3 ms·

It's very common to log when a button is clicked. Which means we can already reconstruct a user's session because we know what coordinates buttons have. We migh

by Alupis 4y ago

It's very common to log when a button is clicked. Which means we can already reconstruct a user's session because we know what coordinates buttons have. We might miss out on the random movements and such, but that might not be a big deal if we also log the timestamp when a button was clicked. Again, if I designed my site to use a websocket instead of event handlers - the result is the same. Are we proposing we outlaw this? Or inversely, placing in law the only accepted method of website design? That seems foolhardy to me. Your car collects huge amounts of data about your driving habits. A Tesla, for example, might auto-report that data, but your "dumb" car also provides that data to an ODBII reader. In fact, that was the premise for those Progressive (I think) Car Insurance things they wanted you to plug into your car to "prove" you were a safe driver. Any time your car is in for service... this data can be freely read. Your insurance company will also obtain this information after an accident in some cases as well. We use mouse/key movements for a lot of things, not just reconstructing sessions. Google's newer "I'm not a Robot" captcha's just ask you to click a single button for example. A ton of anti-fraud/abuse systems do this as well, particularly for credit card checkout forms (anti-bot measures). The ramifications of a bad decision for this suit are huge.

P5fRxh5kUvp2th 4y ago
> Again, if I designed my site to use a websocket instead of event handlers - the result is the same. Are we proposing we outlaw this? yes? I can stab my knife into flesh all day, if that flesh is another human being it turns out it's outlawed. There is no requirement that the law be applied consistently for some action. Insider Trading doesn't imply all trading is illegal. Being able to pop off fireworks doesn't imply doing so anywhere is legal.
- Alupis 4y ago
  That would then be the first law of it's kind, to mandate how a website is to operate on a technical level. Even the existing ADA laws do not specify technical details (which is why they are abused in frivolous lawsuits to often).
  - P5fRxh5kUvp2th 4y ago
    The opposite actually, if the law says you cannot murder, it doesn't become legal because you used a hammer instead of a gun. Your question is essentially "well what if I use a knife, because knives can be used for skinning, which is a legitimate use!". It doesn't work that way.
    - Alupis 4y ago
      Like I said, that would be the first law of it's kind. We have zero laws that specify how a website is operated on the technical level. Or how it's engineered or designed. Nothing exists that is comparable to what is being proposed.
      - P5fRxh5kUvp2th 4y ago
        That's true, I think the point is that such laws need to start getting created because the compute and personal device issue is legitimately different.
        Alupis 4y ago
        The problem with this, is the technology evolves far quicker than our laws do. The ADA law is a glaring example of this, unfortunately.
        P5fRxh5kUvp2th 4y ago
        Apparently if you outlaw murder, the fact that people are constantly creating new ways to murder makes it confusing as to whether or not murder is outlawed.
        Alupis 4y ago
        No, because murder is still illegal. In a technical setting, we can't even reliably describe how things will operate 5 years from now. Imagine a law that specified how frames were to operate... and now no one uses frames. Just imagine a law that says "no tracking". What is tracking? How is it done? How do we know it when we see it? All of this must be defined... and these definitions are fuzzy and change rapidly. The ADA law specifically says you must make your website accessible... but fails to specify what accessible even means in a modern setting. That's the pitfalls of trying to regulate how things are designed in a technical setting. Perhaps it's possible, but I have not yet seen a good law that made an attempt.
S201 4y ago
> It's very common to log when a button is clicked. Which means we can already reconstruct a user's session because we know what coordinates buttons have. We might miss out on the random movements and such, but that might not be a big deal if we also log the timestamp when a button was clicked. The point I was making above was that there's a difference between purely client-side events like mouse movements and keystrokes and server-side events like button clicks and page requests. This may be a trivial difference for most websites, but I have an expectation of privacy around client-side events. Collecting them without the user's consent violates that regardless of the technical mechanism of implementation of that collection. > Your car collects huge amounts of data about your driving habits. A Tesla, for example, might auto-report that data, but your "dumb" car also provides that data to an ODBII reader. In fact, that was the premise for those Progressive (I think) Car Insurance things they wanted you to plug into your car to "prove" you were a safe driver. Right, and the difference is that the data provided through the OBD port requires me to physically plug something in and upload it elsewhere. I have control over that data. This is different from these websites that are collecting data like my mouse movements and immediately sending it off without notification or consent.

by Alupis 4y ago

P5fRxh5kUvp2th 4y ago

> Again, if I designed my site to use a websocket instead of event handlers - the result is the same. Are we proposing we outlaw this? yes? I can stab my knife into flesh all day, if that flesh is another human being it turns out it's outlawed. There is no requirement that the law be applied consistently for some action. Insider Trading doesn't imply all trading is illegal. Being able to pop off fireworks doesn't imply doing so anywhere is legal.

Alupis 4y ago
That would then be the first law of it's kind, to mandate how a website is to operate on a technical level. Even the existing ADA laws do not specify technical details (which is why they are abused in frivolous lawsuits to often).
- P5fRxh5kUvp2th 4y ago
  The opposite actually, if the law says you cannot murder, it doesn't become legal because you used a hammer instead of a gun. Your question is essentially "well what if I use a knife, because knives can be used for skinning, which is a legitimate use!". It doesn't work that way.
  - Alupis 4y ago
    Like I said, that would be the first law of it's kind. We have zero laws that specify how a website is operated on the technical level. Or how it's engineered or designed. Nothing exists that is comparable to what is being proposed.
    - P5fRxh5kUvp2th 4y ago
      That's true, I think the point is that such laws need to start getting created because the compute and personal device issue is legitimately different.
      - Alupis 4y ago
        The problem with this, is the technology evolves far quicker than our laws do. The ADA law is a glaring example of this, unfortunately.
        P5fRxh5kUvp2th 4y ago
        Apparently if you outlaw murder, the fact that people are constantly creating new ways to murder makes it confusing as to whether or not murder is outlawed.
        Alupis 4y ago
        No, because murder is still illegal. In a technical setting, we can't even reliably describe how things will operate 5 years from now. Imagine a law that specified how frames were to operate... and now no one uses frames. Just imagine a law that says "no tracking". What is tracking? How is it done? How do we know it when we see it? All of this must be defined... and these definitions are fuzzy and change rapidly. The ADA law specifically says you must make your website accessible... but fails to specify what accessible even means in a modern setting. That's the pitfalls of trying to regulate how things are designed in a technical setting. Perhaps it's possible, but I have not yet seen a good law that made an attempt.

S201 4y ago

> It's very common to log when a button is clicked. Which means we can already reconstruct a user's session because we know what coordinates buttons have. We might miss out on the random movements and such, but that might not be a big deal if we also log the timestamp when a button was clicked. The point I was making above was that there's a difference between purely client-side events like mouse movements and keystrokes and server-side events like button clicks and page requests. This may be a trivial difference for most websites, but I have an expectation of privacy around client-side events. Collecting them without the user's consent violates that regardless of the technical mechanism of implementation of that collection. > Your car collects huge amounts of data about your driving habits. A Tesla, for example, might auto-report that data, but your "dumb" car also provides that data to an ODBII reader. In fact, that was the premise for those Progressive (I think) Car Insurance things they wanted you to plug into your car to "prove" you were a safe driver. Right, and the difference is that the data provided through the OBD port requires me to physically plug something in and upload it elsewhere. I have control over that data. This is different from these websites that are collecting data like my mouse movements and immediately sending it off without notification or consent.