5 ms·

> It's kind of a ridiculous notion that a site operator cannot monitor how users use the site... this is not wiretapping and I assume (hope) it gets thrown out.

by S201 4y ago

> It's kind of a ridiculous notion that a site operator cannot monitor how users use the site... this is not wiretapping and I assume (hope) it gets thrown out. Putting aside how many other ways there are to determine how users use a website without needing to resort to this level of intrusion, the issue is that almost always the user isn't aware this level of monitoring of their actions is happening. Sure, it may be buried deep in some privacy policy or terms and conditions no one ever reads, but that's not exactly what I'd call informed consent. This is where regulation to at least require websites notify their uses that there's literally a recording being taken of their screen interacting with the website would be helpful.

Alupis 4y ago
I don't think it matters at all. There is no expectation of privacy when browsing a website (from the website operator). We can see everything you do... obviously. Also, it's not a recording of their screen that is being taken, but rather it's mouse coordinates and keystrokes which then re-assemble a replay of the actions. Just like a video game replay.
- S201 4y ago
  > I don't think it matters at all. There is no expectation of privacy when browsing a website (from the website operator). We can see everything you do... obviously. Server logs will of course tell the operator what buttons are being clicked on and which pages are being requested. But once those pages are on my computer, I disagree, I do have an expectation of privacy around my mouse movements and keystrokes on my own computer. If I choose to send those to some third party server so be it, but having those collected without consent is a problem. As engineers we may assume this is being done regardless and accept it as a reality of the web, but I'd imagine the average person would be quite surprised to see what is a recording of their browser window reconstructed without being informed that was happening. They may rightful have that expectation of privacy here, which is being broken by these tools. > Also, it's not a recording of their screen that is being taken, but rather it's mouse coordinates and keystrokes which then re-assemble a replay of the actions. Just like a video game replay. It doesn't matter what method is taken to generate a video if the end result is the same as if you were recording my actual browser window.
  - Alupis 4y ago
    How would this be any different if I were to design my site to use a websocket and stream mouse events and keystrokes to figure out if you are clicking a button, versus using a javascript event handler or something? In fact, a lot of your browser games operate this way (using coordinates). There is no one single way to design a website. The very same non-technical folks that you allege are misled here also have no clue how buttons work on a site either... it's all magic to those folks. Are we not supposed to do any logging now? How is it any different to only log when a user presses a button? Your TV tracks what shows you watch, what buttons you press, how often you skip commercials, etc. Your smart fridge tracks how often you use the ice feature, your car tracks how often you drive aggressively, etc. No one is alleging these devices are "wiretapping"...
    - S201 4y ago
      > How would this be any different if I were to design my site to use a websocket and stream mouse events and keystrokes to figure out if you are clicking a button, versus using a javascript event handler or something? It shouldn't matter the collection method. The point is that you'd be collecting these keystroke and mouse events as they happen in an environment that I, the user, may believe they are not leaving my system. > The very same non-technical folks that you allege are misled here also have no clue how buttons work on a site either... it's all magic to those folks. Are we not supposed to do any logging now? That's a fair point. Some users will have no idea at all what data they're sending to the likes of Facebook, for example; it's just a magic box that shows them photos of their grandkids. The test here is given the average person's understanding of the products they are using, is it reasonable to assume the data being generated is not leaving your local system? I think even the average user would assume mouse movements are not being sent away to reconstruct their session on a website down to that level of granularity. You may disagree but that's the tricky issue here: where does the line of an expectation of privacy get drawn? From a technical point of view, I'd argue it's at the separation of client-side and server-side interactions where anything not needed for the functioning of the product on the client-side remains client-side. Hence, something like my mouse movements on a run of the mill website for analytics is across that line but something like mouse movements in a multiplayer video game is not. > Your TV tracks what shows you watch, what buttons you press, how often you skip commercials, etc.Your smart fridge tracks how often you use the ice feature, your car tracks how often you drive aggressively, etc. The point is where does this data get sent to? Admittedly I don't know exactly what data my car collects on my driving habits, but I'm pretty sure it doesn't leave the car in that it doesn't have an Onstar-like system installed in it. If this data is used to essentially be an observer sitting over my shoulder without telling me when I don't have a reasonable expectation that it's happening then, yes, that's a violation of an expectation of privacy. The fact that all of this is legal really demonstrates how far behind laws are to the issue of data collection around usage of services and products.
- somebodynew 4y ago
  This is not obvious to the average person outside of the industry. For example, most people would expect that text typed into a form field without clicking submit is private and has not been sent to anyone. It is obvious to a software developer that secretly sending the text back to a server while the user types is easy to implement, but posting an agent to read over someone's shoulder while they write a draft which they may choose not to send at all does not become morally acceptable just because modern technology has made this more practical than hiring a PI to watch through someone's house window from a public street.
- robin_reala 4y ago
  I can’t talk for the US, but in the EU under GDPR there absolutely is an expectation of privacy.
- edmundsauto 4y ago
  I think we are in a changepoint time where we need to think about how to make privacy serve the user. By that, I mean it's no longer acceptable to cite the legal standard, but the ethical one. If you collect data, it should be to serve the user. Additionally, any data not used operationally (keep the service running) should have either be limited by purpose ("we will not use your data to target anything to you") or via true anonymization (differential privacy). If it's not beneficial to the user for you to have this data, you shouldn't have it.

by S201 4y ago

Alupis 4y ago

I don't think it matters at all. There is no expectation of privacy when browsing a website (from the website operator). We can see everything you do... obviously. Also, it's not a recording of their screen that is being taken, but rather it's mouse coordinates and keystrokes which then re-assemble a replay of the actions. Just like a video game replay.

S201 4y ago
> I don't think it matters at all. There is no expectation of privacy when browsing a website (from the website operator). We can see everything you do... obviously. Server logs will of course tell the operator what buttons are being clicked on and which pages are being requested. But once those pages are on my computer, I disagree, I do have an expectation of privacy around my mouse movements and keystrokes on my own computer. If I choose to send those to some third party server so be it, but having those collected without consent is a problem. As engineers we may assume this is being done regardless and accept it as a reality of the web, but I'd imagine the average person would be quite surprised to see what is a recording of their browser window reconstructed without being informed that was happening. They may rightful have that expectation of privacy here, which is being broken by these tools. > Also, it's not a recording of their screen that is being taken, but rather it's mouse coordinates and keystrokes which then re-assemble a replay of the actions. Just like a video game replay. It doesn't matter what method is taken to generate a video if the end result is the same as if you were recording my actual browser window.
- Alupis 4y ago
  How would this be any different if I were to design my site to use a websocket and stream mouse events and keystrokes to figure out if you are clicking a button, versus using a javascript event handler or something? In fact, a lot of your browser games operate this way (using coordinates). There is no one single way to design a website. The very same non-technical folks that you allege are misled here also have no clue how buttons work on a site either... it's all magic to those folks. Are we not supposed to do any logging now? How is it any different to only log when a user presses a button? Your TV tracks what shows you watch, what buttons you press, how often you skip commercials, etc. Your smart fridge tracks how often you use the ice feature, your car tracks how often you drive aggressively, etc. No one is alleging these devices are "wiretapping"...
  - S201 4y ago
    > How would this be any different if I were to design my site to use a websocket and stream mouse events and keystrokes to figure out if you are clicking a button, versus using a javascript event handler or something? It shouldn't matter the collection method. The point is that you'd be collecting these keystroke and mouse events as they happen in an environment that I, the user, may believe they are not leaving my system. > The very same non-technical folks that you allege are misled here also have no clue how buttons work on a site either... it's all magic to those folks. Are we not supposed to do any logging now? That's a fair point. Some users will have no idea at all what data they're sending to the likes of Facebook, for example; it's just a magic box that shows them photos of their grandkids. The test here is given the average person's understanding of the products they are using, is it reasonable to assume the data being generated is not leaving your local system? I think even the average user would assume mouse movements are not being sent away to reconstruct their session on a website down to that level of granularity. You may disagree but that's the tricky issue here: where does the line of an expectation of privacy get drawn? From a technical point of view, I'd argue it's at the separation of client-side and server-side interactions where anything not needed for the functioning of the product on the client-side remains client-side. Hence, something like my mouse movements on a run of the mill website for analytics is across that line but something like mouse movements in a multiplayer video game is not. > Your TV tracks what shows you watch, what buttons you press, how often you skip commercials, etc.Your smart fridge tracks how often you use the ice feature, your car tracks how often you drive aggressively, etc. The point is where does this data get sent to? Admittedly I don't know exactly what data my car collects on my driving habits, but I'm pretty sure it doesn't leave the car in that it doesn't have an Onstar-like system installed in it. If this data is used to essentially be an observer sitting over my shoulder without telling me when I don't have a reasonable expectation that it's happening then, yes, that's a violation of an expectation of privacy. The fact that all of this is legal really demonstrates how far behind laws are to the issue of data collection around usage of services and products.
somebodynew 4y ago
This is not obvious to the average person outside of the industry. For example, most people would expect that text typed into a form field without clicking submit is private and has not been sent to anyone. It is obvious to a software developer that secretly sending the text back to a server while the user types is easy to implement, but posting an agent to read over someone's shoulder while they write a draft which they may choose not to send at all does not become morally acceptable just because modern technology has made this more practical than hiring a PI to watch through someone's house window from a public street.
robin_reala 4y ago
I can’t talk for the US, but in the EU under GDPR there absolutely is an expectation of privacy.
edmundsauto 4y ago
I think we are in a changepoint time where we need to think about how to make privacy serve the user. By that, I mean it's no longer acceptable to cite the legal standard, but the ethical one. If you collect data, it should be to serve the user. Additionally, any data not used operationally (keep the service running) should have either be limited by purpose ("we will not use your data to target anything to you") or via true anonymization (differential privacy). If it's not beneficial to the user for you to have this data, you shouldn't have it.