Re:Customer Service Agents Can See What You're Typing in Rea...
by abugheratwork on Wednesday January 23, 2019 @06:22PM
(#18984252)
I think you're right. I also think the browser, as your agent, should enforce expectations. "This website wants to upload data. Allow? [Once] [Always] [No] [Click here to see the data.]"
Re:Customer Service Agents Can See What You're Typing in Rea...
by slavik81 on Thursday January 24, 2019 @03:37AM
(#18986976)
Unfortunately, you'd have to prohibit downloads as well, as the request sent to the server could contain information.
Re:Customer Service Agents Can See What You're Typing in Rea...
by bradknowles on Wednesday January 23, 2019 @06:13PM
(#18984190)
Of course it's malicious. But it's so profitable!
Imagine this scenario: Copying and pasting a debug log, realizing it contains personal or important information (such as password, SSN, or anything else) and it is sent to the agent before you have a chance to redact that info. Or it could be accidentally pasting the wrong thing. I know that I've accidentally pasted Twitter links into my code before.
EDIT: Just to clarify my point. If you're going to break deeply entrenched user expectations, especially in ways that are often used maliciously: explicitly say you are subverting those expectations.
The same reason there are "This call may be recorded" messages when calling in, it shouldn't hurt much to add a "For quality assurance purposes, your keypresses may be logged in the chat window".
And if it does hurt, then you should realize your subversion is malicious.