Not quite the same thing.
Hmmm... nice pitch. Has your series A filled up yet?
/hehehe like I have money :)
https://www.washingtonpost.com/news/the-switch/wp/2013/10/19...
They're very useful for testing. I don't think there's any debate about that. The issue is with using them in production capturing everyone's data with no regard for a user's privacy.
Edit: It also needs to be stored anonymously, though even people I know who build wifi/bluetooth tracking software&hardware say that is almost impossible.
But, I thought it wasn't coming in to force until next May.
No. We are doing analytics for the sole purpose of selling our products and services better. Let's not kid ourselves into thinking we are spying on our users for the greater good. Nobody implements user tracking simply to make their user's lives better. If it does happens, it's merely a side effect of our sales strategies.
The result of these tools is a far better user experience on our site and many other sites.
"recording every keystroke" makes it sound like there's malicious intent, but it's misleading. It should be added that all these tools have a lot of options to avoid tracking sensitive data (like password fields) and we always rely on that (in fact anything else would be a compliance violation for us).
Thinking from a security perspective, I'm not sure "intent" is an important consideration. The question is: should third parties have the technical capability to do this?
IMO there are enough bad actors out there to answer this with a resounding _no_, at least by default.
If you want to record user browsing sessions, you should ask permission.
The third party follows users over all the websites they're deployed on. Best example is google analytics and all beacons scripts (G+, FB like, share on twitter etc.) which track you almost everywhere.
- websites implementing these tools need to specifically opt-in text fields they want to capture the inputs for
- for HTML-side capture, the javascript will obfuscate PII before sending it to the servers
- some of these tools will not capture password fields under any circumstances
Does that address some of your concerns?
It's capturing the things you are typing into the website's input boxes!
Sorry, call me paranoiac, but i will never trust the javascript of a website. With no webdev experience, i was able to inject js (almost by mistake) three years ago. Moreover, is the js communicating with the backend using https too? How can i check that? Are those js library on the website server, or are they hosted by a third party? I can trust them, but how do i know that no attacker was able to modify those scripts? Yes, those risks are small, but i'd rather have ublock making those risks closer tho 0 than not, am i wrong?
I'm genuinely curious what steps are executed once this data is collected.
Also, in theory, you only need to do this after design/layout changes and only for a while, so what justifies collecting it all the time? I might be wrong though.
- I'm going to capture 5% of users sessions as they progress through a purchase funnel
- I capture data for a few days after a design change, and look at behavioral changes, such as spending more time in a particular step of the funnel
- Where there's something weird going on, I'll watch an aggregate view of people's mouse behaviors - I can then see that a lot of people are hovering between two different buttons, or highlighting a particular sentence
- Based on that feedback, I'll do an A/B test of changing the button textx or the dialogue message
- Capture more data, did that change?
It's not "Let's go look at john smith's website behavior" except in the support example, where you get a user's consent to do that, and you usually only do it for internal corporate applications where there's a dedicated helpdesk.
Google does this on all of their products. And people that have left Google have made their own versions of this software for others to use. For example: https://www.fullstory.com/
- Heatmap views of where people hover and start to type
- capture of individual sessions to research support cases
- Better understanding of user flows through a site or web app
And all of these tools, at least the reputable ones cited in the article, allow you to mask fields or parts of the screens so that PII isn't captured, and reputable companies do that.
The other part of this is that I don't think the article captures well is that these tools aren't used for targeting of ads or personalization or "spying" in the sense of malice, but to try to better understand users, what they're trying to find on a site, and clarify pain when using applications. I also think the people that use these tools, generally speaking, are perfectly fine with blocking them, since it's meant as a diagnostic and analytic tool.