4 ms·
+1 for highlighting the privacy concerns, but -1 for blaming the software for not having strong enough defaults. As someone who has integrated FullStory into a
by kevinconroy 9y ago
+1 for highlighting the privacy concerns, but -1 for blaming the software for not having strong enough defaults.
As someone who has integrated FullStory into a production site, I spent several days doing a careful audit of our forms and redacting fields from being tracked. FullStory has an excellent, universal account setting to automatically redact fields based on any CSS selector, so it's very, very easy to tell it to remove any sensitive information - or even all form fields! - if that's what the website publisher desires. Out of the box I found that it correctly blocked credit card fields and passwords correctly, and we were able to add additional fields that are sensitive.
Again, rightly so that a website publisher may want more information than you desire, but they could also store your info in plaintext in the database, making it easy for hackers to exfiltrate as well. Yes, this is another vector, but hardly the easiest one.
- kevinconroy 9y agoCorrection: I wrote redacting when I meant exclusion. My apologies!
- joosters 9y agoIt's still a broken process. Are you going to re-audit every future change to your web site? I doubt it. The default, as the article suggests, should be to redact all fields, then let the company opt-in the fields that they really mean to record.
- kevinconroy 9y agoIf a company is serious about security and privacy, they have to do those audits for every feature, regardless of if they use these tools. PCI requires this if you handle money online. Still, you're right that many companies have a surprising lack of security. This vector of unintentional exfiltration may pale in comparison to the intentional mismanagement and lack of security focus internally. Equifax, anyone?
- maxerickson 9y agoWhat would be the problem with making the default to collect nothing (so the dev would have to opt in for everything they wanted to collect)?