve. How do you run Turing-complete code which might be hostile? All these layers upon layers sophisticated tools, and to what end. To create a merger of TV and magazine advertising. But one could always turn the page or change the channel.

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#28

Post by ams6110 »

englehardt wrote: post #3
seiferteric wrote: post #2

Does anyone know if ublock origin blocks this kind of stuff? Yet another reason to never disable it. I'm starting to realize it's a lot more than an ad blocker, but more like a firewall to protect the client against malicious sites with crypto miners, trackers and this stuff...

Hi, one of the authors here. We discuss this in the last section of the post. uBlock Origin uses lists to determine which requests to block. We tested the two largest, EasyList and EasyPrivacy, and both fail to block scripts from FullStory, Smartlook, and UserReplay.

I checked the hosts file I normally use (MVPS) and they don't seem to be in there either, unless they serve the scripts from a non-obvious domain.

Also fun fact, TurboTax uses SmartLook.

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#29

Post by kevinconroy »

kevinconroy wrote: post #13

+1 for highlighting the privacy concerns, but -1 for blaming the software for not having strong enough defaults. As someone who has integrated FullStory into a production site, I spent several days doing a careful audit of our forms and redacting fields from being tracked. FullStory has an excellent, universal account setting to automatically redact fields based on any CSS selector, so it's very, very easy to tell it…

Correction: I wrote redacting when I meant exclusion. My apologies!

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#30

Post by GrinningFool »

seiferteric wrote: post #2

Does anyone know if ublock origin blocks this kind of stuff? Yet another reason to never disable it. I'm starting to realize it's a lot more than an ad blocker, but more like a firewall to protect the client against malicious sites with crypto miners, trackers and this stuff...

uMatrix stops everything 3rd party from loading by default, but makes it easy to whitelist as you go. It makes browsing extra work for most sites (it adds the step of having to eduguess what you need to enable for the site to function properly - very, very few do so when third parties are blocked) but I find it's worth it.
Post reply on HN