6 ms·

I've always added analytics scripts on websites I worked on. It was second nature for me. Then when I got my own start up, I didn't just add regular analytics b

I've always added analytics scripts on websites I worked on. It was second nature for me. Then when I got my own start up, I didn't just add regular analytics but one that tracks mouse movements so you can watch sessions back like a video [0]. I told a friend about my start up and she jumped on it immediately. I opened the tool and watched her interaction. Then I told her "oh so you opened the dev tools" She immediately ended the session. "How did you know? That's creepy". It was the first time I've actually felt like these tools invade privacy. Yeah, we include it in our terms and condition and privacy page, but I don't think users truly grasp how those tools work. I understand that all analytics tools provide this feature now, but its always creepy to know someone can watch what you are doing. [0]: https://idiallo.com/blog/spying-on-your-user https://idiallo.com/blog/spying-on-your-user

htx80nerd 5mo ago
Everyone knows stores have security cameras. But if you called them up and said 'I saw you pick up the chips' they wouldnt have a good feeling. Everyone understands websites use analytics and tracking, but people dont want to be reminded of it. Which is why people hate those FB ads which exactly match what you searched for 24 hours ago.
- EGreg 5mo ago
  [flagged]
- philipwhiuk 5mo ago
  > Everyone understands websites use analytics and tracking, but people dont want to be reminded of it. People don't want it to be misused is the actual point.
jrowen 5mo ago
I think there's a very interesting duality forming around privacy. It seems like most people don't really care if they're being filmed, or if their data is being slurped up six ways from Sunday, as long as it's aggregated and going through automated systems. But as soon as it feels like an actual person is looking at individual behavior, it's creepy (which is, of course, always a possibility, but plausible deniability is a powerful thing).
- m463 5mo ago
  it's not a duality at all. the people don't know. the people doing the "analytics" (surveillance) like their privacy too, because they are doing creepy stuff and don't want people to know it. And even if they aren't doing creepy stuff, the data might be used that way in the future (profile building, psychological tricks, personalized pricing, sharing behavior with others, etc)
- latexr 5mo ago
  > It seems like most people don't really care if they're being filmed, or if their data is being slurped up six ways from Sunday For the majority of people I don’t think it’s true that they don’t care, but rather that they don’t know, don’t understand the implications, or don’t have the luxury of being able to do anything about it. In the instances where I was able to have a longer discussion with someone to really explain what’s going on, they did care. Even if they previously said they didn’t.
  - ryukoposting 5mo ago
    Or, they do know and they do care, but they're so exhausted by the hostile patterns of our industry that they've given up.
  - jrowen 5mo ago
    People do know on some level though. There was enough willpower to get the cookie bullshit on every website. I think it's just that it's more of a visceral lizard-brain thing than a logical thing. Like how you can go through life eating meat every day, then someone sits you down and tells you the horrors of that industry and shows you a cow being butchered, and you go oh that's horrible, and then most likely put it out of mind and continue eating meat.
- singpolyma3 5mo ago
  Yes. This is it. People are used to "private conversation in public restaurant". It's not private because no one can hear, but because no one is listening.
Sophira 5mo ago
> Yeah, we include it in our terms and condition and privacy page Please be honest with yourself. People don't read terms and conditions. There's a good chance you don't read terms and conditions. And even if you do, odds are better than even that you don't fully understand all the legal implications. Terms and conditions pages nowadays are there mostly to provide legal protection under the guise of "the user told us that they read these by ticking a box on our signup page; it's hardly our fault if they didn't."
- dheera 5mo ago
  I'm also of the opinion that at lot of T&C are basically signing under duress and I consider them invalid. Like if I have to sign a T&C with Google Play and a T&C with your city's sanctioned parking app in order to park on the street, I consider both of those T&C's invalid. As a legal resident of the country with a legally owned car and legal driving license, I should be able to park and pay, I shouldn't have to agree to anything else.
  - komali2 5mo ago
    Your city doesn't have a way to pay for parking with cash on public roads? It's not a private lot? That should simply be illegal.
    - j2j8 5mo ago
      Cash for parking on streets has gone in many parts of Australia
    - dheera 5mo ago
      As an example, most of Boston's public street parking meters use a collection of various parking apps. A large number have broken quarter slots and broken card readers but you're still expected to make payment via app or you can get towed. This is also why I wish we could make anti-towing (anti-car-theft) devices that physically resist and fight the tow people to make their lives uncomfortable and miserable, because predatory jobs like that should just not exist. But any time I suggest this, 5000 people come out of the woods and say "pay your bill" and "don't park where you're not supposed to" whereas my point is really "you shouldn't have to accept a T&C in order to pay for parking" and "you should still have a right to park even if the cash/card reader is broken".
wrRS 5mo ago
Are there any good browser extensions that can block this and protect user privacy?
- hactually 5mo ago
  yes - a fair few
- matheusmoreira 5mo ago
  uBlock Origin should block it.
deleted 5mo ago
[deleted]
matheusmoreira 5mo ago
> Yeah, we include it in our terms and condition and privacy page Nobody reads that stuff.
Rygian 5mo ago
> we include it in our terms and condition and privacy page, but I don't think users truly grasp how those tools work Since you did collect the metrics, you had direct knowledge of how many users opened the T&C and scrolled down to the place where you mention you're recording their session. Would be interesting if you can share an aggregate statistic of that.
- kmoser 5mo ago
  They may have scrolled down to it but that doesn't mean they read it. And even if they read it, they may not have understood it.
  - account42 5mo ago
    And the same goes for other would be conclusions people think they get from their invasive telemetry.
ivanjermakov 5mo ago
I'm surprised browsers don't warn users about every website that has listeners attached to keyboard/mouse events. It's totally fine for something like a game or an experiment website, but might not be something you expect from a blog or a news site.
- account42 5mo ago
  At some point we really need to split websites from web applications as a concept.
XCSme 5mo ago
Ethical question: is there a huge difference between seeing the dev tools being opened in a re-created session replay AND simply storing an event with [dev_tools_opened at 1min 3s]. If you have only the event, you can basically re-create a playback of that action if you want. Now, if you track all actions of interest, than that's basically almost the same as a full session recording.

htx80nerd 5mo ago

Everyone knows stores have security cameras. But if you called them up and said 'I saw you pick up the chips' they wouldnt have a good feeling. Everyone understands websites use analytics and tracking, but people dont want to be reminded of it. Which is why people hate those FB ads which exactly match what you searched for 24 hours ago.

EGreg 5mo ago
[flagged]
philipwhiuk 5mo ago
> Everyone understands websites use analytics and tracking, but people dont want to be reminded of it. People don't want it to be misused is the actual point.

jrowen 5mo ago

I think there's a very interesting duality forming around privacy. It seems like most people don't really care if they're being filmed, or if their data is being slurped up six ways from Sunday, as long as it's aggregated and going through automated systems. But as soon as it feels like an actual person is looking at individual behavior, it's creepy (which is, of course, always a possibility, but plausible deniability is a powerful thing).

m463 5mo ago
it's not a duality at all. the people don't know. the people doing the "analytics" (surveillance) like their privacy too, because they are doing creepy stuff and don't want people to know it. And even if they aren't doing creepy stuff, the data might be used that way in the future (profile building, psychological tricks, personalized pricing, sharing behavior with others, etc)
latexr 5mo ago
> It seems like most people don't really care if they're being filmed, or if their data is being slurped up six ways from Sunday For the majority of people I don’t think it’s true that they don’t care, but rather that they don’t know, don’t understand the implications, or don’t have the luxury of being able to do anything about it. In the instances where I was able to have a longer discussion with someone to really explain what’s going on, they did care. Even if they previously said they didn’t.
- ryukoposting 5mo ago
  Or, they do know and they do care, but they're so exhausted by the hostile patterns of our industry that they've given up.
- jrowen 5mo ago
  People do know on some level though. There was enough willpower to get the cookie bullshit on every website. I think it's just that it's more of a visceral lizard-brain thing than a logical thing. Like how you can go through life eating meat every day, then someone sits you down and tells you the horrors of that industry and shows you a cow being butchered, and you go oh that's horrible, and then most likely put it out of mind and continue eating meat.
singpolyma3 5mo ago
Yes. This is it. People are used to "private conversation in public restaurant". It's not private because no one can hear, but because no one is listening.

Sophira 5mo ago

> Yeah, we include it in our terms and condition and privacy page Please be honest with yourself. People don't read terms and conditions. There's a good chance you don't read terms and conditions. And even if you do, odds are better than even that you don't fully understand all the legal implications. Terms and conditions pages nowadays are there mostly to provide legal protection under the guise of "the user told us that they read these by ticking a box on our signup page; it's hardly our fault if they didn't."

dheera 5mo ago
I'm also of the opinion that at lot of T&C are basically signing under duress and I consider them invalid. Like if I have to sign a T&C with Google Play and a T&C with your city's sanctioned parking app in order to park on the street, I consider both of those T&C's invalid. As a legal resident of the country with a legally owned car and legal driving license, I should be able to park and pay, I shouldn't have to agree to anything else.
- komali2 5mo ago
  Your city doesn't have a way to pay for parking with cash on public roads? It's not a private lot? That should simply be illegal.
  - j2j8 5mo ago
    Cash for parking on streets has gone in many parts of Australia
  - dheera 5mo ago
    As an example, most of Boston's public street parking meters use a collection of various parking apps. A large number have broken quarter slots and broken card readers but you're still expected to make payment via app or you can get towed. This is also why I wish we could make anti-towing (anti-car-theft) devices that physically resist and fight the tow people to make their lives uncomfortable and miserable, because predatory jobs like that should just not exist. But any time I suggest this, 5000 people come out of the woods and say "pay your bill" and "don't park where you're not supposed to" whereas my point is really "you shouldn't have to accept a T&C in order to pay for parking" and "you should still have a right to park even if the cash/card reader is broken".

wrRS 5mo ago

Are there any good browser extensions that can block this and protect user privacy?

hactually 5mo ago
yes - a fair few
matheusmoreira 5mo ago
uBlock Origin should block it.

deleted 5mo ago

[deleted]

matheusmoreira 5mo ago

> Yeah, we include it in our terms and condition and privacy page Nobody reads that stuff.

Rygian 5mo ago

> we include it in our terms and condition and privacy page, but I don't think users truly grasp how those tools work Since you did collect the metrics, you had direct knowledge of how many users opened the T&C and scrolled down to the place where you mention you're recording their session. Would be interesting if you can share an aggregate statistic of that.

kmoser 5mo ago
They may have scrolled down to it but that doesn't mean they read it. And even if they read it, they may not have understood it.
- account42 5mo ago
  And the same goes for other would be conclusions people think they get from their invasive telemetry.

ivanjermakov 5mo ago

I'm surprised browsers don't warn users about every website that has listeners attached to keyboard/mouse events. It's totally fine for something like a game or an experiment website, but might not be something you expect from a blog or a news site.

account42 5mo ago
At some point we really need to split websites from web applications as a concept.

XCSme 5mo ago

Ethical question: is there a huge difference between seeing the dev tools being opened in a re-created session replay AND simply storing an event with [dev_tools_opened at 1min 3s]. If you have only the event, you can basically re-create a playback of that action if you want. Now, if you track all actions of interest, than that's basically almost the same as a full session recording.