- websites implementing these tools need to specifically opt-in text fields they want to capture the inputs for
- for HTML-side capture, the javascript will obfuscate PII before sending it to the servers
- some of these tools will not capture password fields under any circumstances
Does that address some of your concerns?
It's capturing the things you are typing into the website's input boxes!
Sorry, call me paranoiac, but i will never trust the javascript of a website. With no webdev experience, i was able to inject js (almost by mistake) three years ago. Moreover, is the js communicating with the backend using https too? How can i check that? Are those js library on the website server, or are they hosted by a third party? I can trust them, but how do i know that no attacker was able to modify those scripts? Yes, those risks are small, but i'd rather have ublock making those risks closer tho 0 than not, am i wrong?