Comment by sbr464 | Hacker News Reader

Comment by sbr464 | Hacker News Reader

It seems you have fullstory.com tracking all input & mouse events. Can you confirm?

Every few seconds, a large payload goes to fullstory with all details:

  47: {When: 397746, Kind: 2, Args: [8881, -1, [[4405, 2], "cell day blank"]]}
  63: {When: 397746, Kind: 2, Args: [8881, -1, [[4405, 2], "cell day", [93, 2], "15", 96]]}
  71: {When: 397746, Kind: 2, Args: [8881, -1, [[4405, 2], "cell day", [93, 2], "23", 96]]}
  72: {When: 397746, Kind: 2, Args: [8881, -1, [[4405, 2], "cell day weekend sat", [93, 2], "24", 96]]}
  73: {When: 397746, Kind: 2, Args: [8881, -1, [[4405, 2], "cell day weekend sun", [93, 2], "25", 96]]}
  74: {When: 397746, Kind: 2, Args: [8881, -1, [[4405, 2], "cell day", [93, 2], 5593, 96]]}
  90: {When: 397746, Kind: 2, Args: [9087, -1, [94, "Last note6m ago on 8/14/2019"]]}
  91: {Kind: 4, When: 397746, Args: [8984, "class", "cell month selected"]}
  92: {Kind: 4, When: 397746, Args: [8986, "class", "cell month"]}
  94: {Kind: 6, When: 397746, Args: [8294, " in 14d"]}
  95: {Kind: 6, When: 397746, Args: [8876, "Aug 2019"]}

I'm getting the same. I checked after leaving my previous comments in this thread.

For example, began entering a manual contact and the name for that contact was sent to FullStory (that's as far as I looked.)

The privacy statement for FullStory appears much different than that of Dex.

https://www.fullstory.com/legal/privacy/

https://getdex.com/privacypolicy

That's enough for me. I understand I'm already sending my data, but there's no mention that my sensitive data is going to another service. And I would expect that my data is sent over a secure line and securely stored. And that it won't be "replayed" or otherwise viewed.

EDIT: How do I delete my account? Consider that a feature request.

I don't think I need to mention that this is a massive violation of the GDPR.

How exactly?

The above data shows someone clicked in a cell, and edited a calendar date. There's no personal data present there at all.

Even beyond that, site owners have a very colorable legitimate interest claim to look at site interactions in order to improve the UI.

It does log all private data when logged in/using.

Here is what is sent to fullstory when typing into an input. Below are the current filters in place for the fullstory config.

  19: {When: 1800813, Kind: 18, Args: [1621, "Th"]}
  22: {When: 1800932, Kind: 18, Args: [1621, "Tho"]}
  24: {When: 1800976, Kind: 18, Args: [1621, "Thom"]}
  27: {Kind: 4, When: 1801043, Args: [1667, "class", "feed- notice"]}
  28: {When: 1801052, Kind: 18, Args: [1621, "Thoma"]}
  31: {When: 1801157, Kind: 18, Args: [1621, "Thomas"]}
  
  {
   "Consented":false,
   "CookieDomain":"getdex.com",
   "AjaxWatcherEnabled":false,
   "ConsoleWatcherEnabled":true,
   "GetCurrentSessionEnabled":true,
   "ResourceUploadingEnabled":false,
   "WhitelistElementsEnabled":false,
   "ElementBlocks":[
     {
       "Selector":"input[type=password]",
       "Consent":false,
       "Type":0
     },
     {
       "Selector":"input[type=hidden]",
       "Consent":false,
       "Type":0
     },
     {
       "Selector":"[autocomplete^=cc-]",
       "Consent":false,
       "Type":0
     }
   ]
 }

So your complaint is ... they collect the data you typed into the application? Fullstory almost certainly has a DPA with dex specifying Fullstory can't use the data for anything but servicing Dex.

How would any website or application these days work _without_ full-blown analytics tracking the hell out of every user?

By using a business model that doesn't require raiding the customer's personal information.

Puh, not sure if that brings you the sweet, sweet investor money and some data leaks in the long tail. You should really go all in on data collection. Always!

Hmm, FullStory would be hard to use for evil. It's used to creators can track down issues and bugs and provide better customer support, not to do anything malicious.

You can still argue you don't want your data sent to them, and that's very fair, but the only way this helps their business model is if their business model is "provide really good, tailored customer support."

My company doesn't. However, we've had a hell of a time finding a marketing firm that will work with us since we don't use Google Analytics. Seriously, we tell them over and over that we can't use Google Analytics (due to our site terms), and they are so confused and keep asking to be given access to it.

Anyone know and marketing firms that are privacy aware/friendly?

There are plenty of firms that don't do paid ads or any sort of data-based retargeting of users (think content firms), but the problem likely is that without some sort of analytics, it will be really hard for them to gauge the impact of their work.

For example, a content firm wouldn't need user data to write a blogpost for your company, but they would need some sort of event tracking to measure how many signups came from users who discovered your company via the blogpost.

Figuring out a way to setup attribution and basic event tracking without being invasive or sharing user data with third parties would probably make it easier to find a firm.

I've used this, and HotJar, to see if users are having problems using a site. They are mostly usability tools, not keyloggers sending your data to the KGB.

Let’s not kid ourselves. Bonus points, just imagine your data on the screens of employees/founders who think like this:

https://help.fullstory.com/hc/en-us/articles/360020622934

https://twitter.com/vlio20/status/1148311522420170758?s=21

https://twitter.com/carleebb/status/999311978060500992?s=21

https://twitter.com/laurentmtl/status/949531455964803072?s=2...

https://twitter.com/ahgandhi/status/1117980573048483845?s=21

https://twitter.com/paulmwatson/status/672093603519418372?s=...

*note these are people sharing/bragging publicly.

I have used HotJar, though not extensively. I played with it a bit and then handed it off to another dev.

I feel tracking tools are more for marketing and conversions. You're looking at what the user is doing when going through the process of getting the to signup.

I wouldn't think to use this tool in the inner portion of the app. On the outer part, there's not much to identify you. Anything session recording or heatmap is a step beyond what Google Analytics is doing, but it's not going to be sensitive data.

Everything inside the app is sensitive. If there's a possibility of my actions being recorded, I would rather get warned about that or given a chance to opt-in for a session in return for a credit.

This is the sort of thing I'm having less of a stomach for as the internet gets more nuts and my trail of dead sign-ups has grown over two decades plus some years. Your app better be damn good for me to get over that hesitance. And as I get older, I find that almost no apps are that good. I'll go to paper and pencil. IDGAF. Though I'm willing to give in a bit more to major names, even then we're seeing that Amazon and Microsoft is listening into voice from some of their products.

I also think this is lazy for getting info on the usage of the actual app. Go ahead and analyze how your conversion process is going as you change your design. But for the actual app, maybe sit people down in front of you. Have people take a video of their usage. Ask for surveys. Don't just record my session of entering all the times I'm getting laid (along with their vital stats) without me knowing about it.

The logs/tracking mentioned are from the internal/logged in app.

Ugh, thanks for the detective work. This is something I forget about and now it's back on my radar. I'm sure someone has already thought about this, but an idea might be a checklist on Github for things to check when evaluating an app. And yet another good reason for giving some sort of opt-out option on giving any further data than sign-up. IDGAF about what you think the starting experience should be like. Let me use the app before dumping all my data into it and then finding out 2 minutes later that it's not for me.

Remember kids, a shotgun can be a useful tool, but you can also shoot yourself in the foot with it.

If legislators and law enforcement won't stop the widespread various kinds of secret spying behavior of dotcoms, we could try social pressure.

Reply on news.ycombinator.com