Papa John's sued for 'wiretap' spying on website mouse clicks, keystrokes

Re:Papa John's sued for 'wiretap' spying on website mouse cl... by S201 on Friday October 07, 2022 @02:59PM (#33125503)

A few years ago I was at a startup that integration one of these video playback services (Fullstory) into their product. At the time the PM team was all jazzed up about the idea and engineers were rushing to get it implemented. I was the only person to bring up potential privacy concerns which were immediately dismissed under the excuse that the PMs absolutely needed this level of functionality to view individual user's full sessions on the website.

Anyway, Ublock blocks Fullstory's JS from running by default so at the very least your ad-blocker is potentially saving you from this level of intrusion.

[ Parent | on HN ]

Re:Papa John's sued for 'wiretap' spying on website mouse cl... by mmastrac on Friday October 07, 2022 @03:25PM (#33125796)

I don't think this is entirely accurate. I was at FullStory, as a director of development and founding engineer on the mobile analytics, and we were focused on our privacy-by-default initiative that blocks out user PII while still giving you PM-level information.

The founders of the company were invested in privacy and PBD, and we put a lot of effort into balancing data with privacy. One of the founders even spent a great deal of time on the initial implementation.

This work started years ago and I can say that everyone was interested in privacy, from recording/playback engineers to execs.

[ Parent | on HN ]

Re:Papa John's sued for 'wiretap' spying on website mouse cl... by S201 on Friday October 07, 2022 @03:29PM (#33125836)

I didn't work on the integration directly at the time so it's certainly possible some of my details are incorrect. That said, from what I remember of the demos that were given there was the ability to set regions of pages which contained PII that were not collected but this was entirely up to us to configure. Otherwise, it was possible to watch an individual user's full session on the website.

This was years ago too so maybe it has changed since, but my issue is with the whole premise of products like Fullstory that make it possible to essentially watch your user's over their shoulder without being given proper notification that level of monitoring is occurring.

[ Parent | on HN ]

Re:Papa John's sued for 'wiretap' spying on website mouse cl... by mmastrac on Friday October 07, 2022 @03:47PM (#33126051)

The potential is there for sure, but the company believed in giving customers the tools to ensure that PII was not recorded, including go as far as giving internal engineers tools required to scrub data permanently that was accidentally recorded.

I no longer work at FullStory, but I believe very strongly that the culture of privacy still exists.

Senior individuals at FS, myself obviously included, felt very strongly that we wanted to avoid any of the creepiness factor, and it was important to us that we felt comfortable with the technology. Discussions on privacy were paramount in all designs.

[ Parent | on HN ]

Re:Papa John's sued for 'wiretap' spying on website mouse cl... by nrb on Saturday October 08, 2022 @04:21AM (#33130699)

We demo’d Fullstory recently and decided not to go with it because of user privacy concerns, but there is a “private by default” setting now that masks all fields except ones you explicitly allow.

[ Parent | on HN ]