Banks and Retailers Are Tracking How You Type, Swipe and Tap

A helpful Venn Diagram:

http://flowingdata.com/2010/10/22/privacy-and-the-internet/

I've had that in my Privacy & Security slide deck for years. I say unless you're willing to go to EXTRAORDINARY lengths, there really is very little privacy. IT's been gone for years. Maybe new laws like the GDPR will help push things in the right direction?

I kinda feel like a best-effort attempt to minimize data-leakage + some kind of noise injection might be the best approach right now.

Ultimately though, I think we'll need legislative and platform solutions if we want to keep a good amount of online privacy. This just isn't something an individual can solve on their own.

I deal with it mostly by asking myself what "privacy" I'm really concerned about. Let's see... I don't want anyone actually stealing my money. I don't want sensitive security information that can be used to steal my money (ie passwords) falling into unauthorized hands.

But my personal history? My photos? Words I've written? Oh well. If someone wants that stuff, they can probably get it. And the gaping maw of robotic commerce doesn't actually care about me personally, it only cares what it can sell me.

I'm not worried about the police or some authoritarian tyranny on a personal level, on the level where what I say on the internet matters. I worry about it in an impersonal way. When the robot overlords are rounding up the granola-munching people of south Minneapolis for extermination, they won't be checking our internet history first.

I stay sane by believing that as long as I stay active in the tech industry and do my best to constantly push to make things a little better, then I’m doing net good. The worst thing we can do is throw up our hands and admit defeat.

I try not to think about all those engineers out there on the other side, acting in opposition to user privacy, happily writing all this monitoring, tracking, fingerprinting, and profiling software. Many are probably readers here. I hope the paycheck is worth it.

It has all been predicted, and when you throw hordes of PhD's at the problem, solutions will come. I think we should heed the more serious warnings about AI too and not be so cavalier.

I completely agree its exhausting and I think that's by design.

And even given the measures you outlined, if your friend uses FB,Google services you will be exposed to those services via their address book being hoovered up, their photo tagging, their WIFI etc.

I think legislation and regulation is the only thing that's going to provide any meaningful recourse.

> Does anyone else feel a sense of overwhelming futility with respect to internet privacy?

You had me at overwhelming futility

Almost all of my friends are this way now. They just gave up on any sense of privacy and accepted it. I can't say I blame them. They have different needs / wants than I do, but I will admit it's pretty disheartening too.

I haven't given up yet, but it's such a pain in the ass if you don't keep up on it. I ended up just ditching any service that doesn't respect my privacy or at the very least, stick with ones that say they respect it.

If there's anything real important I have a few friends who usually let me know. I still do miss some events but I figure if no one remembered to ask me, it's not important, or I'm not that important. Either way, it's not my issue.

Emotionally I didn't want companies to know about my life but practically it's going okay. Having companies know random information about me doesn't really affect my day to day life much (except for I have more targeted ads, which honestly isn't a negative).

I see it as an unfortunate consequence corollary to freedom of math and speech. If you give people the right to record and calculate everything they know it allows for invasive analytics in an attempt to soothsay by automating superstitions. If you don't have them then it opens abuses such as reporting that a scumbag serial Ponzi schemer convicted of doing so is "violating his right to be forgotten" and reporting that the local police just spend four hours loitering in diners and coffee shops is "illicitly tracking law enforcement". Restricting others to try to prevent it would prove lossy to freedom overall. Even a "no financialization" limit would allow shutting down a voting record of congress mapped to donor contributions because they are making money off of someone else's data if they try to cover their costs in any way.

I believe that the achievable thing to aim for is a transparent society instead of a half-mirror one.

I am probably very unaware of a Chrome or Firefox extension that allows this:

I wish I could Browse to... and set scripts to run before a page is navigated to. I know you can do this from the Dev Tools console just by hooking into events, but i wish there were something more user-friendly so it'd be easy to pass around scripts to average users. Simply to unreference or wrap JS APIs that allow things like this. You'd still need to be impossibly aware of what new API Google is introducing in Chrome every week. I wish they defined subsets of JS, like how there's a C++ embedded standard and such. I know in JS land you go by feature detection not profile selection (like OpenGL?).

We're just learning more ways to sandbox I suppose.

PS: I want the ability to easily re-order the scripts that run before/after an event fires.

I never cared much about that stuff. I trust big corporations, I always opt-in for telemetry and similar stuff, because I genuinely believe that it helps to make better software. And yes, I enjoy all fancy features and never had any problems with that. It's hard for me to understand people who don't want to use Windows 10 because of telemetry. It's awesome OS, who cares. It's not like Windows 98 was open source, you never really know what was collected back then, at least they are honest this time.

> Throw an Amazon Echo in the corner and at least you can control your lights and play Jeopardy.

This is where I have landed, sadly. Especially now that I have a family, I simply don't have time or energy to think about privacy all the time. And that's the only way you can fight it, is to think about it constantly.

I am totally with you on this. I only care about protecting what really matters to me. You cannot win. Companies are getting smarter on how to track you and they WILL track you no matter what you do. Hey I may be getting tracked right now typing all this. Who cares. Go ahead, show me some stupid ads. I won't click on them anyway. Or yea, get some sales guy to call my cell because I was labeled as a potential lead for some stuff based on a page I visited. I never pick up unknown calls. Next.

I have a few comments on this subject.

1) We are in tech. So what we do signals to others. How much we care signals to the public how much they care. If we don't, then why should they? And if they don't, how does legislation pass to prevent extreme invasion? It is in our (and companies') nature to push boundaries. If we don't get upset and do something then they push back.

2) There is more that I care about than Company X has Y data on me. Do I trust that company to be secure? Maybe now, but later? And that's where the government issue comes in. It isn't always about what the government is now, but can become. It should always be set up to be that IF there somehow became a dictator or oligarch, that they couldn't gain trivial access to tools that would exert extreme control.

Or can a foreign adversary exert control by using these tools (cough Russia cough)?

Yes, that kind of thing is unlikely in America, but it is much more likely to happen in other countries and what we do in the First World affects them. I personally am not worried about Trump trying to become dictator, but do we really want to set the ground for someone 50-100 years down the line that might try? Or do we want to make such an action as difficult as possible? And if they do gain that power we want to limit it as much as possible. (What happens when your system fails? Design FOR failure)

3) The argument of "we'll always be fighting" is a sadly true, but one that you can't let yourself be disheartened by. Because that would be like someone saying "well hackers are always going to try to get into my bank account, so I might as well let them." Currently we are the underdogs, and that is why it is so much harder now. But the only way to change that is to gain a critical mass.

So I ask, even if you don't think there is anything you can do and you can not take the steps to add more than minimal protection, then TALK about it. To me, the worst thing that can happen is that the public becomes (stays) complacent. While they are complacent and do not understand the consequences, then there can be no change and it will be a fruitless fight. But I think right now we have the best opportunity we've had in a long time to convince average people to care. (Facebook, Equifax, GDPR, Russian Hacks (which show how VERY real the adversarial abuse of data from non-malicious actors can be), etc).

It's not like you have a choice for everything. You want a phone? Chose your evil: apple or google. And try using one of those without an account.

It's a signal. False positives need to be handled in some way. For captcha, they give you a captcha. For payments type stuff it's likely just one of hundreds of signals you can use to build a score that can raise a manual review above a certain threshold.

There is a company or two in this space that do an OK job of it.

The easy way around this as a scammer is to have the reference material visible beside the screen. I suspect it's another layer to augment existing verification checks. I do wonder about the false negative rate.

Unfortunately, this simplistic behavior modeling ends up being incompatible with autofill and password managers.

> though I suppose there's some potential for abuse, somehow?

One day you want to post online a video obtained through illegal means (for example you film animal abuse in a US abatory), you buy a burner phone and go to an open Wifi, but the behavioral fingerprint you left behind while using YouTube is used to track you down.

I guess this is still fair game, you were breaking the law after all, but you get the idea.

I guess it's a good thing that nobody with kids, a disability, or any other distractions ever fills out online forms when other things are happening in their homes, then!

I have often had my typing of personal information interrupted by my dog coming up and pushing my hand while I'm typing. Guess I wouldn't be able to apply for a loan from these people. Sheesh. What useless poppycock.

This would be a huge improvement in the quality of these stories.

There's a meaningful difference between something like Red Shell, where a few games gathered data that most others don't collect, and the stream of "apps log events!" stories which find some examples and present them as company-specific outrages instead of a nasty practice across the industry. Without understanding that, it's hard to have a useful discussion about tracking.

I think there's a fairly likely future that the banks and financial companies will try (and IMO succeed) to ban the providers of this data from using it for anything else. Aka: we will not use a biometrics service that uses our user's biometric data for anything other than fraud prevention and authentication.

The banks are ultra-sensitive about personal data at the moment at least, but they really want these kinds of solutions to stop fraud without interrupting your user experience. They have the scale to demand vendors stay in a particular use case and I think they'll succeed.

I would expect the future you're predicting to exist, but I expect it to come from e-commerce companies and others adopting tech from similar vendors but without demanding any restrictions on data use.

How would the browser know which to block?

`onClick(){fetchAllForumTopics();}` vs `onClick(){sendTrackingData();}`. Both are simple ajax calls.

Even if you somehow managed to know which calls to block, you could simply hack it by calling a jpg with extra parameters and then have the server save those:

`onClick(){body.css({backgroundImage: 'http :// mysite.com/ images/ logo.png?x=123&y=512&elementName=BankAccountNumber'});}`

I for one, prefer not to be harassed by popups all day. What you propose is EU check for cookies, EU check for privacy statement, GPS check accelerometer check, keyboard check?

Ok, now we are getting a little ridiculous. If keyboard usage can be checked, that would be a warning for nearly every website. This reminds me of the app usage warnings on Android, which request access for every phone function. Or in California, the "Known to the state of California to cause cancer" notices that are in literally every restaurant.

When everything has a warning sign on it, nothing does. Opt-in just trains the user to ignore all of the prompts. A better solution in my opinion, would be to improve browser security and don't allow these APIs to be exploited beyond narrow use cases. In the interim, extensions could be used to reduce the effectiveness of all manner of data collecting.

There also is something to be said about user habits. For example, some websites are very intrusive with ads. My solution? I don't visit that site and find the information elsewhere. This is where extensions or browser features would be great. What if we created a privacy index on each site? Then the user could choose whether a visit to that site is necessary.

You can’t easily block this without blocking a lot of legitimate behavior like rollover menus.

But how would that work? If I work on a word processing application, that application can be used to write horrible lies and propaganda that many people would believe. Are you saying I shouldn't work on such a product because of that?

If you look at the story of how browser cookies came about[0], it wasn't for advertising and tracking people. It was just intended to be a simple way to allow users to keep state between web pages to provide services the people wanted. It was later hijacked by ad companies to do surveillance and then the government hopped on board.

[0] https://en.wikipedia.org/wiki/HTTP_cookie#History

Do we technologists need to build privacy invading tools on every damn thing?

They are reporting on a problem that we keep creating. I don't see any problems with this.

They do it for two reasons:

1. Outrage sells, so they like to cause outrage.

2. Their business model was invalidated by technology 20 years ago and they're still fighting to stay relevant.

If you want to see how they really feel about privacy, just visit their site with an ad blocker and see how many trackers get blocked.

This article is in the business section of the newspaper. That's not exactly the optimal section if your intention was to "start a privacy panic about every damn thing."

Many people including myself were not familiar with the companies mentioned in this article or the use of their software for fraud prevention, these are the thrust of the article not hysteria.

Your conspiratorial assessment of this article seems to be misplaced.

We need a list of banks which do and don't track their users this way, or at least allow their customers to opt out.

FUD. Provide some proof when you make a claim like that. If you've ever worked outside of dev you know how a paper trail or physical recording is critical for everything that happens in a businesses. You think a bank would let a customer and rep make account changes over the phone and not have a recording of that? What happens when there is a disagreement about what was said?