Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No boundaries: Exfiltration of personal data by session-replay scripts

freedom-to-tinker.com

Post reply on HN
Print view View original

41–50 of 57 posts

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#41

Post by Myztiq »

phkahler wrote: post #6

DAMMIT. Once again the question that immediately come to mind is "Why the FUCK do browsers facilitate this shit?" C'mon you stupid web devs on HN tell me again all your excuses to need these capabilities. Sorry to generalize to all those of you who don't do this, but many of you still want those capabilities that have opened the door. And those browser devs... It's like they compete to sell out the users by adding "f…

Ok, here's a real example of how fullstory can help provide a better product. Bug reporting. A user gets a JS error on the page, but say my application is pretty complex, and the state machine I've built can't handle a particular state. Well, I can easily walk through the recording of what the user had done and reproduce the issue.

I can actually hop on a call with this user and walk them through how to do something, while looking at what page and what inputs they have filled in. This takes frustrating back and forth of "What do you see now?" that happens without this tool.

Say I want to influence user decisions by offering subtle cues to push them towards something that will be overall beneficial for them. By watching certain key users we can know what frustrates them (erratic mouse movements, long time searching for features etc) and what things they grok easily.

The article totally washes over a super important feature of fullstory, excluding elements[0]. When you include a simple class name or specifically selecting what you'd like to exclude.

[0] http://help.fullstory.com/technical-questions/exclude-elemen...

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#42

Post by gorhill »

englehardt wrote: post #3
seiferteric wrote: post #2

Does anyone know if ublock origin blocks this kind of stuff? Yet another reason to never disable it. I'm starting to realize it's a lot more than an ad blocker, but more like a firewall to protect the client against malicious sites with crypto miners, trackers and this stuff...

Hi, one of the authors here. We discuss this in the last section of the post. uBlock Origin uses lists to determine which requests to block. We tested the two largest, EasyList and EasyPrivacy, and both fail to block scripts from FullStory, Smartlook, and UserReplay.

I suggest uBO's medium mode, this blocks 3rd-party scripts by default.

[1] https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium...

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#43

Post by phkahler »

pdkl95 wrote: post #32
michrassena wrote: post #27

Earlier quoted context omitted.

I guess what I find frustrating is that it's the same class of problem as Captain Crunch's whistle, in-band control. But, I think we're getting to the point where it has to be sandboxes all the way down (running things in sandboxes, inside of VMs, with memory protection, etc). But it's still not enough. This class of problem must be extremely difficult to solve. How do you run Turing-complete code which might be host…

> How do you run Turing-complete code which might be hostile? That's the key problem that (almost) nobody wants to talk about. We've been trying to solve the decision problem for a long time, and we already know that even relatively simple problems are provably undecidable[1]. Any real program will be much more complex[2]. An unknown program could generate any output it wants and we cannot know that without running i…

>> The original design for the web was (probably) safe. It didn't require anonymous Turing complete code, and provided quite a bit of functionality with declarative markup. It even allowed simple (but still useful) server-side applications with 3270-style forms (again, no code needed). This was wonderfully useful, reasonably safe, and most importantly it was understandable by both humans and machines.

Thanks for that! So many web devs today can't even comprehend the idea that you can have interactivity without JS. Part of the reason for what we have came from offloading work from the server. I once made an Othello game with nothing client side but an auto-reload after a timeout - everything was in a CGI script on the server.

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#44

Post by kevinconroy »

joosters wrote: post #31
kevinconroy wrote: post #13

+1 for highlighting the privacy concerns, but -1 for blaming the software for not having strong enough defaults. As someone who has integrated FullStory into a production site, I spent several days doing a careful audit of our forms and redacting fields from being tracked. FullStory has an excellent, universal account setting to automatically redact fields based on any CSS selector, so it's very, very easy to tell it…

It's still a broken process. Are you going to re-audit every future change to your web site? I doubt it. The default, as the article suggests, should be to redact all fields, then let the company opt-in the fields that they really mean to record.

If a company is serious about security and privacy, they have to do those audits for every feature, regardless of if they use these tools. PCI requires this if you handle money online.

Still, you're right that many companies have a surprising lack of security. This vector of unintentional exfiltration may pale in comparison to the intentional mismanagement and lack of security focus internally. Equifax, anyone?

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#45

Post by kevinconroy »

Myztiq wrote: post #41
phkahler wrote: post #6

DAMMIT. Once again the question that immediately come to mind is "Why the FUCK do browsers facilitate this shit?" C'mon you stupid web devs on HN tell me again all your excuses to need these capabilities. Sorry to generalize to all those of you who don't do this, but many of you still want those capabilities that have opened the door. And those browser devs... It's like they compete to sell out the users by adding "f…

Ok, here's a real example of how fullstory can help provide a better product. Bug reporting. A user gets a JS error on the page, but say my application is pretty complex, and the state machine I've built can't handle a particular state. Well, I can easily walk through the recording of what the user had done and reproduce the issue. I can actually hop on a call with this user and walk them through how to do something,…

+1 - having session recordings is a HUGE win to help track down hard-to-reproduce bugs. You can get the strangest bug reports, and by watching the session, as a dev, you can instantly translate it into the technical terms that the end user lacked and you can fix the problem.

It's also great for ad-hoc usability testing to see how people are using your features, where they slow down to read, what elements they try to click on but can't, and other UX improvements that you'd pay consultants six figures to put in a report for you.

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#46

Post by kevinconroy »

skrebbel wrote: post #37

To be fair, FullStory spends a lot of time in their onboarding, UI and docs encouraging you to check and double check that anything sensitive is excluded. They broadcast this message so clearly that it's obvious that they take privacy seriously (or, about as seriously as any over-the-shoulder-peeking service could), and they strongly encourage their users to adopt the same stance. This article makes it seem like thei…

Yes, the on boarding for FullStory is excellent and they go out of their way to help you try to get it right. Odds are you'll end up doing a better job at protecting privacy in FullStory than in your own log files, but YMMV.

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#47

Post by eadmund »

phkahler wrote: post #6

DAMMIT. Once again the question that immediately come to mind is "Why the FUCK do browsers facilitate this shit?" C'mon you stupid web devs on HN tell me again all your excuses to need these capabilities. Sorry to generalize to all those of you who don't do this, but many of you still want those capabilities that have opened the door. And those browser devs... It's like they compete to sell out the users by adding "f…

> Once again the question that immediately come to mind is "Why the FUCK do browsers facilitate this shit?"

Because their developers were too busy wondering if they could to wonder if they should.

The modern web is like Moria: we've delved too deeply, and have awaken a slumbering horror.

Re: No boundaries: Exfiltration of personal data by session-replay scripts

#48

Post by alinspired »

gorhill wrote: post #42
englehardt wrote: post #3

Earlier quoted context omitted.

Hi, one of the authors here. We discuss this in the last section of the post. uBlock Origin uses lists to determine which requests to block. We tested the two largest, EasyList and EasyPrivacy, and both fail to block scripts from FullStory, Smartlook, and UserReplay.

I suggest uBO's medium mode, this blocks 3rd-party scripts by default. [1] https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium...

thank you for suggestion in this unexpected place. i wish i knew of this uBO feature before!
Post reply on HN