A demonstration of browser events used to monitor online behaviour

by jameswiseman • 10 years ago

560 165 10 years ago

onion2k• 10 years ago

Thank goodness for devtools...

    for (var lazyisgood = 0; lazyisgood < 1000; lazyisgood++) { $('a.button').click(); }

jackpointnl• 10 years ago

Subject has run script to click on the button ten times within one second

barrystaes• 10 years ago

This is as far as i got.. https://clickclickclick.click/#4650e8c30d3089e27cf1a931bdf06...

Walkman2• 10 years ago

That's wow, you are geek. :D

Walkman2• 10 years ago

IT SAID THAT IF YOU RUN THE SCRIPT!

fredley• 10 years ago

    ROBOT

retube• 10 years ago

Hmm. Tells me to open on a desktop computer but am on a desktop.

dschuetz3• 10 years ago

Yeah, it's messing with you, don't believe everything it says.

0898• 10 years ago

Is there anywhere I find a huge list of all these new weird domains?

icebraining• 10 years ago

Go to the source: https://newgtlds.icann.org/en/program-status/delegated-strin...

They may not all be available for registration, though.

omarkassim• 10 years ago

I love Domainr, https://domainr.com/about/tlds

ogig• 10 years ago

This reminded me that notch web game[1]. Both kept me interested and I find them a very pleasant form of art.

[1] http://game.notch.net/drowning/

pawadu• 10 years ago

Surprised no one has mentioned Cookie Clicker yet, which I think was what inspired notch to write that game: http://orteil.dashnet.org/cookieclicker/

Notch's game was written in Dart and the source code is simple and elegant:

http://ludumdare.com/compo/ludum-dare-29/?action=preview&uid...

darrelld• 10 years ago

Thanks for effectively killing my productivity with that cookie clicker game.

Ph0X• 10 years ago

Candy box [1] was actually the original IIRC, or at least the one that came before the drowning and cookie clicker and was the inspiration for them. Also check out Candy Box 2 [2] which is honestly a full game.

[1] http://candies.aniwey.net/

[2] http://candybox2.net/

i336_3• 10 years ago

For anyone curious...

  Game.ClickCookie(null, 100);

Gives you 100 cookies.

There is no limit to the number you can input.

Desustorm• 10 years ago

This was surprisingly moving! notch is truly talented.

Roritharr• 10 years ago

My desire to powergame this made the ending all the more tragic. I should rethink a few things i guess.

kayge• 10 years ago

I wrote a python script to play it for me. Not sure what that says about me :)

catshirt• 10 years ago

reminded me of The Stanley Parable.

if anyone was humored, intrigued, or moved by either this or Notch's "drowning".... you will love The Stanley Parable. don't do any Googling or reading on it before you play though. go in blind. i wish i could play it again for the first time.

The Stanley Parable is literally one of my favorite things ever.

dotancohen• 10 years ago

I have no idea what the Stanley Parable is. So without googling it, how should one find it to play?

Cafey• 10 years ago

It really was amazing especially that part where .... nah I'm kidding! not gonna spoil it for everyone it's too good :D

axelfreeman• 10 years ago

I had a lot of fun automate this game and see the results.

setInterval(function() {document.getElementsByTagName("a")[Math.floor(Math.random() * document.getElementsByTagName("a").length)].click()}, 5000)

drake01• 10 years ago

or may be this: window.setInterval(function(){ [].forEach.call(document.querySelectorAll('a'), function (el){el.click();});},500)

m3rc• 10 years ago

This is fantastic. I got so caught up in trying to advance through the stages I ended up dead before i even knew it. It seems dumb to have not seen that coming but you seriously do get caught up in the small details of each requirement for each advancement that the big picture sort of fades away.

fisherjeff• 10 years ago

I got so caught up in trying to advance through the stages I ended up dead before i even knew it.

Who doesn't these days?

udkl• 10 years ago

Great game. This is on the similar lines like the SIMS and both of them are different implementations of the 'life simulator' approach.

i336_3• 10 years ago

Got it!

For those of you who want to play the game without the delays:

- Open drowninginproblems.dart.js in the Sources tab

- Verify you can type in the .js file; if you can't, right-click, Add Folder to Workspace, add any/new empty folder

- Change the ">" to a "<" on line 3753 so it says "if(x<1)this.Hk()" and ^S

Seems to work. The JS debugging in devtools nowadays is awesome, this is first time I've ever seriously used it. Imagine if we were still stuck with IE6 and Notepad. lol

For anyone who wants to play around, line 6950 in :formatted is where to start. this.zo.Fq seems to have the delay value in it, but I was unable to figure out where this came from.

Also, here's a simple oneliner to autoplay the game - which works equally well regardless of whether you do the above (in fact it looks really cool with the percentage counter left in):

  i = window.setInterval(() => {document.querySelectorAll('a').forEach(a => 
   { a.click() })}, 1200);

Has no fancy features like click randomization or smooth delays (it clicks all the buttons at once, every 1.2 seconds) but this fits in one line.

  clearInterval(i);

Stops it.

Edit: I just noticed that the source code is actually available. Ah well.

diskooo• 10 years ago

The 'Dutch English' is hugely annoying...

Teever• 10 years ago

Why?

aluhut• 10 years ago

No it's not. It's pretty cute.

kagamine2• 10 years ago

You didn't get that he was meant to sound like a possibly Austrian psychoanalyst?

pluma2• 10 years ago

I didn't know Austrians have Dutch accents.

sakri• 10 years ago

oh pleasche schqueesche me a fresch glasch of orangche jchuische. It's funny :)

markharris992• 10 years ago

I thought it was very funny. Kudos to the developer.

ablation• 10 years ago

That was interesting. Certainly kept my attention.

thomasdd• 10 years ago

???? (please turn on your sound) nothing else on the site here.

piyush_soni• 10 years ago

Same happened to me on Firefox first (and worked on Chrome), but then when I tried again in Firefox, it worked there too. Also told me "Firefox! hmmm ... Privacy, alternative etc.." :)

OliverM• 10 years ago

Doesn't seem to load on Safari/macOS. Console error:

    Failed to load resource: An SSL error has occurred and a secure connection to the server cannot be made.

franze• 10 years ago

funny, it can track/sync me from my "normal" chrome window over to the anonymous chrome window, anybody have a guess how it does that?

gempir• 10 years ago

I would guess IP Address is there anything else?

jimboj• 10 years ago

Did you copy and paste the URL? It adds an id on the end, it doesn't track me when I remove the id.

codsnake2• 10 years ago

Probably the URL's identifier added on the path...

dschuetz3• 10 years ago

You sure it doesn't make you just think that it recognised you? Do you have all the same ID and the "achievements" in both? I started in Safari, switched to Chrome and the script said "Welcome Back" although everything looked like the script made a new profile.

corecoder3• 10 years ago

Hug of death? I'm getting loads of 500 errors.

corecoder3• 10 years ago

It seems to work now.

petervandijck• 10 years ago

omg that is fun and freaky at the same time.

yati• 10 years ago

I'm at work and a Dutch guy is speaking on the phone behind me, and then I hear this guy talk with a Dutch accent. It felt creepy as hell for a moment.

aroch2• 10 years ago

It looks like all the audio files are stored as numbered mp3's on AWS, so those interested can grab all of them pretty simply.

My personal favorite is the, "Oh, for fucks sake": https://s3-eu-west-1.amazonaws.com/clickclickclick.click/Voi...

There's a song as well: https://s3-eu-west-1.amazonaws.com/clickclickclick.click/Voi...

slig• 10 years ago

For a moment I thought that it was the new Web Speech API.

ahstro• 10 years ago

Why do I know that song? Isn't it in Moulin Rouge or something?

Ambroos• 10 years ago

It's Nature Boy, originally recorded by Nat King Cole. https://www.youtube.com/watch?v=Iq0XJCJ1Srw - it's one of those songs that's been recorded by a ton of artists from that era. I personally heard Ella Fitzgerald's version first.

aroch2• 10 years ago

Its a pretty old jazz standard by Nat King: https://en.wikipedia.org/wiki/Nature_Boy

There are tons of versions and variations of it

It does in fact show up in Moulin Rouge: https://www.youtube.com/watch?v=ekCvBztYs_A

jlgaddis• 10 years ago

If you grabbed all of them, are you able to post a tarball or something somewhere? I'd like to listen to them but I don't want to make thousands of requests/downloads and rack up AWS charges for anyone.

corecoder3• 10 years ago

Has anybody granted the camera permission?

dschuetz3• 10 years ago

Not exactly, the script decided that my browser doesn't support webcam und asked to reopen the website on another browser

SilkRoadie• 10 years ago

Yep. It took a picture, insulted me then turned off the camera :D

codsnake2• 10 years ago

Is it open source?

markharris992• 10 years ago

I'd love to know this as well. Thanks.

greenshackle2• 10 years ago

It looks like it's all done in the javascript, so, yes.

(As far as I can tell the only thing it's fetching are the mp3 files, it's not talking to a backend.)

Edit: you're probably asking if it has a free license; that I don't know.

danfromberlin• 10 years ago

Who else feels a sense of horrible dread and frustration that every minutiae of my (and your) online activity is recorded for eternity and exploited to the fullest extent?

What are you going to do about it?

necessity• 10 years ago

Well the site doesn't even work if you have NoScript, which is the bare minimum to have...

hrrsn• 10 years ago

I wouldn't consider it bare minimum. Most of the web is broken with NoScript installed.

andybak2• 10 years ago

I behave online with the understanding that my behaviour is essentially public.

PS - how come all website product recommendations still suck? Data collection is rather ahead of data usage it seems...

pdkl955• 10 years ago

website product recommendations still suck

Targeted advertising isn't about giving you good recommendations. It's about advertisers picking which demographic they want to influence. It may be presented as a "recommendation", but it's still an ad.

raimue• 10 years ago

Oh, yes, the algorithms supposed to target you specifically are often quite bad and annoying. For example on Amazon, when you just bought a coffee machine, your recommendations will show you a bunch of coffee machines. Well, I just made a choice and ordered a coffee machine, I am not going to buy another one for quite some time.

dom0• 10 years ago

I behave online with the understanding that my behaviour is essentially public.

Also assume that the connection between any and all pseudonyms used only is public knowledge. Because it is.

SquareWheel3• 10 years ago

Horrible dread? Can't say I do. If I get a relevant ad from a keyword in my email, that seems like a pretty minor event in my life.

pdkl955• 10 years ago

You do know that the ad won't necessarily be relevant to you, right? The ads will be "relevant" according to the advertisers who think you're the kind of target they want to trick into buying their product.

Regarding that "minor event": it is minor in isolation, but the point is that you are generating a large amount of those events that are being aggregated into databases where they are unlikely to be deleted. The ad(s) you might get isn't important. What you should be concerned about is the detailed pattern-of-life analysis that can be done at any time in the future by anybody that buys a copy of that database.

dx0344• 10 years ago

Not really horrified. Yes they save it, but they don't seem to be able to use it well. The ads I get on Facebook are sometimes really interesting (i.e. targeted well), on other pages it's mostly stuff I bought a while ago or topics where I don't even have a clue why they think that could be interesting.

And even though they can save it forever, it's outdated pretty quickly. If someone has information that I clicked a button 5 times when I visited a page in '09, this will have zero value now. The information is only valid for hours or days.

I guess most of this information is used to test behavior on pages and to optimize them. And I can only support that. Tracking like this is the reason why popular pages are intuitive. They perform A/B testing extensively to see what works best. I don't see an issue with that.

Pigo• 10 years ago

I sometimes wonder if I should be more concerned with privacy and my data than I am. I don't engage in risky behaviors, and use mailinator as much as possible. But I also have nothing to hide, and rarely share anything critical apart from cc# with amazon. If they want to know how often I show up and track events, I couldn't care less. I suppose it's good more people know what they're capable of. I know people who think they need to go Snowden when they're daily life is just finding answers on Stack Overflow and watching Joe Rogan on YouTube.

pdkl955• 10 years ago

they don't seem to be able to use it well

You are implicitly assuming that this won't change. Databases persist indefinitely.

The information is only valid for hours or days.

This simply isn't true. You seem to be only thinking about single data points, not the entire picture about your life that is painted when you aggregate that all of the captured data. For example, timestamps of your clicks build a pattern about when you use your computer, and the domain names you have visited (including the order you visited them) probably gives a reasonably accurate estimation of your political views, personal beliefs, and other data that you haven't shared on the web. (Bayesian analysis, machine learning, and other modern analysis methods do amazing things with minimal data)

I guess

It might be a good idea to not base your risk analysis on a guess. If you have no other option and have guess the level of risk, you should be assume the worse. Assuming benevolence (or incompetence) without evidence is incredibly foolish.

falcolas2• 10 years ago

they don't seem to be able to use it well

Or they are intentionally dialing back on the accuracy.

Being too accurate in your advertising is like delving into the uncanny valley of CGI. It gets spooky and makes people intentionally shy away from your products.

So, perhaps they're following the same trajectory as CGI: adding intentional inaccuracy to mask their actual targeted ads. If I saw the one thing I wanted in a lineup of four other poorly targeted ads, I'd be less likely to consider it as spooky, and more likely to treat it as I would any other advertisement. These companies follow you around the internet for years, after all. They can afford to play a long game.

Or it's just my tinfoil hat. Either way.

LeifCarrotson3• 10 years ago

But the goal of that optimization is not to make your life better, it's to make money for them.

They may be pretty bad at it now, but one thing about technology is that it gets better and better, and their goal is to encourage consumption of their product.

I'm thinking about buying a new laptop right now. I'm trying to make a smart choice, weighing the funds I have available, my need for it, the options available, my preferences for various brands and features, and my own desire to have new shiny stuff.

The advertisers can distort this rational decision. Right now they just have a poorly-targeted generic bit of text that I don't really read in the sidebar of certain websites, and I feel comfortable with this level of influence. If they were super-persuasive at selling their product to me Present Me would consider that theft. Future Me would probably be grateful to the advertiser, and that's terrifying.

A Self-Driving, Self-Selling Tesla might show up at my door, perform an inspection of my current car, and, in its silky voice, deliver an irrefutable argument why I must never get in that car again and should instead hop in for a free ride across state lines so I can take out a home equity loan and cash in my 401k to buy it. Yikes!

The optimistic side of this is that maybe they'll eventually move beyond market research and on to individual research to give us stuff that we actually want. "Oh, LeifCarrotson is filtering out our 1366x768 TN panels, doesn't seem to care about thickness, has recently read about the Samsung 960 Pro? Let's build him one with a big 9-cell battery and longer travel keyboard, a good screen, and one of those SSDs. And he seems to be running Linux? Let's swap our default touchpad for one with an open driver, and donate a few percent of the profits to the EFF, that's sure to make him happy."

rolodato• 10 years ago

It's true that everything that can be recorded will be recorded, but the actual way to not bring attention to you is to let everything be recorded. NoScript/Ghostery/etc users are actually the outliers. Similar to what happens with Tor.

I can find relief in the fact that it's extremely unlikely someone will look for your specific data because of the sheer volume of it. Website owners will just look at some charts and metrics in their analytics platform and that's it.

Diederich4• 10 years ago

Honest question.

I think, historically, most people have lived in very tight quarters, quite close to a lot of other people. Indeed, that's still true for many of us!

Some of these very 'always nearby' people would be family members and/or greatly trusted, but even one layer beyond that would be a lot of people who we would consider acquaintances today.

My question: isn't it possible that the amount of privacy some people had in the last couple of centuries was rather anomalous? That our default level of privacy has always been very low.

Edit: To be clear, I do not intend to minimize the value of privacy, whether it's a recent thing or not. However, some historical context is, I believe, useful.

iamnothere• 10 years ago

This is true for many things though. Isn't it true that the level of healthcare available recently is rather anomalous, historically speaking? Or the quantity of food available?

Technology can grant us advantages if we allow it. It can also take them away.

eveningcoffee• 10 years ago

There is an important difference. This transparency applied to the most of the people - everyone was transparent, except some exceptional people.

In many parts of the world we have lived already about two hundred years with expectation to high level privacy.

peller• 10 years ago

To state it another way: isn't it possible that the amount of freedom some people had in the last couple of centuries was rather anomalous? That our default level of freedom has always been very low?

I would posit both your and my "questions" are true. Does that truth make it any less worth fighting for? One might even argue, there is no such thing as freedom without privacy.

taneq• 10 years ago

Maybe it's time to accept that we are ems.

binthere• 10 years ago

Disable cookies and javascript. Use a decent browser such as Firefox, Tor. Use ddg.gg to search. Solved.

SeriousM• 10 years ago

Disable JavaScript is the first right step.

tdaltonc• 10 years ago

Monitoring and optimizing human behavior is what I do for a living so . . . I'm going to do more of the same.

Retra• 10 years ago

If the fullest extent at which they can exploit my activities is to show me mostly irrelevant shit that I'll never buy, then I'm not worried about it. It's be like worrying about all those 'psychics' that pretend to know what you're thinking by repeating what you've just said back at you. Whatever power they find there is an exploitation of other peoples' careless ignorance, which is something I do dread on occasion.

andai• 10 years ago

The Internet = other people's computers

agumonkey• 10 years ago

It motivates me to use lynx to surf or go to a library to read, and to some local store for music and books. The future looks marvellously humane.

garaetjjte• 10 years ago

How it knows how many cores CPU have?

debugish• 10 years ago

navigator.hardwareConcurrency

Klathmon• 10 years ago

and if that's not supported but web workers are, you can guess that information pretty damn accurately by doing work in an increasing number of threads and looking for where you stop seeing little-to-no slowdown.

SCdF• 10 years ago

Note that it's how many threads, not cores. I have a this CPU: http://ark.intel.com/products/84985/Intel-Core-i5-5257U-Proc... which the websites believes is 4 cores when really it's 2.

bpicolo• 10 years ago

It's logical cores vs physical cores.

lucb1e2• 10 years ago

Turns out this was made not more than 10 minutes walking from where I am right now. Kind of cool to see.

tirant• 10 years ago

and that is...?

ragebol2• 10 years ago

Eindhoven, Netherlands (Source: https://clickclickclick.click/credit)

mountaineer22• 10 years ago

Awesome work.

vool2• 10 years ago

hi score ?

GoToRO• 10 years ago

I used HotJar and it's pretty cool to see the actual website and the user navigating.

This is a video of an actual recording a site owner will see: https://www.youtube.com/watch?v=3Odc4k4KXjc

PuffinBlue• 10 years ago

I'm kind of amazed at the amount of mouse movement.

I move mine a bit but that was all over the place!

tomatohs• 10 years ago

I'm working on a similar project that aims to fully emulate the user's browser, http://screensquid.com

brianzelip• 10 years ago

What's the difference to the browser between "tripleclicking" the button and "clicking the button >X times in one second"?

ie: why did it respond that I "clicked the button seven times within one second" before it responded that I "tripleclicked the button for the first time"?

See this screenshot for reference: http://imgur.com/xhWHPQa

avisser• 10 years ago

In Windows, at least, on your ie: sentence,

* Single click - nothing

* Double click - highlight word

* Triple click - highlight paragraph

ryan-c• 10 years ago

I got "Subject has run script to click on the button 10 times in one second" by using xdotool click --delay 10 --repeat 100 1, wonder whether that's checking timing or just assuming nobody clicks that fast.

spuz• 10 years ago

I got a legitimate "Subject clicked button 10 times in one second". I didn't use a script so I assume that it either is able to detect the source of the event, or it checks to make sure the time between clicks is not fixed.

jagthebeetle• 10 years ago

Suspect it must be checking time, below didn't really trigger anything:

for (var i = 0; i < 30; i++) { setTimeout(()=> button.click(), Math.random()*1500) }

I wish bundle.js weren't minified, it could be fun to read.

korethr2• 10 years ago

http://unminify.com/ might help.

acqq• 10 years ago

Looking at the source of the page, its own description is

"A browser-based game on online profiling"

which is even better than the current HN title.

linkmotif• 10 years ago

Wow this is very nice. It is like my dream. The inline aggregations are really cool too. Great demo!

EDIT: First saw this on mobile. Didn't realize there was sound. Distracting for me. Wish it wasn't there. (Well done, though.)

janci• 10 years ago

Would be fun to see what other subjects are doing...

return0• 10 years ago

Haha. Well the narrator's accent betrays more than my mouse movements. could it be a dutch / danish white male in his late 20s?

gpvos• 10 years ago

Clearly a fairly strong Dutch accent.

mcintyre1994• 10 years ago

Surprising omissions: touch events, and zoom events.

Subject develops on a MacOS machine?

pault2• 10 years ago

"Subject is privacy conscious, educated"

1/2

korethr2• 10 years ago

I was somewhat unnerved when I heard that -- my reaction being something along the lines of "Uhh, yeah, but who told you that?"

I'm curious how it determines these things, so I'm looking through the unminified JS, trying to understand it.

Now if it were to detect and call out that I was trying to reverse engineer it, that would be truly creepy.

pault2• 10 years ago

I have a bunch of ad and tracker blockers installed, so in a certain sense I am "technically educated", but not classically so. :)

i336_3• 10 years ago

Subject has clicked on the button nine times within one second.

Yup, ThinkPads with their dual mice (and mouse buttons!) are cool.

Subject has run script to click on the button ten times within one second.

"Wha--" * looks at xterm with "sleep 1; while true; do xdotool click 1; done" in it * "how did you--"

Subject has tried to drag the body.

"So I can't select now?!"

Then I ran one of the JavaScript excerpts in another comment which proceeded to make the page continuously open extra tabs (from other links). Task Manager to the rescue...

kelseydh• 10 years ago

They should have showed more info from the request headers, like the subject's type of computer and location based on IP.

ChefDenominator• 10 years ago

I would like to see the app equivalent of this.

A demonstration of browser events used to monitor online behaviour

Related Stories