15 ms·

Sounds creepy af. It's stuff like this that makes me keep javascript disabled whenever possible.

drdeca 6y ago
On the one hand, I agree that the capability is concerning, but if it only records the behavior within a single visit and doesn't correlate it with an account, or across multiple visits, or across websites at all, I think that that probably wouldn't be much of an issue, for me at least. However, I don't see a way to allow that without also making the aforementioned unwanted connections also possible.
- lmkg 6y ago
  Here's the documentation for passing a user identifier to Hotjar: https://help.hotjar.com/hc/en-us/articles/360033640653-Identify-API-Reference#handling_user_ids https://help.hotjar.com/hc/en-us/articles/360033640653-Ident... This is a bit better than it used to be. At one point the documentation had a field for User Email Address, and only a footnote in some documentation suggested it be hashed. Still, for a company that chooses to use the feature, the session recording can be tied back to the user account and any data already associated with it.
  - drdeca 6y ago
    thanks
  - capitol_ 6y ago
    Hashing email addresses doesn't really work. Most people don't use unique addresses per service and its easy to get a large list of email addresses that you can hash and do lookups in.
- deleted 6y ago
  [deleted]
echlebek 6y ago
Funny you should say that, I just blacklisted hotjar this morning in noscript!
privateprofile 6y ago
It's also blocked by default by uBlock Origin, fortunately.
stiray 6y ago
Naah, just install adnauseum [1] and thank advertisers for forcing you to use adblocker. Let them pay for all the manace they couse to you and help ad networks to build completely wrong profile on you. [1] https://adnauseam.io/ https://adnauseam.io/
- nix23 6y ago
  Hehe yes since i installed adnauseum i love ad's...and i love that they have to pay for it, atm at 5732$ ;)
  - mike_d 6y ago
    Make sure you keep all your software up to date. Malvertising is pretty common, and adnauseum does a great job at firing payloads on your machine. It is the equivalent of installing an app that silently opens every attachment that is emailed to you.
    - beervirus 6y ago
      They deny this, but I have no idea how accurate the denial is. https://github.com/dhowe/AdNauseam/wiki/FAQ#does-adnauseams-clicking-put-me-at-risk-for-malicious-ads-or-ransomware https://github.com/dhowe/AdNauseam/wiki/FAQ#does-adnauseams-...
    - nix23 6y ago
      Had the same idea, but my OS is so uncommon that malware probably does not exist (if it's not a targeted attack).
    - Nextgrid 6y ago
      They should make it so that it talks to a VM (with no persistent storage) and sends the links to be opened to it (with the current browser's context such as cookies, etc so attribution still works).
qkeast 6y ago
I think it goes so far as to be unethical, because it takes advantage of a gap in understanding[1] where most users aren't even aware of the possibility of this being possible. [1] https://quinnkeast.com/writing/the-possibility-gap-its-time-to-label-this-dark-pattern/ https://quinnkeast.com/writing/the-possibility-gap-its-time-...

On the one hand, I agree that the capability is concerning, but if it only records the behavior within a single visit and doesn't correlate it with an account, or across multiple visits, or across websites at all, I think that that probably wouldn't be much of an issue, for me at least. However, I don't see a way to allow that without also making the aforementioned unwanted connections also possible.

lmkg 6y ago
Here's the documentation for passing a user identifier to Hotjar: https://help.hotjar.com/hc/en-us/articles/360033640653-Identify-API-Reference#handling_user_ids https://help.hotjar.com/hc/en-us/articles/360033640653-Ident... This is a bit better than it used to be. At one point the documentation had a field for User Email Address, and only a footnote in some documentation suggested it be hashed. Still, for a company that chooses to use the feature, the session recording can be tied back to the user account and any data already associated with it.
- drdeca 6y ago
  thanks
- capitol_ 6y ago
  Hashing email addresses doesn't really work. Most people don't use unique addresses per service and its easy to get a large list of email addresses that you can hash and do lookups in.
deleted 6y ago
[deleted]

echlebek 6y ago

Funny you should say that, I just blacklisted hotjar this morning in noscript!

privateprofile 6y ago

It's also blocked by default by uBlock Origin, fortunately.

stiray 6y ago

Naah, just install adnauseum [1] and thank advertisers for forcing you to use adblocker. Let them pay for all the manace they couse to you and help ad networks to build completely wrong profile on you. [1] https://adnauseam.io/ https://adnauseam.io/

nix23 6y ago
Hehe yes since i installed adnauseum i love ad's...and i love that they have to pay for it, atm at 5732$ ;)
- mike_d 6y ago
  Make sure you keep all your software up to date. Malvertising is pretty common, and adnauseum does a great job at firing payloads on your machine. It is the equivalent of installing an app that silently opens every attachment that is emailed to you.
  - beervirus 6y ago
    They deny this, but I have no idea how accurate the denial is. https://github.com/dhowe/AdNauseam/wiki/FAQ#does-adnauseams-clicking-put-me-at-risk-for-malicious-ads-or-ransomware https://github.com/dhowe/AdNauseam/wiki/FAQ#does-adnauseams-...
  - nix23 6y ago
    Had the same idea, but my OS is so uncommon that malware probably does not exist (if it's not a targeted attack).
  - Nextgrid 6y ago
    They should make it so that it talks to a VM (with no persistent storage) and sends the links to be opened to it (with the current browser's context such as cookies, etc so attribution still works).

qkeast 6y ago

I think it goes so far as to be unethical, because it takes advantage of a gap in understanding[1] where most users aren't even aware of the possibility of this being possible. [1] https://quinnkeast.com/writing/the-possibility-gap-its-time-to-label-this-dark-pattern/ https://quinnkeast.com/writing/the-possibility-gap-its-time-...