6 ms·

> I don't think it matters at all. There is no expectation of privacy when browsing a website (from the website operator). We can see everything you do... obvi

by S201 4y ago

> I don't think it matters at all. There is no expectation of privacy when browsing a website (from the website operator). We can see everything you do... obviously. Server logs will of course tell the operator what buttons are being clicked on and which pages are being requested. But once those pages are on my computer, I disagree, I do have an expectation of privacy around my mouse movements and keystrokes on my own computer. If I choose to send those to some third party server so be it, but having those collected without consent is a problem. As engineers we may assume this is being done regardless and accept it as a reality of the web, but I'd imagine the average person would be quite surprised to see what is a recording of their browser window reconstructed without being informed that was happening. They may rightful have that expectation of privacy here, which is being broken by these tools. > Also, it's not a recording of their screen that is being taken, but rather it's mouse coordinates and keystrokes which then re-assemble a replay of the actions. Just like a video game replay. It doesn't matter what method is taken to generate a video if the end result is the same as if you were recording my actual browser window.

Alupis 4y ago
How would this be any different if I were to design my site to use a websocket and stream mouse events and keystrokes to figure out if you are clicking a button, versus using a javascript event handler or something? In fact, a lot of your browser games operate this way (using coordinates). There is no one single way to design a website. The very same non-technical folks that you allege are misled here also have no clue how buttons work on a site either... it's all magic to those folks. Are we not supposed to do any logging now? How is it any different to only log when a user presses a button? Your TV tracks what shows you watch, what buttons you press, how often you skip commercials, etc. Your smart fridge tracks how often you use the ice feature, your car tracks how often you drive aggressively, etc. No one is alleging these devices are "wiretapping"...
- S201 4y ago
  > How would this be any different if I were to design my site to use a websocket and stream mouse events and keystrokes to figure out if you are clicking a button, versus using a javascript event handler or something? It shouldn't matter the collection method. The point is that you'd be collecting these keystroke and mouse events as they happen in an environment that I, the user, may believe they are not leaving my system. > The very same non-technical folks that you allege are misled here also have no clue how buttons work on a site either... it's all magic to those folks. Are we not supposed to do any logging now? That's a fair point. Some users will have no idea at all what data they're sending to the likes of Facebook, for example; it's just a magic box that shows them photos of their grandkids. The test here is given the average person's understanding of the products they are using, is it reasonable to assume the data being generated is not leaving your local system? I think even the average user would assume mouse movements are not being sent away to reconstruct their session on a website down to that level of granularity. You may disagree but that's the tricky issue here: where does the line of an expectation of privacy get drawn? From a technical point of view, I'd argue it's at the separation of client-side and server-side interactions where anything not needed for the functioning of the product on the client-side remains client-side. Hence, something like my mouse movements on a run of the mill website for analytics is across that line but something like mouse movements in a multiplayer video game is not. > Your TV tracks what shows you watch, what buttons you press, how often you skip commercials, etc.Your smart fridge tracks how often you use the ice feature, your car tracks how often you drive aggressively, etc. The point is where does this data get sent to? Admittedly I don't know exactly what data my car collects on my driving habits, but I'm pretty sure it doesn't leave the car in that it doesn't have an Onstar-like system installed in it. If this data is used to essentially be an observer sitting over my shoulder without telling me when I don't have a reasonable expectation that it's happening then, yes, that's a violation of an expectation of privacy. The fact that all of this is legal really demonstrates how far behind laws are to the issue of data collection around usage of services and products.
  - Alupis 4y ago
    It's very common to log when a button is clicked. Which means we can already reconstruct a user's session because we know what coordinates buttons have. We might miss out on the random movements and such, but that might not be a big deal if we also log the timestamp when a button was clicked. Again, if I designed my site to use a websocket instead of event handlers - the result is the same. Are we proposing we outlaw this? Or inversely, placing in law the only accepted method of website design? That seems foolhardy to me. Your car collects huge amounts of data about your driving habits. A Tesla, for example, might auto-report that data, but your "dumb" car also provides that data to an ODBII reader. In fact, that was the premise for those Progressive (I think) Car Insurance things they wanted you to plug into your car to "prove" you were a safe driver. Any time your car is in for service... this data can be freely read. Your insurance company will also obtain this information after an accident in some cases as well. We use mouse/key movements for a lot of things, not just reconstructing sessions. Google's newer "I'm not a Robot" captcha's just ask you to click a single button for example. A ton of anti-fraud/abuse systems do this as well, particularly for credit card checkout forms (anti-bot measures). The ramifications of a bad decision for this suit are huge.
    - P5fRxh5kUvp2th 4y ago
      > Again, if I designed my site to use a websocket instead of event handlers - the result is the same. Are we proposing we outlaw this? yes? I can stab my knife into flesh all day, if that flesh is another human being it turns out it's outlawed. There is no requirement that the law be applied consistently for some action. Insider Trading doesn't imply all trading is illegal. Being able to pop off fireworks doesn't imply doing so anywhere is legal.
      - Alupis 4y ago
        That would then be the first law of it's kind, to mandate how a website is to operate on a technical level. Even the existing ADA laws do not specify technical details (which is why they are abused in frivolous lawsuits to often).
- P5fRxh5kUvp2th 4y ago
  If I were asked for consent for all the things you listed, I'd withhold it. Sort of like how Apple gave users the ability to consent and they overwhelmingly withheld it (to the chagrin of FB). If someone learns they're watched via cameras while in a grocery store, they may not be happy about it but they'll also generally recognize they're on _STORE PROPERTY_. The key difference here is that this is being done on the _USERS_ property and you're acting as if they shouldn't have to right to withhold that consent. --- Everyone accepts that an employer may look through company emails of its employees because it goes through company equipment. These same companies then have the unadulterated gall to turn around and try and claim they have those very same rights on _OTHER PEOPLES EQUIPMENT_. They're laying claim to other peoples compute.
  - Alupis 4y ago
    The reality is you wouldn't be allowed to use the site at all then. As invisible as you might want to be, the system does need to track you and your actions to do anything useful at all. We're not talking about a blog or static site here...
    - P5fRxh5kUvp2th 4y ago
      If someone asks to borrow my car to run to the grocery store and they drive 100 miles away to another state, it's theft. If I consent to have someone use my compute for the operation of their website on my device and they decide to start recording tracking information, it's theft. There is no dichotomy here, it's possible to consent to one use and not another.

by S201 4y ago

Alupis 4y ago

How would this be any different if I were to design my site to use a websocket and stream mouse events and keystrokes to figure out if you are clicking a button, versus using a javascript event handler or something? In fact, a lot of your browser games operate this way (using coordinates). There is no one single way to design a website. The very same non-technical folks that you allege are misled here also have no clue how buttons work on a site either... it's all magic to those folks. Are we not supposed to do any logging now? How is it any different to only log when a user presses a button? Your TV tracks what shows you watch, what buttons you press, how often you skip commercials, etc. Your smart fridge tracks how often you use the ice feature, your car tracks how often you drive aggressively, etc. No one is alleging these devices are "wiretapping"...

S201 4y ago
> How would this be any different if I were to design my site to use a websocket and stream mouse events and keystrokes to figure out if you are clicking a button, versus using a javascript event handler or something? It shouldn't matter the collection method. The point is that you'd be collecting these keystroke and mouse events as they happen in an environment that I, the user, may believe they are not leaving my system. > The very same non-technical folks that you allege are misled here also have no clue how buttons work on a site either... it's all magic to those folks. Are we not supposed to do any logging now? That's a fair point. Some users will have no idea at all what data they're sending to the likes of Facebook, for example; it's just a magic box that shows them photos of their grandkids. The test here is given the average person's understanding of the products they are using, is it reasonable to assume the data being generated is not leaving your local system? I think even the average user would assume mouse movements are not being sent away to reconstruct their session on a website down to that level of granularity. You may disagree but that's the tricky issue here: where does the line of an expectation of privacy get drawn? From a technical point of view, I'd argue it's at the separation of client-side and server-side interactions where anything not needed for the functioning of the product on the client-side remains client-side. Hence, something like my mouse movements on a run of the mill website for analytics is across that line but something like mouse movements in a multiplayer video game is not. > Your TV tracks what shows you watch, what buttons you press, how often you skip commercials, etc.Your smart fridge tracks how often you use the ice feature, your car tracks how often you drive aggressively, etc. The point is where does this data get sent to? Admittedly I don't know exactly what data my car collects on my driving habits, but I'm pretty sure it doesn't leave the car in that it doesn't have an Onstar-like system installed in it. If this data is used to essentially be an observer sitting over my shoulder without telling me when I don't have a reasonable expectation that it's happening then, yes, that's a violation of an expectation of privacy. The fact that all of this is legal really demonstrates how far behind laws are to the issue of data collection around usage of services and products.
- Alupis 4y ago
  It's very common to log when a button is clicked. Which means we can already reconstruct a user's session because we know what coordinates buttons have. We might miss out on the random movements and such, but that might not be a big deal if we also log the timestamp when a button was clicked. Again, if I designed my site to use a websocket instead of event handlers - the result is the same. Are we proposing we outlaw this? Or inversely, placing in law the only accepted method of website design? That seems foolhardy to me. Your car collects huge amounts of data about your driving habits. A Tesla, for example, might auto-report that data, but your "dumb" car also provides that data to an ODBII reader. In fact, that was the premise for those Progressive (I think) Car Insurance things they wanted you to plug into your car to "prove" you were a safe driver. Any time your car is in for service... this data can be freely read. Your insurance company will also obtain this information after an accident in some cases as well. We use mouse/key movements for a lot of things, not just reconstructing sessions. Google's newer "I'm not a Robot" captcha's just ask you to click a single button for example. A ton of anti-fraud/abuse systems do this as well, particularly for credit card checkout forms (anti-bot measures). The ramifications of a bad decision for this suit are huge.
  - P5fRxh5kUvp2th 4y ago
    > Again, if I designed my site to use a websocket instead of event handlers - the result is the same. Are we proposing we outlaw this? yes? I can stab my knife into flesh all day, if that flesh is another human being it turns out it's outlawed. There is no requirement that the law be applied consistently for some action. Insider Trading doesn't imply all trading is illegal. Being able to pop off fireworks doesn't imply doing so anywhere is legal.
    - Alupis 4y ago
      That would then be the first law of it's kind, to mandate how a website is to operate on a technical level. Even the existing ADA laws do not specify technical details (which is why they are abused in frivolous lawsuits to often).
P5fRxh5kUvp2th 4y ago
If I were asked for consent for all the things you listed, I'd withhold it. Sort of like how Apple gave users the ability to consent and they overwhelmingly withheld it (to the chagrin of FB). If someone learns they're watched via cameras while in a grocery store, they may not be happy about it but they'll also generally recognize they're on _STORE PROPERTY_. The key difference here is that this is being done on the _USERS_ property and you're acting as if they shouldn't have to right to withhold that consent. --- Everyone accepts that an employer may look through company emails of its employees because it goes through company equipment. These same companies then have the unadulterated gall to turn around and try and claim they have those very same rights on _OTHER PEOPLES EQUIPMENT_. They're laying claim to other peoples compute.
- Alupis 4y ago
  The reality is you wouldn't be allowed to use the site at all then. As invisible as you might want to be, the system does need to track you and your actions to do anything useful at all. We're not talking about a blog or static site here...
  - P5fRxh5kUvp2th 4y ago
    If someone asks to borrow my car to run to the grocery store and they drive 100 miles away to another state, it's theft. If I consent to have someone use my compute for the operation of their website on my device and they decide to start recording tracking information, it's theft. There is no dichotomy here, it's possible to consent to one use and not another.