5 ms·
It seems you have fullstory.com tracking all input & mouse events. Can you confirm? Every few seconds, a large payload goes to fullstory with all details:
by sbr464 7y ago
It seems you have fullstory.com tracking all input & mouse events. Can you confirm?
Every few seconds, a large payload goes to fullstory with all details:
47: {When: 397746, Kind: 2, Args: [8881, -1, [[4405, 2], "cell day blank"]]}
63: {When: 397746, Kind: 2, Args: [8881, -1, [[4405, 2], "cell day", [93, 2], "15", 96]]}
71: {When: 397746, Kind: 2, Args: [8881, -1, [[4405, 2], "cell day", [93, 2], "23", 96]]}
72: {When: 397746, Kind: 2, Args: [8881, -1, [[4405, 2], "cell day weekend sat", [93, 2], "24", 96]]}
73: {When: 397746, Kind: 2, Args: [8881, -1, [[4405, 2], "cell day weekend sun", [93, 2], "25", 96]]}
74: {When: 397746, Kind: 2, Args: [8881, -1, [[4405, 2], "cell day", [93, 2], 5593, 96]]}
90: {When: 397746, Kind: 2, Args: [9087, -1, [94, "Last note6m ago on 8/14/2019"]]}
91: {Kind: 4, When: 397746, Args: [8984, "class", "cell month selected"]}
92: {Kind: 4, When: 397746, Args: [8986, "class", "cell month"]}
94: {Kind: 6, When: 397746, Args: [8294, " in 14d"]}
95: {Kind: 6, When: 397746, Args: [8876, "Aug 2019"]}
- martin_a 7y agoHow would any website or application these days work _without_ full-blown analytics tracking the hell out of every user?
- diafygi 7y agoMy company doesn't. However, we've had a hell of a time finding a marketing firm that will work with us since we don't use Google Analytics. Seriously, we tell them over and over that we can't use Google Analytics (due to our site terms), and they are so confused and keep asking to be given access to it. Anyone know and marketing firms that are privacy aware/friendly?
- ChefboyOG 7y agoThere are plenty of firms that don't do paid ads or any sort of data-based retargeting of users (think content firms), but the problem likely is that without some sort of analytics, it will be really hard for them to gauge the impact of their work. For example, a content firm wouldn't need user data to write a blogpost for your company, but they would need some sort of event tracking to measure how many signups came from users who discovered your company via the blogpost. Figuring out a way to setup attribution and basic event tracking without being invasive or sharing user data with third parties would probably make it easier to find a firm.
- sorokod 7y agoBy using a business model that doesn't require raiding the customer's personal information.
- martin_a 7y agoPuh, not sure if that brings you the sweet, sweet investor money and some data leaks in the long tail. You should really go all in on data collection. Always!
- gkoberger 7y agoHmm, FullStory would be hard to use for evil. It's used to creators can track down issues and bugs and provide better customer support, not to do anything malicious. You can still argue you don't want your data sent to them, and that's very fair, but the only way this helps their business model is if their business model is "provide really good, tailored customer support."
- deleted 7y ago[deleted]
- sadok 7y agoI've used this, and HotJar, to see if users are having problems using a site. They are mostly usability tools, not keyloggers sending your data to the KGB.
- deleted 7y ago[deleted]
- sbr464 7y agoLet’s not kid ourselves. Bonus points, just imagine your data on the screens of employees/founders who think like this: https://help.fullstory.com/hc/en-us/articles/360020622934 https://help.fullstory.com/hc/en-us/articles/360020622934 https://twitter.com/vlio20/status/1148311522420170758?s=21 https://twitter.com/vlio20/status/1148311522420170758?s=21 https://twitter.com/carleebb/status/999311978060500992?s=21 https://twitter.com/carleebb/status/999311978060500992?s=21 https://twitter.com/laurentmtl/status/949531455964803072?s=21 https://twitter.com/laurentmtl/status/949531455964803072?s=2... https://twitter.com/ahgandhi/status/1117980573048483845?s=21 https://twitter.com/ahgandhi/status/1117980573048483845?s=21 https://twitter.com/paulmwatson/status/672093603519418372?s=21 https://twitter.com/paulmwatson/status/672093603519418372?s=... *note these are people sharing/bragging publicly.
- gexla 7y agoI have used HotJar, though not extensively. I played with it a bit and then handed it off to another dev. I feel tracking tools are more for marketing and conversions. You're looking at what the user is doing when going through the process of getting the to signup. I wouldn't think to use this tool in the inner portion of the app. On the outer part, there's not much to identify you. Anything session recording or heatmap is a step beyond what Google Analytics is doing, but it's not going to be sensitive data. Everything inside the app is sensitive. If there's a possibility of my actions being recorded, I would rather get warned about that or given a chance to opt-in for a session in return for a credit. This is the sort of thing I'm having less of a stomach for as the internet gets more nuts and my trail of dead sign-ups has grown over two decades plus some years. Your app better be damn good for me to get over that hesitance. And as I get older, I find that almost no apps are that good. I'll go to paper and pencil. IDGAF. Though I'm willing to give in a bit more to major names, even then we're seeing that Amazon and Microsoft is listening into voice from some of their products. I also think this is lazy for getting info on the usage of the actual app. Go ahead and analyze how your conversion process is going as you change your design. But for the actual app, maybe sit people down in front of you. Have people take a video of their usage. Ask for surveys. Don't just record my session of entering all the times I'm getting laid (along with their vital stats) without me knowing about it.
- neilv 7y agoIf legislators and law enforcement won't stop the widespread various kinds of secret spying behavior of dotcoms, we could try social pressure.
- gexla 7y agoI'm getting the same. I checked after leaving my previous comments in this thread. For example, began entering a manual contact and the name for that contact was sent to FullStory (that's as far as I looked.) The privacy statement for FullStory appears much different than that of Dex. https://www.fullstory.com/legal/privacy/ https://www.fullstory.com/legal/privacy/ https://getdex.com/privacypolicy https://getdex.com/privacypolicy That's enough for me. I understand I'm already sending my data, but there's no mention that my sensitive data is going to another service. And I would expect that my data is sent over a secure line and securely stored. And that it won't be "replayed" or otherwise viewed. EDIT: How do I delete my account? Consider that a feature request.
- martin_a 7y agoI don't think I need to mention that this is a massive violation of the GDPR.
- x0x0 7y agoHow exactly? The above data shows someone clicked in a cell, and edited a calendar date. There's no personal data present there at all. Even beyond that, site owners have a very colorable legitimate interest claim to look at site interactions in order to improve the UI.
- sbr464 7y agoIt does log all private data when logged in/using. Here is what is sent to fullstory when typing into an input. Below are the current filters in place for the fullstory config. 19: {When: 1800813, Kind: 18, Args: [1621, "Th"]} 22: {When: 1800932, Kind: 18, Args: [1621, "Tho"]} 24: {When: 1800976, Kind: 18, Args: [1621, "Thom"]} 27: {Kind: 4, When: 1801043, Args: [1667, "class", "feed- notice"]} 28: {When: 1801052, Kind: 18, Args: [1621, "Thoma"]} 31: {When: 1801157, Kind: 18, Args: [1621, "Thomas"]} { "Consented":false, "CookieDomain":"getdex.com", "AjaxWatcherEnabled":false, "ConsoleWatcherEnabled":true, "GetCurrentSessionEnabled":true, "ResourceUploadingEnabled":false, "WhitelistElementsEnabled":false, "ElementBlocks":[ { "Selector":"input[type=password]", "Consent":false, "Type":0 }, { "Selector":"input[type=hidden]", "Consent":false, "Type":0 }, { "Selector":"[autocomplete^=cc-]", "Consent":false, "Type":0 } ] }