Hacker News Reader

Comment by mattzito | Hacker News Reader

I agree that this can be used for ill, but there's a number of very valid reasons to use these tools:

- Heatmap views of where people hover and start to type

- capture of individual sessions to research support cases

- Better understanding of user flows through a site or web app

And all of these tools, at least the reputable ones cited in the article, allow you to mask fields or parts of the screens so that PII isn't captured, and reputable companies do that.

The other part of this is that I don't think the article captures well is that these tools aren't used for targeting of ads or personalization or "spying" in the sense of malice, but to try to better understand users, what they're trying to find on a site, and clarify pain when using applications. I also think the people that use these tools, generally speaking, are perfectly fine with blocking them, since it's meant as a diagnostic and analytic tool.

View on HN

"There are a number of very valid reasons to install cameras and microphones in every living room. Consider the amount of domestic abuse that could be prevented this way! Also, interior designers could further understand and tweak the layout of people's living rooms for optimal recreation and entertainment."

A more correct comparison is a store recording how people shop in their locations to better optimize paths and locations of products. Your comparison is more like an app that watches everything you do on your computer outside the context of the app.

Not quite the same thing.

> a store recording how people shop in their locations to better optimize paths and locations of products

Hmmm... nice pitch. Has your series A filled up yet?

/hehehe like I have money :)

Retailers already do this:

https://www.washingtonpost.com/news/the-switch/wp/2013/10/19...

An even more correct comparison is if you invited a salesperson into your house and they had hidden cameras and other sensors recording everything.

Not really, because again it doesn't recorded anything outside of it's context. It's more like being part of a user study group every time you use their product, whether or not you want to be, or agree to be.

Fine then, compare it to a TV that watches you back whenever you're looking at it.

false, many many websites have much of your very personal information, information that is not leaked by walking around a store.

Unless you signed up for the loyalty card.

there's a number of very valid reasons to use these tools

They're very useful for testing. I don't think there's any debate about that. The issue is with using them in production capturing everyone's data with no regard for a user's privacy.

Doing this without explicit user consent (explicit, detailed and with risks shown) is illegal for all 'good' use cases. (At least in the EU). It is criminal for all others.

Edit: It also needs to be stored anonymously, though even people I know who build wifi/bluetooth tracking software&hardware say that is almost impossible.

So, in a GDPR world, it is true that you need to get more explicit user consent for the gathering of this permission. However, I think it's overly dramatic to say "illegal for all good use cases" and criminal for others. These tools have been used for years in the EU, with signoff from lawyers and regulators when PII is being obfuscated or removed.

GDPR is addressing precisely these things though, and tightening up the allowed actions. It doesn't really matter if it was previously allowed, you need explicit documented consent to store PII.

But, I thought it wasn't coming in to force until next May.

> what they're trying to find on a site, and clarify pain when using applications.

No. We are doing analytics for the sole purpose of selling our products and services better. Let's not kid ourselves into thinking we are spying on our users for the greater good. Nobody implements user tracking simply to make their user's lives better. If it does happens, it's merely a side effect of our sales strategies.

I've found these tools extremely useful to understand user behavior. We rely on Fullstory all the time to improve the user experience, to identify bugs, and to debug user issues.

The result of these tools is a far better user experience on our site and many other sites.

"recording every keystroke" makes it sound like there's malicious intent, but it's misleading. It should be added that all these tools have a lot of options to avoid tracking sensitive data (like password fields) and we always rely on that (in fact anything else would be a compliance violation for us).

I don't have any malicious intent, but don't mind me as I set up camp here in your bedroom...

> "recording every keystroke" makes it sound like there's malicious intent

Thinking from a security perspective, I'm not sure "intent" is an important consideration. The question is: should third parties have the technical capability to do this?

IMO there are enough bad actors out there to answer this with a resounding _no_, at least by default.

If you want to record user browsing sessions, you should ask permission.

I suppose the issue here is that these aren't really "third" parties doing the recording, even if they're using third-party scripts.

Yeah the owner of the website which include the script has only their website data.

The third party follows users over all the websites they're deployed on. Best example is google analytics and all beacons scripts (G+, FB like, share on twitter etc.) which track you almost everywhere.

There's a lot of "valid reasons" for doing a lot of bad things.

Certainly if someone breaks into my house and watches it with not-spy-at-all cameras, they can know how I live and provide me with better products shaped for my habits and preferences, and help me with emergencies or particularly difficult tasks. But that might be sliiightly inconvenient at times, no?

Not quite the same thing.

Passwords, medical records and credit card information are so sensitive that it's irrelevant that there are good uses for the tech that captures them or that at some point in the pipeline they get masked.

So, to be clear, the way at least the tools I've worked with operate:

- websites implementing these tools need to specifically opt-in text fields they want to capture the inputs for

- for HTML-side capture, the javascript will obfuscate PII before sending it to the servers

- some of these tools will not capture password fields under any circumstances

Does that address some of your concerns?

No. There's too many parties involved I'd have to trust to a) want to keep my data save and b) don't mess up. And even if both are true, I have to accept yet another way with several points of failure where bad agent could exfiltrate my data.

But this is being run by a party you trust with that data in the first place surely?

It's capturing the things you are typing into the website's input boxes!

Just because you trust the first party site with that information doesn't mean you would necessarily trust a third party to store or transmit that info.

We trust the website we give our information to. It is https-based (else my browser will tell me) and probably using an ORM that will 99% of the time hash my password. But the javascript layer...

Sorry, call me paranoiac, but i will never trust the javascript of a website. With no webdev experience, i was able to inject js (almost by mistake) three years ago. Moreover, is the js communicating with the backend using https too? How can i check that? Are those js library on the website server, or are they hosted by a third party? I can trust them, but how do i know that no attacker was able to modify those scripts? Yes, those risks are small, but i'd rather have ublock making those risks closer tho 0 than not, am i wrong?

> number of very valid reasons

I'm genuinely curious what steps are executed once this data is collected.

Also, in theory, you only need to do this after design/layout changes and only for a while, so what justifies collecting it all the time? I might be wrong though.

Usually if someone complains to support, their session can be tracked down and sent to the devs.

o.O that goes massively against data protection laws.

There are definitely SaaS tools that let you watch a user's session on your site. They stitch together page transitions, show you the mouse cursor moving around, what they type. It's like watching a remote desktop session. Creepy as hell.

Data protection laws? Provide some examples.

Google does this on all of their products. And people that have left Google have made their own versions of this software for others to use. For example: https://www.fullstory.com/

So, again, the use cases here are varied. For the most common, which is understanding user behavior, you'll do something like:

- I'm going to capture 5% of users sessions as they progress through a purchase funnel

- I capture data for a few days after a design change, and look at behavioral changes, such as spending more time in a particular step of the funnel

- Where there's something weird going on, I'll watch an aggregate view of people's mouse behaviors - I can then see that a lot of people are hovering between two different buttons, or highlighting a particular sentence

- Based on that feedback, I'll do an A/B test of changing the button textx or the dialogue message

- Capture more data, did that change?

It's not "Let's go look at john smith's website behavior" except in the support example, where you get a user's consent to do that, and you usually only do it for internal corporate applications where there's a dedicated helpdesk.

Those are all valid reasons. But what these companies need to do instead is pay consenting users to engage in usability sessions.

I know plenty of companies would pay a lot for usability sessions if they were remotely accurate (and they do anyway), but they really aren't like regular users using the site naturally.

Because people don't think they're being watched.

... so it is deceptive to watch them.

That's mostly fine, but it should be clear to me (the user) that it is happening.

Reply on news.ycombinator.com