It's hardly new back in 2008, I worked for a company that used Tealeaf, a proxy that intercepted all web traffic before it even hit the load balancer, to record every click and request. It was used by the help desk and, when they couldn't figure it out, the Tealeaf session and player were forwarded to the devs. (This was a company under HIPPA, so a bunch of that data was related to personal health records).

In 2012, I worked at a University with analytic tools that showed a color map indicating the average scroll speed for pages on our website and heat maps indicating how long different users hovered over a section.

This stuff has been around for a long long time.

> the average scroll speed for pages on our website and heat maps indicating how long different users hovered over a section.

Optimizely has all of this stuff (sampled), but the fact they can 'sample' something means they have the full data.

It's creepy indeed. Not only do they collect all your actions (key presses included) but I believe they also send the activity to their servers via HTTP, rendering the SSL on the page that includes their script, useless.

If it's a HTTPS page, wouldn't that be blocked due to mixed content though? Or is HTTP requests from a HTTPS-loaded script allowed?

Modern browsers should block all backend/javascript http communication if the main request is made over HTTPS, unless you specifically disable it with a Content Security Policies.

Better to just disable javascript altogether. Sure, there's no dynamic loading of garbage, but I didn't want that anyway. If your back-end server can't render HTML then you need to build an app.

At least with native desktop apps I can put that garbage into a VM or container. Load whatever you want. I can then apply my own firewall/containerization/VM rules.

According to their documentation it is sent in https

https://help.hotjar.com/hc/en-us/articles/115011639887-Data-...