18 ms·

Many popular websites see what you type before you hit submit

204 points by amanzi 4y ago

Dave3of5 4y ago
Btw it's worse that this. Most popular website are tracking your mouse movements and clicks on their website. It's called a user heatmap and it's meant to be used to see what users are actually clicking on when they drop into your website i.e. everyone highlighted this word on you copy or stopped scrolling after this section that sort of thing. It's been happening for many years. If you don't want to give websites this data block javascript in your browser by default.
- bennyp101 4y ago
  I don’t really have a problem with this - as long as it’s not tracking people - I don’t think it’s unreasonable to know where people are clicking most. Seems fairly sensible to figure out how to optimise the ui
  - rchaud 4y ago
    Precisely. If anything, session recordings are one of the least invasive forms of tracking because they restrict data collection to what you do on the website you're visiting. They don't record information typed into forms, e.g. addresses, emails, CC numbers. Well, some don't record by default, with others you have to specify that manually. Either way, it's better than a Facebook or Twitter Like buttons that infest the web and connect your visits with that site to your Twitter/FB account.
    - marcosdumay 4y ago
      Most software that does session recording also collect keyboard events.
  - ramesh31 4y ago
    >I don’t really have a problem with this - as long as it’s not tracking people It is. Everything you do is being logged and categorized, and your automatically assigned device fingerprinted user UID (whether you've made an account or not), is associated to all of your actions. Those associations are then dumped into a data lake for data scientists to mine for marketing purposes, and to cross-reference your activities across other sites.
    - feoren 4y ago
      Much of what you describe is immoral and/or illegal in the EU. It's certainly not the case that every site is breaking the law this way. You can get 90% of the benefit of analytics with anonymized data.
  - dave5104 4y ago
    > as long as it’s not tracking people I'm sure some sites don't do this, but plenty do. Check out FullStory. It's a drop-in Javascript snippet (aka accessible to any marketing/design folks) that records the DOM and rebuilds it as a playable video in their backend as if you were doing a screenshare and recording it. https://www.fullstory.com/ https://www.fullstory.com/
- ramesh31 4y ago
  >Most popular website are tracking your mouse movements and clicks on their website. It's called a user heatmap and it's meant to be used to see what users are actually clicking on when they drop into your website i.e. everyone highlighted this word on you copy or stopped scrolling after this section that sort of thing. It's even worse than this. They have full HD screen recordings of every single user session, including all values typed into any input field regardless of submission. I can pull up hundreds of thousands of unique user sessions right now and sit there watching everything they did on our sites, going back for years. Say it with me now: Every. Single. Interaction. With. Any. Computer. Is. Tracked.
  - konfusinomicon 4y ago
    I had a serious moral dilemma when I was tasked with implementing that product for a client. it definitely crosses the digital tracking creepy line
    - XCSme 4y ago
      Customers are already video recorded in a real life shop, which not only provides analytical data but also contains their personal information (face, credit card, what they purchased, etc.). Is anonymously tracking which buttons were clicked on a site more creepy?
      - rhn_mk1 4y ago
        No, but also recording customers is totally creepy, if you store that for later.
        XCSme 4y ago
        Some shops do apply machine learning on recorded videos of customers to find out more info about how they navigate the store. As far as I remember, even electronic advertising panels have cameras and track how long people are looking at the ad and store the age/race of the person.
      - 4y ago
- endemic 4y ago
  Yeah, I knew about heatmaps, but my eyes were opened further by a product that my current company uses that can replay a user’s actions on the entire site — it’s like watching over their shoulder.
- kornhole 4y ago
  And forms in many pages are analyzing text and typing patterns as you type. This can actually be used to identify someone. I generally resort to typing everything into a notepad and then pasting when ready. Whonix resolves this, but my work on work computer is slowed down by this inefficient process.
- deleted 4y ago
  [deleted]
- kaeruct 4y ago
  I know of hotjar, it's used in quite a few ecommerce sites. What other tools like it exist?
  - karaterobot 4y ago
    FullStory is a competitor. We used it at a previous company. From a product design perspective, it was amazing to have that tool available, to see where users were running into problems with our application. From a privacy perspective, I can definitely see how it would freak someone out.
- tmaly 4y ago
  could a browser extension be used to scramble the movement and click events?
hnrodey 4y ago
In the early days, Instagram silently uploaded your photo before you actually officially posted as a way to improve the "speed" of the user experience. So go ahead and add your filters, the text for the post, etc. because then the moment you clicked Post the app presented like it happened immediately. All for the UX. Source: Kevin Systrom on Lex Fridman Podcast https://www.youtube.com/watch?v=3pvpNKUPbIY https://www.youtube.com/watch?v=3pvpNKUPbIY
- webo 4y ago
  That doesn’t sound bad to me? Email attachments and file uploads have worked like that on the web way before instagram.
  - SamBam 4y ago
    For an email file attachment it quite clearly shows it uploading. The issue with the Instagram model is that it looks like you are just doing things locally on your phone, and haven't uploaded yet. If you have second thoughts and decide not to post the pic, Instagram could keep the photo. That said, I don't really see why they would do this. What would it gain them to keep millions of discarded photos?
    - webo 4y ago
      Iirc, they were saved as “drafts”, meaning you could come back to it later or on another device. Youtube was like that before instagram, it’s a popular feature on Snapchat/Tiktok. My point is that it is feature clearly people appreciated, not a dark UX pattern.
monkeybutton 4y ago
One fun and not so obvious insight learned from tracking what users type is that some users have an average message length longer than what they type.
- XCSme 4y ago
  I usually type my message, then reread it and optimize/shorten it if possible before submitting. Sometimes I even discard the message entirely.
  - monkeybutton 4y ago
    That would give you an average message length that's shorter than what you typed. In the case that it was longer, it turned out those users were copying and pasting the content, then maybe editing it a bit before sending.
    - XCSme 4y ago
      Oh, I got it now, so there were more characters than they typed.
      - monkeybutton 4y ago
        Yes! A clever trick to catch out spammers.
blueatlas 4y ago
Is there a browser extension that will show a visual indication of network activity so I know to take a closer look via the network monitor. I know - it might flash all the time, but at least I can take a closer look to assess the sites that I visit regularly.
- DerekBickerton 4y ago
  Not browser extensions, but firewalls where you can monitor your traffic on the OS: (TCP View is not really a firewall however, it just lets you inspect traffic, but not block it or filter it) https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch (Linux) https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html (Mac) https://www.glasswire.com/ https://www.glasswire.com/ (Windows) https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview https://docs.microsoft.com/en-us/sysinternals/downloads/tcpv... (Windows)
  - dewey 4y ago
    That doesn't really help you as if you want to use the website you already allow connections to that host and as far as I know these are mostly aimed at hostnames not the endpoint where the "creepy" request is being fired at.
    - DerekBickerton 4y ago
      > you already allow connections to that host Correct. You could always have JS disabled by default in uBlock Origin to mitigate JS snooping on sensitive info, so there is that. You can blacklist specific domains in uBlock too. We need something like Portmaster[0], but inside the browser as an extension. [0] https://safing.io/portmaster/ https://safing.io/portmaster/
      - dewey 4y ago
        That ship has sailed. Apart from a few of us nerds on HN nobody will do that. In reality people have a hard time seeing the problem with re-using a password, making people decide which hostnames are okay or vet javascript files before allowing them is unrealistic and not the solution to the problem.
DerekBickerton 4y ago
I once lost focus of my terminal and typed in my root password into Stack Overflow (I prolly had too many whiskeys). Glad Stack Overflow didn't have a covert keylogger, and JavaScript was disabled so I got lucky. Protip: Always make sure the focus is on your terminal when typing in credentials to it, or any input box that holds sensitive info. I sometimes forget to focus Firefox's master password prompt too and end up typing my Firefox master passphrase into other apps!
- travisporter 4y ago
  I cannot begin to express my rage at windows changing focus when typing. Is there no way for it to not do this when receiving input? Feels like it should be an OS feature
  - tailspin2019 4y ago
    macOS does this occasionally too, with pop ups sometimes appearing while I type (software update messages etc) Especially problematic if you happen to hit Enter for a line return and end up accepting the default selected button on the popup instead. I think there should be some OS-level heuristics-driven functionality to prevent or delay this sort of thing while the user is actually inputting data. And prevent any third party apps from overriding this unless consent is explicitly given (if the app really needs direct control over window focus) similar to how consent is required for apps to record the screen in macOS.
  - julius 4y ago
    With OpenBox (linux window manager thing ... included in eg LXDE) there is a configuration option called "Focus new windows when they appear". You can uncheck that (have not tried it myself).
  - pwg 4y ago
    This seems to be an artifact of OS's that also decide that "window on top must have keyboard focus" (i.e., MSWin is very bad in this regard). Because the pop-up dialog must be "on top" to be a pop-up, the OS's built in design of "window on top must have keyboard focus" results in the popup gaining keyboard focus, even if you are actively typing into another window at the same time. On my Linux system, I run Fvwm2, and because on X the decision to grant focus to a window lies with the window manager, I can control who gets focus via my Fvwm2 config. I have Fvwm2 set for focus follows mouse so unless a popup happens to appear, directly under where the mouse cursor happens to be at that moment, the popup can appear, and be "on top" and my keyboard focus is unchanged. I also have Fvwm2 configured so that a window gaining focus does not in any way change its order in the stack, so I can focus, and type, into a partially obscured window, without ever moving that window up/down from where it sits. An old version of OpenOffice (I think back when it was still called StarOffice) had decided at some point that if the mouse cursor so much as brushed across its window that it would pop itself to the top and take keyboard focus. That happened about two times, then I added a couple lines to my Fvwm2 config to take away StarOffice's ability to both take focus and to raise itself to the top, and it became a properly behaved program that stayed put until I told it specifically to move to the top. These kinds of irritants can be fixed, but only if the environment one uses gives one the ability to control these miss-behaviors.
titzer 4y ago
I love how this site rendered the full article but magically transformed itself to hide everything but the first paragraph, the words literally disappearing under my eyes. And then the rest of the page is "enjoy more great articles from Wired". Like, hello, I didn't even enjoy one!? A dark pattern all too common these days. I hate the modern web.
- anderber 4y ago
  Funny too, turning off JS for Wired not only stopped that behavior but made the page load incredibly fast.
  - JKCalhoun 4y ago
    Funny ha-ha or funny sad?
    - seanw444 4y ago
      More funny ridiculous.
- next_xibalba 4y ago
  > A dark pattern all too common these days. I hate the modern web. This is a belief I strongly disagree with that has become pervasive on HN: "I don't like this thing so it is a dark pattern/is toxic, etc." People will, on the one hand, decry the current state of news media and bemoan how Google and/or Facebook have destroyed or perversely mutated it, while, on the other hand, decry the efforts of the news media to monetize (aka get paid) for their efforts. There is no free lunch. Journalism isn't free. Labor isn't free. We certainly aren't entitled to the free use of the products of each other's labor.
  - dec0dedab0de 4y ago
    There is no free lunch. Journalism isn't free. Labor isn't free. We certainly aren't entitled to the free use of the products of each other's labor. Sure, but it's rude to present something and then take it away. Google used to downrank sites who did this, anyone remember how awful experts exchange was? If they want to have a paywall then they should have a paywall.
ramesh31 4y ago
Wait until they find out about Fullstory.
grumple 4y ago
This is pretty common and it's easy to do. It was popularized first by Google search decades ago, then by Facebook search. How do you think they make suggestions as you are typing? Responsiveness creates a better user experience. In our use cases we are using this primarily in search fields. In a few places we do queries onblur. The cost of these queries is trivial, directly hitting indexed db columns. I don't think we have any db inserts triggered from this behavior, and we don't log request params as a general rule (except rarely for short term debugging or non-sensitive performance tracking).
- JKCalhoun 4y ago
  It's wrong to do it on posts though. I have often responded to a comment with a rather heated reply before thinking better of it and hitting the Cancel button. I guess I like to vent but would rather my "venting" not end up in some site's DB.
  - grumple 4y ago
    Totally get it, and it is a problem. I don't like it, and I also don't like clipboard access. Browsers could have a mode that prevents this, similar to how certain features don't work unless a user has interacted with the page (like playing sound). Something like no queries when an input field contains data unless the user submits a form via a click or enter.
chmod775 4y ago
As an EU citizen, do the following: Paste some information about yourself into one of these forms without submitting, then send them an e-mail asking them to delete your personal information. Bonus points for having your lawyer write that mail, so it gets handled by their legal department instead of regular support. Watch them scramble trying to figure out how to even go about that. When gentle reminders to not irresponsibly collect data aren't enough, maybe a kick in the teeth will do. Shit sites becoming responsible for all the data they soak up couldn't have happened soon enough.
- deleted 4y ago
  [deleted]
- rchaud 4y ago
  Or just block the Facebook and Tiktok pixels at the browser level and save yourself the hassle.
- XCSme 4y ago
  Does a company break privacy laws if you bring a paper with your personal details and put it in their office without telling anyone?
  - moreira 4y ago
    No, but if they have a policy of collecting and saving any papers that people have on them, then they’re responsible for that collection. Which is what’s happening here - they’re collecting data that the user isn’t even submitting.
    - XCSme 4y ago
      If they know it's personal data and handle it accordingly it might be ok. What if the user submits personal data without being expected to? For example, I have to enter a nickname on online game before starting to play, what if my nickname is my full name and home address? Now they unknowingly store PII without a privacy policy. What should the company do in this case?
c22 4y ago
Just one more reason to leave javascript disabled. Demand user agents that represent the user.
zagrebian 4y ago
Breaking news: Thousands of popular supermarkets see what’s in your cart before you check out
- XCSme 4y ago
  Also, they can do this online even without JavaScript, the cart is often saved server-side.
HKH2 4y ago
I would be shocked if they didn't do that, since it tells you a lot about the user's inhibitions.
ChrisMarshallNY 4y ago
The Wired story seems a bit thin. Here's the original presentation: https://homes.esat.kuleuven.be/~asenol/leaky-forms/ https://homes.esat.kuleuven.be/~asenol/leaky-forms/ I had a friend that had his card charged, even though he hadn't actually completed it (He entered the card number and exp. date, but then left the shopping cart, without completing the transaction). The Web site owners were pretty damn aggressive, when he complained about it, but he was even more aggressive (he has since passed, but he was not someone that you wanted to mess with).
- throwawayboise 4y ago
  > He entered the card number and exp. date, but then left the shopping cart, without completing the transaction I do that somewhat often, for sites that don't reveal shipping charges and other components of the "final price" until the end. Sometimes at that point I'll change my mind. Never been charged, fortunately, but I have worried about the possibility.
- throw10920 4y ago
  > I had a friend that had his card charged, even though he hadn't actually completed it What site? I want to know what it is so I can suggest all of my friends avoid it like the plague.
  - ChrisMarshallNY 4y ago
    I have no idea. He told me about it, years ago. And then popped his clogs, so he took it to the grave with him. He was an IT guy, though, so it was probably a nerd site.
    - throw10920 4y ago
      That's unfortunate along multiple axes, I'm sorry :(
duxup 4y ago
How do they know what the difference is between a keylogger and auto-complete? I use auto complete A LOT and my customer's love it. On the back end I sure could be storing that information (I don't)... There's some good use cases that easily could be a keylogger, but aren't, or at least we don't know. Even if they store something that isn't auto complete it could be legitimate "hey are people stumbling over those stupid dashes all the time?" exploration of how the users do things. Real dark patterns, and legit features tend to intermix sometimes and the devil is in the details...
- my69thaccount 4y ago
  Your customers probably wouldn't love auto complete if they knew it was implemented as a key logger. Try doing it client side.
  - duxup 4y ago
    >Try doing it client side Do what client side? Store all the auto-complete possibilities client side? I think that doesn't make sense. But my larger point is you can't tell for sure if it is a keylogger or just something else.
    - vorpalhex 4y ago
      Nor does the difference matter to me as a user. If you're transmitting my keystrokes to your server.. it's a keylogger.
      - Shish2k 4y ago
        It’s really hard to have a meaningful discussion if we’re warping the definitions of words so much that “keylogger” now means something other than “a thing that logs keys” :(
        vorpalhex 4y ago
        If you are sending my keystrokes server side.. and your server has logs (as servers tend to do), don't you think you might be logging my keystrokes? You are literally transmitting my keystrokes through several log keeping machines, to a piece of software that probably keeps logs.
gbasin 4y ago
This is nasty, especially the plaintext password leak. I wonder if you could build a chrome extension to monitor for patterns like this — just like at the payloads being sent while you're typing and pattern-match (without keylogging itself, or maybe allow it but keep it open-source)
denton-scratch 4y ago
Hit "Subscribe" before you can see the article. I subscribe to exactly one website. If I subscribed to every subscription website that I read, I'd spend more on subscriptions than my income. So: F12, "display: none". Wut? Really? A one-paragraph article? I guess Wired can join NYT and Washpo as sites I'm not going to visit, because they don't want the likes of me to visit.
cloverich 4y ago
Aren't services like Heap effectively worse versions of this? On their landing page they outright list this as their value prop: > Heap collects all the data on your customers - automatically. What they click. Where they go. What they do, even when you’re not looking. All without the need for engineers. [1]: https://heap.io/ https://heap.io/
Vinnl 4y ago
Direct link to the research website: https://homes.esat.kuleuven.be/~asenol/leaky-forms/ https://homes.esat.kuleuven.be/~asenol/leaky-forms/
gniv 4y ago
I wonder if there's a way for ad blockers to block these requests -- the pre-submit non-user-driven requests -- without me turning off JS or anything drastic like that. I suspect the answer is no, but I'm wondering if it's at all feasible for an extension to do that.
fxtentacle 4y ago
Interesting question: If I have a keyboard that malfunctions so that it'll accidentally type gigabytes of data into the form (but never submit it)... is that still a DDoS or just an unfortunate keyboard malfunction?
- alwayslikethis 4y ago
  Would be good if someone modified the extension a bit, and make it send thousands of fake requests to pollute their data if this behavior is detected. Works like Adnauseum which works like ublock origin, except you can set it to click a portion of the ads to waste the advertiser's money while supporting the underlying websites.
  - fxtentacle 4y ago
    Great idea. Ideally, it would find their "contact us" email address and use that so that websites who implement this get a taste of their own medicine.
sam1r 4y ago
Correct me if I’m wrong.. But the simplest way to check would be 1. Inspect element > start recording under ‘Network’ 2. Press any key, and check for new requests visually that correlate to the time you pressed the key.
danielrhodes 4y ago
Do tech companies really store unbounded amounts of information, like keyboard strokes, from their users? For me this seems hard to believe, at least over the medium to long term. Storing data is not free and if you plan to use this data for anything it can definitely be not cheap (i.e. cold vs hot storage). When you extrapolate this to the scale of a service like Facebook or Google it becomes insanely expensive. So there would have to be some pretty clear monetary payoff to justify this expenditure. I understand the worries of privacy advocates, but I don't understand the economic incentive of keeping all this data. The only way it could possibly make sense is if it were highly aggregated, but at that point you nullify many of the privacy concerns.
- kibwen 4y ago
  We've known since 2013 that Facebook has been doing this, though they claim they're only storing metadata. It's not that hard to believe.
  - danielrhodes 4y ago
    You're welcome to request your data from Facebook and see if they have this data (assuming they are following the law, which I assume they are). I've requested my data from various companies and they did not have anything even close to this level of detail. That makes me think that if they do store data such as keystrokes or mouse clicks or whatever, it's being stored in a highly aggregated way, which doesn't bother me very much. But I also imagine one of the reasons they are storing data in an aggregated way is: 1) they don't need it at an individual level and/or 2) it's not cost effective.
- aeturnum 4y ago
  > Storing data is not free and if you plan to use this data for anything it can definitely be not cheap I think there are a lot of companies that are not running out of money and are holding on to a lot of data that might, someday, be valuable. Look at Google's features like spelling correction or search term suggestions - they likely used huge troves of semi-anonymous user input to develop and support them. > When you extrapolate this to the scale of a service like Facebook or Google it becomes insanely expensive This is just not true. Backblaze is putting their storage cost at ~$0.035 a gigabyte[1], which means you can store a megabyte of data for every human on earth for a bit under $300k a year (about 8 petabytes). Big companies probably can get even lower. This isn't...a negligible cost, but it's very normal at that scale. Google only has ~4.5 billion users and most companies have orders of magnitude fewer. [1] https://www.backblaze.com/blog/petabytes-on-a-budget-10-years-and-counting/ https://www.backblaze.com/blog/petabytes-on-a-budget-10-year...
me_me_mu_mu 4y ago
And here I am building my startup making sure I do my best to store as little user information in my servers as possible.
retox 4y ago
A while ago I was doing a review of youtuber merch sites to get an idea of the shipping charges to my corner of the world. The PewDiePie merch site requires you to enter an address and email before you can see shipping prices. It's on the same page as the quote generation but the form isn't submitted and an account isn't created. I didn't go any further than looking at the total price before leaving, then I got an email minutes after I closed the tab with a discount code.
shadowgovt 4y ago
This isn't terribly surprising given how many sites are architected so that the page running in your client is just the UI for an app running on a server. Auto completion of addresses, for example, requires this approach unless you want to download the entire planet's address database onto an end user's machine. Where Google goes, others will follow.
Agamus 4y ago
Every time I see an article like this, it disturbs me to think that it is 2022 and this is news to people.
- stewx 4y ago
  Unless you are ultra-paranoid or cynical, it is pretty reasonable to believe that a site is not submitting the contents of a form before you click the Submit button.
  - unsupp0rted 4y ago
    Especially because why would they? What do they gain from seeing first drafts of form submissions? The closest thing I can think of is as an "abandoned cart" for forms. "You were about to submit our contact form to ask about our software. Are you still interested in a demo? (we're evil, by the way)"
    - rchaud 4y ago
      Abandoned Cart is a good example. It takes the email address if it's been filled out and auto-sends a reminder email later. Not really the same thing as taking your payment and address information and sending it to some guy in a basement. Half-complete or incorrect data isn't an issue any company wants to deal with. Abandoned Cart functionality makes money, so that's why it's included.
    - mtreis86 4y ago
      Another use is for a form with questions, like you get in jobs postings. Seeing how someone types in the answers may be more revealing than the answer itself.
  - Agamus 4y ago
    Agreed, but it still disturbs me. And I do think that a normal person must be a bit pathologically skewed, here in 2022, if they are not a little bit cynical or paranoid when they interface with a computer. Finally, one can be ultra-paranoid, cynical, or just mildly knowledgeable about the technology upon which the entire modern experience depends.
baal80spam 4y ago
Just try to browse the web with noscript (most browsers have a switch to toggle JavaScript, alternatively use uBlock Origin) - many pages won't render at all! It's a really sad state of affairs. When I need to allow JavaScript on a page - I know all bets are off.
- Agamus 4y ago
  I have used this as a general policy for whether or not I interact with a site since about 2004. That policy has kept me 100% off Twitter, Facebook, etc, since they appeared. I highly recommend, for those who can live without the modern web reality.
- kkfx 4y ago
  I do that regularly, just allowing few websites and only for certain js, FF Reader also help sometime...
- pteraspidomorph 4y ago
  It's because modern client-side frameworks like react or vue use javascript for routing, and in fact storing every character in a form as you type it is a basic design principle in such frameworks. If you are curious, you can install their respective dev tool extensions so you can tell at a glance which framework a website is using by checking which button lights up in the browser toolbar. I like the uBlock Origin toggle myself, aka the "naughty website gets no javascript" button.
- forgotmypw17 4y ago
  I've noticed over time that requiring JS correlates heavily with low quality content and other abusive behavior, so closing the tab saves me time and nothing of value is lost.
mcdonje 4y ago
Privacy concerns aside, I'm having trouble understanding the value prop. It's more to build and maintain, requires more bandwidth and storage, and the resulting dataset is mostly noise or not significantly different from what was submitted. Data mining that would be a lot of work for very little gain in most cases.
- Dave3of5 4y ago
  > I'm having trouble understanding the value prop It'll be for abandoned signups. If someone is literally on the signup page but end up not clicking the submit button you want to find out what stopped them and coerce them somehow to actually clicking the button. The more data you gather about the process the more you can adapt the signup page to actually get them to click the button. It's really important for startups as one of their KPI's will be new signups per X. Companies like slack, facebook, youtube ..etc have teams of people who are working on this type of thing. Note: I do not condone this type of invasive analytics but I'm telling you why they do it that's all.
  - deleted 4y ago
    [deleted]
  - mcdonje 4y ago
    I hadn't thought of that, thanks. I suppose if there's a trend of users quitting when they get to a certain sign up field, the company can determine if that field can be changed or removed.
  - ohwellhere 4y ago
    I worked for a popular software services company that used this sort of thing on their inbound interest forms. They found that oftentimes prospective clients would write a first draft that was much more candid about what they wanted and what their budget was, and then they'd revise it to make it more circumspect before submitting. Going into negotiations, our side had the original unfiltered data.
    - 4y ago

204 points by amanzi 4y ago

Btw it's worse that this. Most popular website are tracking your mouse movements and clicks on their website. It's called a user heatmap and it's meant to be used to see what users are actually clicking on when they drop into your website i.e. everyone highlighted this word on you copy or stopped scrolling after this section that sort of thing. It's been happening for many years. If you don't want to give websites this data block javascript in your browser by default.

bennyp101 4y ago
I don’t really have a problem with this - as long as it’s not tracking people - I don’t think it’s unreasonable to know where people are clicking most. Seems fairly sensible to figure out how to optimise the ui
- rchaud 4y ago
  Precisely. If anything, session recordings are one of the least invasive forms of tracking because they restrict data collection to what you do on the website you're visiting. They don't record information typed into forms, e.g. addresses, emails, CC numbers. Well, some don't record by default, with others you have to specify that manually. Either way, it's better than a Facebook or Twitter Like buttons that infest the web and connect your visits with that site to your Twitter/FB account.
  - marcosdumay 4y ago
    Most software that does session recording also collect keyboard events.
- ramesh31 4y ago
  >I don’t really have a problem with this - as long as it’s not tracking people It is. Everything you do is being logged and categorized, and your automatically assigned device fingerprinted user UID (whether you've made an account or not), is associated to all of your actions. Those associations are then dumped into a data lake for data scientists to mine for marketing purposes, and to cross-reference your activities across other sites.
  - feoren 4y ago
    Much of what you describe is immoral and/or illegal in the EU. It's certainly not the case that every site is breaking the law this way. You can get 90% of the benefit of analytics with anonymized data.
- dave5104 4y ago
  > as long as it’s not tracking people I'm sure some sites don't do this, but plenty do. Check out FullStory. It's a drop-in Javascript snippet (aka accessible to any marketing/design folks) that records the DOM and rebuilds it as a playable video in their backend as if you were doing a screenshare and recording it. https://www.fullstory.com/ https://www.fullstory.com/
ramesh31 4y ago
>Most popular website are tracking your mouse movements and clicks on their website. It's called a user heatmap and it's meant to be used to see what users are actually clicking on when they drop into your website i.e. everyone highlighted this word on you copy or stopped scrolling after this section that sort of thing. It's even worse than this. They have full HD screen recordings of every single user session, including all values typed into any input field regardless of submission. I can pull up hundreds of thousands of unique user sessions right now and sit there watching everything they did on our sites, going back for years. Say it with me now: Every. Single. Interaction. With. Any. Computer. Is. Tracked.
- konfusinomicon 4y ago
  I had a serious moral dilemma when I was tasked with implementing that product for a client. it definitely crosses the digital tracking creepy line
  - XCSme 4y ago
    Customers are already video recorded in a real life shop, which not only provides analytical data but also contains their personal information (face, credit card, what they purchased, etc.). Is anonymously tracking which buttons were clicked on a site more creepy?
    - rhn_mk1 4y ago
      No, but also recording customers is totally creepy, if you store that for later.
      - XCSme 4y ago
        Some shops do apply machine learning on recorded videos of customers to find out more info about how they navigate the store. As far as I remember, even electronic advertising panels have cameras and track how long people are looking at the ad and store the age/race of the person.
    - 4y ago
endemic 4y ago
Yeah, I knew about heatmaps, but my eyes were opened further by a product that my current company uses that can replay a user’s actions on the entire site — it’s like watching over their shoulder.
kornhole 4y ago
And forms in many pages are analyzing text and typing patterns as you type. This can actually be used to identify someone. I generally resort to typing everything into a notepad and then pasting when ready. Whonix resolves this, but my work on work computer is slowed down by this inefficient process.
deleted 4y ago
[deleted]
kaeruct 4y ago
I know of hotjar, it's used in quite a few ecommerce sites. What other tools like it exist?
- karaterobot 4y ago
  FullStory is a competitor. We used it at a previous company. From a product design perspective, it was amazing to have that tool available, to see where users were running into problems with our application. From a privacy perspective, I can definitely see how it would freak someone out.
tmaly 4y ago
could a browser extension be used to scramble the movement and click events?

hnrodey 4y ago

In the early days, Instagram silently uploaded your photo before you actually officially posted as a way to improve the "speed" of the user experience. So go ahead and add your filters, the text for the post, etc. because then the moment you clicked Post the app presented like it happened immediately. All for the UX. Source: Kevin Systrom on Lex Fridman Podcast https://www.youtube.com/watch?v=3pvpNKUPbIY https://www.youtube.com/watch?v=3pvpNKUPbIY

webo 4y ago
That doesn’t sound bad to me? Email attachments and file uploads have worked like that on the web way before instagram.
- SamBam 4y ago
  For an email file attachment it quite clearly shows it uploading. The issue with the Instagram model is that it looks like you are just doing things locally on your phone, and haven't uploaded yet. If you have second thoughts and decide not to post the pic, Instagram could keep the photo. That said, I don't really see why they would do this. What would it gain them to keep millions of discarded photos?
  - webo 4y ago
    Iirc, they were saved as “drafts”, meaning you could come back to it later or on another device. Youtube was like that before instagram, it’s a popular feature on Snapchat/Tiktok. My point is that it is feature clearly people appreciated, not a dark UX pattern.

monkeybutton 4y ago

One fun and not so obvious insight learned from tracking what users type is that some users have an average message length longer than what they type.

XCSme 4y ago
I usually type my message, then reread it and optimize/shorten it if possible before submitting. Sometimes I even discard the message entirely.
- monkeybutton 4y ago
  That would give you an average message length that's shorter than what you typed. In the case that it was longer, it turned out those users were copying and pasting the content, then maybe editing it a bit before sending.
  - XCSme 4y ago
    Oh, I got it now, so there were more characters than they typed.
    - monkeybutton 4y ago
      Yes! A clever trick to catch out spammers.

blueatlas 4y ago

Is there a browser extension that will show a visual indication of network activity so I know to take a closer look via the network monitor. I know - it might flash all the time, but at least I can take a closer look to assess the sites that I visit regularly.

DerekBickerton 4y ago
Not browser extensions, but firewalls where you can monitor your traffic on the OS: (TCP View is not really a firewall however, it just lets you inspect traffic, but not block it or filter it) https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch (Linux) https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html (Mac) https://www.glasswire.com/ https://www.glasswire.com/ (Windows) https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview https://docs.microsoft.com/en-us/sysinternals/downloads/tcpv... (Windows)
- dewey 4y ago
  That doesn't really help you as if you want to use the website you already allow connections to that host and as far as I know these are mostly aimed at hostnames not the endpoint where the "creepy" request is being fired at.
  - DerekBickerton 4y ago
    > you already allow connections to that host Correct. You could always have JS disabled by default in uBlock Origin to mitigate JS snooping on sensitive info, so there is that. You can blacklist specific domains in uBlock too. We need something like Portmaster[0], but inside the browser as an extension. [0] https://safing.io/portmaster/ https://safing.io/portmaster/
    - dewey 4y ago
      That ship has sailed. Apart from a few of us nerds on HN nobody will do that. In reality people have a hard time seeing the problem with re-using a password, making people decide which hostnames are okay or vet javascript files before allowing them is unrealistic and not the solution to the problem.

DerekBickerton 4y ago

I once lost focus of my terminal and typed in my root password into Stack Overflow (I prolly had too many whiskeys). Glad Stack Overflow didn't have a covert keylogger, and JavaScript was disabled so I got lucky. Protip: Always make sure the focus is on your terminal when typing in credentials to it, or any input box that holds sensitive info. I sometimes forget to focus Firefox's master password prompt too and end up typing my Firefox master passphrase into other apps!

travisporter 4y ago
I cannot begin to express my rage at windows changing focus when typing. Is there no way for it to not do this when receiving input? Feels like it should be an OS feature
- tailspin2019 4y ago
  macOS does this occasionally too, with pop ups sometimes appearing while I type (software update messages etc) Especially problematic if you happen to hit Enter for a line return and end up accepting the default selected button on the popup instead. I think there should be some OS-level heuristics-driven functionality to prevent or delay this sort of thing while the user is actually inputting data. And prevent any third party apps from overriding this unless consent is explicitly given (if the app really needs direct control over window focus) similar to how consent is required for apps to record the screen in macOS.
- julius 4y ago
  With OpenBox (linux window manager thing ... included in eg LXDE) there is a configuration option called "Focus new windows when they appear". You can uncheck that (have not tried it myself).
- pwg 4y ago
  This seems to be an artifact of OS's that also decide that "window on top must have keyboard focus" (i.e., MSWin is very bad in this regard). Because the pop-up dialog must be "on top" to be a pop-up, the OS's built in design of "window on top must have keyboard focus" results in the popup gaining keyboard focus, even if you are actively typing into another window at the same time. On my Linux system, I run Fvwm2, and because on X the decision to grant focus to a window lies with the window manager, I can control who gets focus via my Fvwm2 config. I have Fvwm2 set for focus follows mouse so unless a popup happens to appear, directly under where the mouse cursor happens to be at that moment, the popup can appear, and be "on top" and my keyboard focus is unchanged. I also have Fvwm2 configured so that a window gaining focus does not in any way change its order in the stack, so I can focus, and type, into a partially obscured window, without ever moving that window up/down from where it sits. An old version of OpenOffice (I think back when it was still called StarOffice) had decided at some point that if the mouse cursor so much as brushed across its window that it would pop itself to the top and take keyboard focus. That happened about two times, then I added a couple lines to my Fvwm2 config to take away StarOffice's ability to both take focus and to raise itself to the top, and it became a properly behaved program that stayed put until I told it specifically to move to the top. These kinds of irritants can be fixed, but only if the environment one uses gives one the ability to control these miss-behaviors.

titzer 4y ago

I love how this site rendered the full article but magically transformed itself to hide everything but the first paragraph, the words literally disappearing under my eyes. And then the rest of the page is "enjoy more great articles from Wired". Like, hello, I didn't even enjoy one!? A dark pattern all too common these days. I hate the modern web.

anderber 4y ago
Funny too, turning off JS for Wired not only stopped that behavior but made the page load incredibly fast.
- JKCalhoun 4y ago
  Funny ha-ha or funny sad?
  - seanw444 4y ago
    More funny ridiculous.
next_xibalba 4y ago
> A dark pattern all too common these days. I hate the modern web. This is a belief I strongly disagree with that has become pervasive on HN: "I don't like this thing so it is a dark pattern/is toxic, etc." People will, on the one hand, decry the current state of news media and bemoan how Google and/or Facebook have destroyed or perversely mutated it, while, on the other hand, decry the efforts of the news media to monetize (aka get paid) for their efforts. There is no free lunch. Journalism isn't free. Labor isn't free. We certainly aren't entitled to the free use of the products of each other's labor.
- dec0dedab0de 4y ago
  There is no free lunch. Journalism isn't free. Labor isn't free. We certainly aren't entitled to the free use of the products of each other's labor. Sure, but it's rude to present something and then take it away. Google used to downrank sites who did this, anyone remember how awful experts exchange was? If they want to have a paywall then they should have a paywall.

ramesh31 4y ago

Wait until they find out about Fullstory.

grumple 4y ago

This is pretty common and it's easy to do. It was popularized first by Google search decades ago, then by Facebook search. How do you think they make suggestions as you are typing? Responsiveness creates a better user experience. In our use cases we are using this primarily in search fields. In a few places we do queries onblur. The cost of these queries is trivial, directly hitting indexed db columns. I don't think we have any db inserts triggered from this behavior, and we don't log request params as a general rule (except rarely for short term debugging or non-sensitive performance tracking).

JKCalhoun 4y ago
It's wrong to do it on posts though. I have often responded to a comment with a rather heated reply before thinking better of it and hitting the Cancel button. I guess I like to vent but would rather my "venting" not end up in some site's DB.
- grumple 4y ago
  Totally get it, and it is a problem. I don't like it, and I also don't like clipboard access. Browsers could have a mode that prevents this, similar to how certain features don't work unless a user has interacted with the page (like playing sound). Something like no queries when an input field contains data unless the user submits a form via a click or enter.

chmod775 4y ago

As an EU citizen, do the following: Paste some information about yourself into one of these forms without submitting, then send them an e-mail asking them to delete your personal information. Bonus points for having your lawyer write that mail, so it gets handled by their legal department instead of regular support. Watch them scramble trying to figure out how to even go about that. When gentle reminders to not irresponsibly collect data aren't enough, maybe a kick in the teeth will do. Shit sites becoming responsible for all the data they soak up couldn't have happened soon enough.

deleted 4y ago
[deleted]
rchaud 4y ago
Or just block the Facebook and Tiktok pixels at the browser level and save yourself the hassle.
XCSme 4y ago
Does a company break privacy laws if you bring a paper with your personal details and put it in their office without telling anyone?
- moreira 4y ago
  No, but if they have a policy of collecting and saving any papers that people have on them, then they’re responsible for that collection. Which is what’s happening here - they’re collecting data that the user isn’t even submitting.
  - XCSme 4y ago
    If they know it's personal data and handle it accordingly it might be ok. What if the user submits personal data without being expected to? For example, I have to enter a nickname on online game before starting to play, what if my nickname is my full name and home address? Now they unknowingly store PII without a privacy policy. What should the company do in this case?

c22 4y ago

Just one more reason to leave javascript disabled. Demand user agents that represent the user.

zagrebian 4y ago

Breaking news: Thousands of popular supermarkets see what’s in your cart before you check out

XCSme 4y ago
Also, they can do this online even without JavaScript, the cart is often saved server-side.

HKH2 4y ago

I would be shocked if they didn't do that, since it tells you a lot about the user's inhibitions.

ChrisMarshallNY 4y ago

The Wired story seems a bit thin. Here's the original presentation: https://homes.esat.kuleuven.be/~asenol/leaky-forms/ https://homes.esat.kuleuven.be/~asenol/leaky-forms/ I had a friend that had his card charged, even though he hadn't actually completed it (He entered the card number and exp. date, but then left the shopping cart, without completing the transaction). The Web site owners were pretty damn aggressive, when he complained about it, but he was even more aggressive (he has since passed, but he was not someone that you wanted to mess with).

throwawayboise 4y ago
> He entered the card number and exp. date, but then left the shopping cart, without completing the transaction I do that somewhat often, for sites that don't reveal shipping charges and other components of the "final price" until the end. Sometimes at that point I'll change my mind. Never been charged, fortunately, but I have worried about the possibility.
throw10920 4y ago
> I had a friend that had his card charged, even though he hadn't actually completed it What site? I want to know what it is so I can suggest all of my friends avoid it like the plague.
- ChrisMarshallNY 4y ago
  I have no idea. He told me about it, years ago. And then popped his clogs, so he took it to the grave with him. He was an IT guy, though, so it was probably a nerd site.
  - throw10920 4y ago
    That's unfortunate along multiple axes, I'm sorry :(

duxup 4y ago

How do they know what the difference is between a keylogger and auto-complete? I use auto complete A LOT and my customer's love it. On the back end I sure could be storing that information (I don't)... There's some good use cases that easily could be a keylogger, but aren't, or at least we don't know. Even if they store something that isn't auto complete it could be legitimate "hey are people stumbling over those stupid dashes all the time?" exploration of how the users do things. Real dark patterns, and legit features tend to intermix sometimes and the devil is in the details...

my69thaccount 4y ago
Your customers probably wouldn't love auto complete if they knew it was implemented as a key logger. Try doing it client side.
- duxup 4y ago
  >Try doing it client side Do what client side? Store all the auto-complete possibilities client side? I think that doesn't make sense. But my larger point is you can't tell for sure if it is a keylogger or just something else.
  - vorpalhex 4y ago
    Nor does the difference matter to me as a user. If you're transmitting my keystrokes to your server.. it's a keylogger.
    - Shish2k 4y ago
      It’s really hard to have a meaningful discussion if we’re warping the definitions of words so much that “keylogger” now means something other than “a thing that logs keys” :(
      - vorpalhex 4y ago
        If you are sending my keystrokes server side.. and your server has logs (as servers tend to do), don't you think you might be logging my keystrokes? You are literally transmitting my keystrokes through several log keeping machines, to a piece of software that probably keeps logs.

gbasin 4y ago

This is nasty, especially the plaintext password leak. I wonder if you could build a chrome extension to monitor for patterns like this — just like at the payloads being sent while you're typing and pattern-match (without keylogging itself, or maybe allow it but keep it open-source)

denton-scratch 4y ago

Hit "Subscribe" before you can see the article. I subscribe to exactly one website. If I subscribed to every subscription website that I read, I'd spend more on subscriptions than my income. So: F12, "display: none". Wut? Really? A one-paragraph article? I guess Wired can join NYT and Washpo as sites I'm not going to visit, because they don't want the likes of me to visit.

cloverich 4y ago

Aren't services like Heap effectively worse versions of this? On their landing page they outright list this as their value prop: > Heap collects all the data on your customers - automatically. What they click. Where they go. What they do, even when you’re not looking. All without the need for engineers. [1]: https://heap.io/ https://heap.io/

Vinnl 4y ago

Direct link to the research website: https://homes.esat.kuleuven.be/~asenol/leaky-forms/ https://homes.esat.kuleuven.be/~asenol/leaky-forms/

gniv 4y ago

I wonder if there's a way for ad blockers to block these requests -- the pre-submit non-user-driven requests -- without me turning off JS or anything drastic like that. I suspect the answer is no, but I'm wondering if it's at all feasible for an extension to do that.

fxtentacle 4y ago

Interesting question: If I have a keyboard that malfunctions so that it'll accidentally type gigabytes of data into the form (but never submit it)... is that still a DDoS or just an unfortunate keyboard malfunction?

alwayslikethis 4y ago
Would be good if someone modified the extension a bit, and make it send thousands of fake requests to pollute their data if this behavior is detected. Works like Adnauseum which works like ublock origin, except you can set it to click a portion of the ads to waste the advertiser's money while supporting the underlying websites.
- fxtentacle 4y ago
  Great idea. Ideally, it would find their "contact us" email address and use that so that websites who implement this get a taste of their own medicine.

sam1r 4y ago

Correct me if I’m wrong.. But the simplest way to check would be 1. Inspect element > start recording under ‘Network’ 2. Press any key, and check for new requests visually that correlate to the time you pressed the key.

danielrhodes 4y ago

Do tech companies really store unbounded amounts of information, like keyboard strokes, from their users? For me this seems hard to believe, at least over the medium to long term. Storing data is not free and if you plan to use this data for anything it can definitely be not cheap (i.e. cold vs hot storage). When you extrapolate this to the scale of a service like Facebook or Google it becomes insanely expensive. So there would have to be some pretty clear monetary payoff to justify this expenditure. I understand the worries of privacy advocates, but I don't understand the economic incentive of keeping all this data. The only way it could possibly make sense is if it were highly aggregated, but at that point you nullify many of the privacy concerns.

kibwen 4y ago
We've known since 2013 that Facebook has been doing this, though they claim they're only storing metadata. It's not that hard to believe.
- danielrhodes 4y ago
  You're welcome to request your data from Facebook and see if they have this data (assuming they are following the law, which I assume they are). I've requested my data from various companies and they did not have anything even close to this level of detail. That makes me think that if they do store data such as keystrokes or mouse clicks or whatever, it's being stored in a highly aggregated way, which doesn't bother me very much. But I also imagine one of the reasons they are storing data in an aggregated way is: 1) they don't need it at an individual level and/or 2) it's not cost effective.
aeturnum 4y ago
> Storing data is not free and if you plan to use this data for anything it can definitely be not cheap I think there are a lot of companies that are not running out of money and are holding on to a lot of data that might, someday, be valuable. Look at Google's features like spelling correction or search term suggestions - they likely used huge troves of semi-anonymous user input to develop and support them. > When you extrapolate this to the scale of a service like Facebook or Google it becomes insanely expensive This is just not true. Backblaze is putting their storage cost at ~$0.035 a gigabyte[1], which means you can store a megabyte of data for every human on earth for a bit under $300k a year (about 8 petabytes). Big companies probably can get even lower. This isn't...a negligible cost, but it's very normal at that scale. Google only has ~4.5 billion users and most companies have orders of magnitude fewer. [1] https://www.backblaze.com/blog/petabytes-on-a-budget-10-years-and-counting/ https://www.backblaze.com/blog/petabytes-on-a-budget-10-year...

me_me_mu_mu 4y ago

And here I am building my startup making sure I do my best to store as little user information in my servers as possible.

retox 4y ago

A while ago I was doing a review of youtuber merch sites to get an idea of the shipping charges to my corner of the world. The PewDiePie merch site requires you to enter an address and email before you can see shipping prices. It's on the same page as the quote generation but the form isn't submitted and an account isn't created. I didn't go any further than looking at the total price before leaving, then I got an email minutes after I closed the tab with a discount code.

shadowgovt 4y ago

This isn't terribly surprising given how many sites are architected so that the page running in your client is just the UI for an app running on a server. Auto completion of addresses, for example, requires this approach unless you want to download the entire planet's address database onto an end user's machine. Where Google goes, others will follow.

Agamus 4y ago

Every time I see an article like this, it disturbs me to think that it is 2022 and this is news to people.

stewx 4y ago
Unless you are ultra-paranoid or cynical, it is pretty reasonable to believe that a site is not submitting the contents of a form before you click the Submit button.
- unsupp0rted 4y ago
  Especially because why would they? What do they gain from seeing first drafts of form submissions? The closest thing I can think of is as an "abandoned cart" for forms. "You were about to submit our contact form to ask about our software. Are you still interested in a demo? (we're evil, by the way)"
  - rchaud 4y ago
    Abandoned Cart is a good example. It takes the email address if it's been filled out and auto-sends a reminder email later. Not really the same thing as taking your payment and address information and sending it to some guy in a basement. Half-complete or incorrect data isn't an issue any company wants to deal with. Abandoned Cart functionality makes money, so that's why it's included.
  - mtreis86 4y ago
    Another use is for a form with questions, like you get in jobs postings. Seeing how someone types in the answers may be more revealing than the answer itself.
- Agamus 4y ago
  Agreed, but it still disturbs me. And I do think that a normal person must be a bit pathologically skewed, here in 2022, if they are not a little bit cynical or paranoid when they interface with a computer. Finally, one can be ultra-paranoid, cynical, or just mildly knowledgeable about the technology upon which the entire modern experience depends.

baal80spam 4y ago

Just try to browse the web with noscript (most browsers have a switch to toggle JavaScript, alternatively use uBlock Origin) - many pages won't render at all! It's a really sad state of affairs. When I need to allow JavaScript on a page - I know all bets are off.

Agamus 4y ago
I have used this as a general policy for whether or not I interact with a site since about 2004. That policy has kept me 100% off Twitter, Facebook, etc, since they appeared. I highly recommend, for those who can live without the modern web reality.
kkfx 4y ago
I do that regularly, just allowing few websites and only for certain js, FF Reader also help sometime...
pteraspidomorph 4y ago
It's because modern client-side frameworks like react or vue use javascript for routing, and in fact storing every character in a form as you type it is a basic design principle in such frameworks. If you are curious, you can install their respective dev tool extensions so you can tell at a glance which framework a website is using by checking which button lights up in the browser toolbar. I like the uBlock Origin toggle myself, aka the "naughty website gets no javascript" button.
forgotmypw17 4y ago
I've noticed over time that requiring JS correlates heavily with low quality content and other abusive behavior, so closing the tab saves me time and nothing of value is lost.

mcdonje 4y ago

Privacy concerns aside, I'm having trouble understanding the value prop. It's more to build and maintain, requires more bandwidth and storage, and the resulting dataset is mostly noise or not significantly different from what was submitted. Data mining that would be a lot of work for very little gain in most cases.

Dave3of5 4y ago
> I'm having trouble understanding the value prop It'll be for abandoned signups. If someone is literally on the signup page but end up not clicking the submit button you want to find out what stopped them and coerce them somehow to actually clicking the button. The more data you gather about the process the more you can adapt the signup page to actually get them to click the button. It's really important for startups as one of their KPI's will be new signups per X. Companies like slack, facebook, youtube ..etc have teams of people who are working on this type of thing. Note: I do not condone this type of invasive analytics but I'm telling you why they do it that's all.
- deleted 4y ago
  [deleted]
- mcdonje 4y ago
  I hadn't thought of that, thanks. I suppose if there's a trend of users quitting when they get to a certain sign up field, the company can determine if that field can be changed or removed.
- ohwellhere 4y ago
  I worked for a popular software services company that used this sort of thing on their inbound interest forms. They found that oftentimes prospective clients would write a first draft that was much more candid about what they wanted and what their budget was, and then they'd revise it to make it more circumspect before submitting. Going into negotiations, our side had the original unfiltered data.
  - 4y ago