No, you’re not being paranoid. Sites really are watching your every move

No, you’re not being paranoid. Sites really are watching your every move

Sites log your keystrokes and mouse movements in real time, before you click submit.





If you have the uncomfortable sense someone is looking over your shoulder as you surf the Web, you're not being paranoid. A new study finds hundreds of sites—including microsoft.com, adobe.com, and godaddy.com—employ scripts that record visitors' keystrokes, mouse movements, and scrolling behavior in real time, even before the input is submitted or is later deleted.

Session replay scripts are provided by third-party analytics services that are designed to help site operators better understand how visitors interact with their Web properties and identify specific pages that are confusing or broken. As their name implies, the scripts allow the operators to re-enact individual browsing sessions. Each click, input, and scroll can be recorded and later played back.

A study published last week reported that 482 of the 50,000 most trafficked websites employ such scripts, usually with no clear disclosure. It's not always easy to detect sites that employ such scripts. The actual number is almost certainly much higher, particularly among sites outside the top 50,000 that were studied.

"Collection of page content by third-party replay scripts may cause sensitive information, such as medical conditions, credit card details, and other personal information displayed on a page, to leak to the third-party as part of the recording," Steven Englehardt, a PhD candidate at Princeton University, wrote. "This may expose users to identity theft, online scams, and other unwanted behavior. The same is true for the collection of user inputs during checkout and registration processes."

Englehardt installed replay scripts from six of the most widely used services and found they all exposed visitors' private moments to varying degrees. During the process of creating an account, for instance, the scripts logged at least partial input typed into various fields. Scripts from FullStory, Hotjar, Yandex, and Smartlook were the most intrusive because, by default, they recorded all input typed into fields for names, e-mail addresses, phone numbers, addresses, Social Security numbers, and dates of birth.

The following video captured data as it was transmitted in real time to FullStory:



Even when services took steps to mask some of the data, they often did so in ways that continued to jeopardize visitor privacy. Smartlook and UserReplay, for instance, collected the number of characters typed into password fields. UserReplay also logged the last four digits of visitors' credit card numbers.

Englehardt said the services provide manual and automatic tools website operators can use to redact information that is collected on their properties. But the tools in many cases require large amounts of developer time and skill. And even then, sites with strong legal incentives not to leak sensitive data were found doing just that. Walgreens.com, for instance, sent medical conditions and prescriptions alongside user names to FullStory despite the extensive use of manual redactions on the pharmacy site.

Another example: the account page for clothing store Bonobos leaked full credit card details—character by character as they were typed—to FullStory. Adding insult to injury, Yandex, Hotjar, and Smartlook all offer dashboards that use unencrypted HTTP when subscribing publishers replay visitor sessions, even when the original sessions were protected by HTTPS.

Representatives for both Walgreens and Bonobos have said the sites have stopped sharing information with FullStory, according to reports from Motherboard and Wired.

It's not clear what meaningful recourses Internet users have for preventing the data collection. The researcher said that ad-blockers can filter out some, but not all, of the replay scripts. Checking the "do not track" option built into some browsers also failed to stop the logging. That means every keystroke typed into a Web field may be logged, character by character, even if the visitor later deletes the field and never presses a submit button.

Until more robust protections are available, people should remember that just about anything they do while visiting a website can be logged.



Dan Goodin Dan is the Security Editor at Ars Technica, which he joined in 2012 after working for The Register, the Associated Press, Bloomberg News, and other publications. Email dan.goodin@arstechnica.com // Twitter @dangoodin001

Views: 91

Replies to This Discussion

Folks, I highly recommend Kaspersky use on your electronics. On my PC, I use Premium, and the "Privacy Cleaner" every time I log off. I can tell it's working because my spam count has dropped by 90%. I also researched them well before I signed up. They are Hated by the US Government, which to me, means they are effective in what they do. Mike Rivero recommended them, and I took it from there.

RSS

"Destroying the New World Order"

TOP CONTENT THIS WEEK

THANK YOU FOR SUPPORTING THE SITE!

mobile page

12160.info/m

12160 Administrators

 

Latest Activity

Doc Vega posted a blog post
14 hours ago
tjdavis posted blog posts
yesterday
Doc Vega posted photos
yesterday
tjdavis posted a blog post
Wednesday
Doc Vega commented on Doc Vega's blog post Is this proof that the story about Charlie Kirk's assassination is false?
"Les prone, Thanks Buddy! "
Tuesday
Doc Vega posted a blog post
Tuesday
tjdavis posted a photo
Tuesday
Doc Vega commented on Doc Vega's blog post Is this proof that the story about Charlie Kirk's assassination is false?
"Less Prone as usual the official version of the truth does not match the evidence and is labeled…"
Saturday
Less Prone commented on Doc Vega's blog post This Memorable Anthem Given by Nick Freitas Hit the Nail on the Head Please Listen!
"Charlie Kirk was getting very critical against Israel and had turned down a lucrative deal from the…"
Saturday
Doc Vega's blog post was featured

The Army of Government Launched Psychopaths

They walk among us in most college towns. They seem relatively reasonable until political…See More
Saturday
Less Prone favorited Doc Vega's blog post Is this proof that the story about Charlie Kirk's assassination is false?
Saturday
Less Prone commented on Doc Vega's blog post Is this proof that the story about Charlie Kirk's assassination is false?
"Have to sign in to YT for this. So. What I do is to go to https://ytdown.io/en/ and download…"
Saturday
Doc Vega commented on Doc Vega's blog post Was a Planned Civil War Averted?
"cheeki kea, you are spot on. The old guard is about to collapse! "
Oct 2
Doc Vega commented on Doc Vega's blog post Alligator Creek and a Japanese Massacre
"cheeki kea, the Japanese thought they could expand their empire and exact enough damage on the US…"
Oct 2
Michelle Reichert favorited Burbia's video
Oct 1
cheeki kea posted a video

NEW DOCUMENTARY - Dissent Into Madness

TRANSCRIPT AND SOURCES: https://www.corbettreport.com/dissent-into-madness/What if the delusions of the dissidents are in fact real? What if their paranoid f...
Oct 1
cheeki kea commented on Doc Vega's blog post Alligator Creek and a Japanese Massacre
"Japan served themselves up no favours by inching out into the South Pacific as they soon found out.…"
Oct 1
cheeki kea commented on Doc Vega's blog post Was a Planned Civil War Averted?
"Their plans did not work out because we are the news now, and the old news is the enemy. "
Oct 1
Doc Vega posted a blog post

Alligator Creek and a Japanese Massacre

The year is 1942 just a few months after the Pearl Harbor disaster. Despite losses suffered by the…See More
Sep 30
Doc Vega commented on Burbia's video
Thumbnail

CHARLIE KIRK WAS CNP! JOSH REEVES 9-11-25

"With all due respect this guy comes off as a drunken asshole and he didn't even  know who…"
Sep 29

© 2025   Created by truth.   Powered by

Badges  |  Report an Issue  |  Terms of Service

content and site copyright 12160.info 2007-2019 - all rights reserved. unless otherwise noted