Um. This isn’t nefarious.
We’ve used inspectlet from time to time to help figure out where there are problems in our UI. It tracks mouse movements as part of a complete session. It’s been really helpful.
Facebook confirms that it tracks mouse movements
41–50 of 188 posts
Re: Facebook confirms that it tracks mouse movements
#42Um. This isn’t nefarious. We’ve used inspectlet from time to time to help figure out where there are problems in our UI. It tracks mouse movements as part of a complete session. It’s been really helpful.
You should still only do this when the user is aware you’re tracking these behaviors and you have their consent. That’s the problem here.
Re: Facebook confirms that it tracks mouse movements
#43Earlier quoted context omitted.
It won't hurt if humans fail the test every so often, as long as it's under a threshold that humans regularly can overcome. I can imagine it would be easy to trick the system a few times (either as a bot pretending to be human, or a human acting like a bot), but tricking it consistently over months or years is going to be damn near impossible.
Also don't forget that Facebook probably has to do all detection in Javascript on the client, i.e. with limited resources. I suspect they don't send every mouse-movement to the server. This also means they probably don't have fine-grained historical data.
Not necessarily.
I've only given it a few minutes thought, but position and time data is really small, and easy to compress (you don't need to send anything while the user isn't moving the mouse). If it's sent in batches or over an already open websocket, it's not like it's using a ton of resources on the client.
Assuming all of their users (guessing a billion daily active users) are on desktop half of the time (a wildly incorrect assumption I'm sure), and the mouse position data is 1mb per person for the data you care about (which again, seems like a lot), that's 500tb.
For $25k you could store it all. That's nothing compared to the benefits of being able to identify bots on your platform.
Re: Facebook confirms that it tracks mouse movements
#44According to lcamtuf[1] how people move mouse and use keyboard are unique per person, it's your personal digital-fingerprint that can be transferred to track you elsewhere. [1] From Book "Silence on the Wire"
Unfortunately, it's not just JS, but several other indicators. In practice, if you don't use the Tor Browser, it's as if you decided to leave tracks everywhere, almost identifying yourself. Yet, this is not common knowledge among web users. These are the things that children need to be taught in schools. The society as a whole needs to be aware and learn how to protect itself.
Re: Facebook confirms that it tracks mouse movements
#45I'm not sure if this is actually how reCAPTCHA v2 works, but I've found moving my mouse and highlighting text immediately after ticking the box almost certainly passes the tests for human. I very rarely get asked to recognise images or pick X out of Y. When I don't do this, i.e., I don't move my mouse or highlight text on a page at random, I most certainly have to sit through a couple of screens of tests (I'm behind a shared IP with lots of users).
All this leads me to think mouse movements tracking is much more widespread.
Re: Facebook confirms that it tracks mouse movements
#46Um. This isn’t nefarious. We’ve used inspectlet from time to time to help figure out where there are problems in our UI. It tracks mouse movements as part of a complete session. It’s been really helpful.
You should still only do this when the user is aware you’re tracking these behaviors and you have their consent. That’s the problem here.
I'm not so worried about this, as long as it's only on their site and when I'm logged in. They're using it to test features and engagement, and can't really learn much about me as a person with it.
Re: Facebook confirms that it tracks mouse movements
#47> Facebook said that it tracks mouse movements to help its algorithm distinguish between humans and bots. Stupid cat and mouse game. How difficult would it be for a bot to simulate a human's mouse movements? I suppose not very difficult. Also, doesn't this conflict with rare types of input devices? Or people with a motor function disability? > to also determine if the window is foregrounded or backgrounded Shouldn't…
How difficult would it be for a bot to simulate a human's mouse movements? Very very hard. Because the bot author does not have the giant database that FB has to analyze how humans move the mouse around. Also the bot author does not know which aspects FB looks at to determine if it's a human. And even if the bot author had all that information, it would still be super hard to write an AI that accomplishes a given tas…
All those "the attacker won't have the knowledge" underestimate that the attacker can simply run their own websites tracking the exact same stuff, and can then just get the same knowledge.
You need to break ReCaptcha? Simple, you implement your own captcha on your own site that's frequently used and whenever you need to solve one you copy the challenge and present it to one of your users.
Same with recording mouse data.
It's an old idea even, very similar to https://xkcd.com/792/
Re: Facebook confirms that it tracks mouse movements
#48I'm not sure if this is actually how reCAPTCHA v2 works, but I've found moving my mouse and highlighting text immediately after ticking the box almost certainly passes the tests for human. I very rarely get asked to recognise images or pick X out of Y. When I don't do this, i.e., I don't move my mouse or highlight text on a page at random, I most certainly have to sit through a couple of screens of tests (I'm behind…
I have a similar experience. Filling in fields and switching with the TAB button then pressing ENTER always brings me to a visual recognition test, while manually clicking on the fields (and adding a bit of sloppiness) is most of the time an immediate validation from reCAPTCHA2.
However I'm pretty sure this was advertised or at least acknowledged by Google in the launching of reCAPTCHA v2.
Re: Facebook confirms that it tracks mouse movements
#49Is there even anything left that Facebook doesn't track?
Re: Facebook confirms that it tracks mouse movements
#50According to lcamtuf[1] how people move mouse and use keyboard are unique per person, it's your personal digital-fingerprint that can be transferred to track you elsewhere. [1] From Book "Silence on the Wire"
Unfortunately, it's not just JS, but several other indicators. In practice, if you don't use the Tor Browser, it's as if you decided to leave tracks everywhere, almost identifying yourself. Yet, this is not common knowledge among web users. These are the things that children need to be taught in schools. The society as a whole needs to be aware and learn how to protect itself.
That is victim blaming, just because you do not know that everybody out there is tracking you does not mean that you have decided to let them.
I agree that this is something people should be more aware of and school is a good place to start. However it is up to browser manufacturers to fix this, not users.