5 ms·
> How would this be any different if I were to design my site to use a websocket and stream mouse events and keystrokes to figure out if you are clicking a but
by S201 4y ago
> How would this be any different if I were to design my site to use a websocket and stream mouse events and keystrokes to figure out if you are clicking a button, versus using a javascript event handler or something?
It shouldn't matter the collection method. The point is that you'd be collecting these keystroke and mouse events as they happen in an environment that I, the user, may believe they are not leaving my system.
> The very same non-technical folks that you allege are misled here also have no clue how buttons work on a site either... it's all magic to those folks. Are we not supposed to do any logging now?
That's a fair point. Some users will have no idea at all what data they're sending to the likes of Facebook, for example; it's just a magic box that shows them photos of their grandkids. The test here is given the average person's understanding of the products they are using, is it reasonable to assume the data being generated is not leaving your local system? I think even the average user would assume mouse movements are not being sent away to reconstruct their session on a website down to that level of granularity. You may disagree but that's the tricky issue here: where does the line of an expectation of privacy get drawn? From a technical point of view, I'd argue it's at the separation of client-side and server-side interactions where anything not needed for the functioning of the product on the client-side remains client-side. Hence, something like my mouse movements on a run of the mill website for analytics is across that line but something like mouse movements in a multiplayer video game is not.
> Your TV tracks what shows you watch, what buttons you press, how often you skip commercials, etc.Your smart fridge tracks how often you use the ice feature, your car tracks how often you drive aggressively, etc.
The point is where does this data get sent to? Admittedly I don't know exactly what data my car collects on my driving habits, but I'm pretty sure it doesn't leave the car in that it doesn't have an Onstar-like system installed in it.
If this data is used to essentially be an observer sitting over my shoulder without telling me when I don't have a reasonable expectation that it's happening then, yes, that's a violation of an expectation of privacy. The fact that all of this is legal really demonstrates how far behind laws are to the issue of data collection around usage of services and products.
- Alupis 4y agoIt's very common to log when a button is clicked. Which means we can already reconstruct a user's session because we know what coordinates buttons have. We might miss out on the random movements and such, but that might not be a big deal if we also log the timestamp when a button was clicked. Again, if I designed my site to use a websocket instead of event handlers - the result is the same. Are we proposing we outlaw this? Or inversely, placing in law the only accepted method of website design? That seems foolhardy to me. Your car collects huge amounts of data about your driving habits. A Tesla, for example, might auto-report that data, but your "dumb" car also provides that data to an ODBII reader. In fact, that was the premise for those Progressive (I think) Car Insurance things they wanted you to plug into your car to "prove" you were a safe driver. Any time your car is in for service... this data can be freely read. Your insurance company will also obtain this information after an accident in some cases as well. We use mouse/key movements for a lot of things, not just reconstructing sessions. Google's newer "I'm not a Robot" captcha's just ask you to click a single button for example. A ton of anti-fraud/abuse systems do this as well, particularly for credit card checkout forms (anti-bot measures). The ramifications of a bad decision for this suit are huge.
- P5fRxh5kUvp2th 4y ago> Again, if I designed my site to use a websocket instead of event handlers - the result is the same. Are we proposing we outlaw this? yes? I can stab my knife into flesh all day, if that flesh is another human being it turns out it's outlawed. There is no requirement that the law be applied consistently for some action. Insider Trading doesn't imply all trading is illegal. Being able to pop off fireworks doesn't imply doing so anywhere is legal.
- Alupis 4y agoThat would then be the first law of it's kind, to mandate how a website is to operate on a technical level. Even the existing ADA laws do not specify technical details (which is why they are abused in frivolous lawsuits to often).
- P5fRxh5kUvp2th 4y agoThe opposite actually, if the law says you cannot murder, it doesn't become legal because you used a hammer instead of a gun. Your question is essentially "well what if I use a knife, because knives can be used for skinning, which is a legitimate use!". It doesn't work that way.
- Alupis 4y agoLike I said, that would be the first law of it's kind. We have zero laws that specify how a website is operated on the technical level. Or how it's engineered or designed. Nothing exists that is comparable to what is being proposed.
- P5fRxh5kUvp2th 4y agoThat's true, I think the point is that such laws need to start getting created because the compute and personal device issue is legitimately different.