4 ms·

RMS has been writing about the issue of non-free session recording scripts in The JavaScript Trap[0]: > In addition to being nonfree, many of these programs ar

by hjek 8y ago

RMS has been writing about the issue of non-free session recording scripts in The JavaScript Trap[0]: > In addition to being nonfree, many of these programs are malware because they snoop on the user. Even nastier, some sites use services which record all the user's actions while looking at the page.[1] The services supposedly “redact” the recordings to exclude some sensitive data that the web site shouldn't get. But even if that works reliably, the whole purpose of these services is to give the web site other personal data that it shouldn't get. [0]: https://www.gnu.org/philosophy/javascript-trap.html https://www.gnu.org/philosophy/javascript-trap.html [1]: https://freedom-to-tinker.com/2017/11/15/no-boundaries-exfiltration-of-personal-data-by-session-replay-scripts/ https://freedom-to-tinker.com/2017/11/15/no-boundaries-exfil...

SquareWheel 8y ago
I agree with the privacy concern, but calling analytics software "malware" is too extreme. It isn't mining for bitcoins on your hardware, or encrypting your documents to extort you. Always using the most extreme terms just makes it easier to dismiss such views outright.
- hjek 8y ago
  I think it depends on how the software is used. A friend of mine got a suspicious tax returns email that had a link to a form asking for credit card information. Being careful and responsible, my friend of course asked me if the site looked legit before actually pressing 'submit'. Of course it was a scam site, and using session recording, they could very well have gotten my friend's credit card details without per pressing 'submit'. I think it's always the context that decides whether something is malware. Is a program that erases everything on your disk malware? Perhaps, but if it's a disk formatting tool and you asked it to do so, then it's not.
  - SquareWheel 8y ago
    Yes, that's a fair point and I agree with you on both examples.
  - dceddia 8y ago
    It's a good example, and something I often wonder about when I'm filling out a survey and give up part-way -- did they save the questions I had already answered? FWIW you probably wouldn't need something as powerful or blunt as session recording to pull this off, though. You'd only need to listen for keystrokes on the relevant input (with document.addEventListener or similar), and send them to the server as they're typed. Same with partially-filled surveys. IIRC Facebook got in some heat a while ago for sending the partially-typed messages up to the server and to the other chat participant.

by hjek 8y ago

SquareWheel 8y ago

I agree with the privacy concern, but calling analytics software "malware" is too extreme. It isn't mining for bitcoins on your hardware, or encrypting your documents to extort you. Always using the most extreme terms just makes it easier to dismiss such views outright.

hjek 8y ago
I think it depends on how the software is used. A friend of mine got a suspicious tax returns email that had a link to a form asking for credit card information. Being careful and responsible, my friend of course asked me if the site looked legit before actually pressing 'submit'. Of course it was a scam site, and using session recording, they could very well have gotten my friend's credit card details without per pressing 'submit'. I think it's always the context that decides whether something is malware. Is a program that erases everything on your disk malware? Perhaps, but if it's a disk formatting tool and you asked it to do so, then it's not.
- SquareWheel 8y ago
  Yes, that's a fair point and I agree with you on both examples.
- dceddia 8y ago
  It's a good example, and something I often wonder about when I'm filling out a survey and give up part-way -- did they save the questions I had already answered? FWIW you probably wouldn't need something as powerful or blunt as session recording to pull this off, though. You'd only need to listen for keystrokes on the relevant input (with document.addEventListener or similar), and send them to the server as they're typed. Same with partially-filled surveys. IIRC Facebook got in some heat a while ago for sending the partially-typed messages up to the server and to the other chat participant.