News for hackers. Stuff that matters.
Re:No, you’re not being paranoid. Sites really are watching ... by piratebroadcast on Monday November 20, 2017 @06:55PM (#15744456)
Whats a js library that would do this? Would love to put a demo up on my website to show the user.
Re:No, you’re not being paranoid. Sites really are watching ... by throwawayjava on Monday November 20, 2017 @07:19PM (#15744550)
I did this in like 2005. I don't recall it taking more than an hour. For simple sites, probably faster to just implement it than find a library and read the docs.

Collection is easy. Just capture every key even and read the location of the the mouse in a sufficiently tight loop. Timestamp everything, bunch it and send it to the server on a regular interval. You can do it in 10ish lines of JavaScript.

Playback is the hard part, depending on your infrastructure. But if your site is simple enough you don't even need a library; just load up the page the user was on and play back the data.

I'd be surprised if there isn't already a Dropbox company out there going the final 20% on this "just rsync it" comment though.

Re:No, you’re not being paranoid. Sites really are watching ... by mbb70 on Monday November 20, 2017 @08:14PM (#15744799)
FullStory, LogRocket, HotJar and Mouseflow all fit the bill, the search term of choice appears to be "session replay".
Re:No, you’re not being paranoid. Sites really are watching ... by throwawayjava on Monday November 20, 2017 @10:11PM (#15745215)
Funny, now "session replay" refers to both a privacy vulnerability and a security vulnerability.
Re:No, you’re not being paranoid. Sites really are watching ... by saltedmd5 on Tuesday November 21, 2017 @08:04AM (#15747597)
> For simple sites, probably faster to just implement it than find a library and read the docs.

Not really - the implementation flow for tools that do this sort of thing are typically:

1. Register account 2. Dump JS snippet into page 3. Start watching live user sessions