Banks and Retailers Are Tracking How You Type, Swipe and Tap

https://www.nytimes.com/2018/08/13/business/behavioral-biometrics-banks-security.html

106 70 8 years ago

Sigh... give them an inch and they take the universe. It seems like nearly every piece of local data an application can gather is being abused for privacy invasion, this time under the guise of fraud prevention. It's bullshit; we all know how this information will be used. Swiping, mouse movements, keyboard input habits, etc. will all be used to build a profile about you and target ads. What a sad, sad use of humanity's infinite ingenuity.

tomasien• 8 years ago

I think there's a fairly likely future that the banks and financial companies will try (and IMO succeed) to ban the providers of this data from using it for anything else. Aka: we will not use a biometrics service that uses our user's biometric data for anything other than fraud prevention and authentication.

The banks are ultra-sensitive about personal data at the moment at least, but they really want these kinds of solutions to stop fraud without interrupting your user experience. They have the scale to demand vendors stay in a particular use case and I think they'll succeed.

I would expect the future you're predicting to exist, but I expect it to come from e-commerce companies and others adopting tech from similar vendors but without demanding any restrictions on data use.

econ4all• 8 years ago

Do newspapers have to start a privacy panic about every damn thing? there are other ways to frame these reports, it's like they won't be satisfied until everything done on an electronic device is outlawed.

CaptSpify3• 8 years ago

Do we technologists need to build privacy invading tools on every damn thing?

They are reporting on a problem that we keep creating. I don't see any problems with this.

radiorental• 8 years ago

Huh? The customer ('banks') asked and paid for this functionality. Not the other way around.

You make it sound like software engineers lobbied Bank CTOs to install this under duress

malvosenior• 8 years ago

They do it for two reasons:

1. Outrage sells, so they like to cause outrage.

2. Their business model was invalidated by technology 20 years ago and they're still fighting to stay relevant.

If you want to see how they really feel about privacy, just visit their site with an ad blocker and see how many trackers get blocked.

bogomipz2• 8 years ago

This article is in the business section of the newspaper. That's not exactly the optimal section if your intention was to "start a privacy panic about every damn thing."

Many people including myself were not familiar with the companies mentioned in this article or the use of their software for fraud prevention, these are the thrust of the article not hysteria.

Your conspiratorial assessment of this article seems to be misplaced.

lostimpo• 8 years ago

Does anyone else feel a sense of overwhelming futility with respect to internet privacy? I'm at the point where I feel like I might as well just use all the fancy features and devices, privacy be damned.

It feels like it's a giant waste of time, even if you go out of your way to use "privacy protecting" expensive devices and software. Use an iPhone or LineageOS! Use Firefox! Don't use Google services! Don't use iCloud, back up everything to a local NAS! Pay for your email services!

It all feels mostly pointless. There's always another thing right around the corner. You're always defeated and tracked -- this time with "behavioral biometrics." For the average person, why not just give up? Throw an Amazon Echo in the corner and at least you can control your lights and play Jeopardy.

It's totally exhausting.

blakesterz2• 8 years ago

A helpful Venn Diagram:

http://flowingdata.com/2010/10/22/privacy-and-the-internet/

I've had that in my Privacy & Security slide deck for years. I say unless you're willing to go to EXTRAORDINARY lengths, there really is very little privacy. IT's been gone for years. Maybe new laws like the GDPR will help push things in the right direction?

394549• 8 years ago

I kinda feel like a best-effort attempt to minimize data-leakage + some kind of noise injection might be the best approach right now.

Ultimately though, I think we'll need legislative and platform solutions if we want to keep a good amount of online privacy. This just isn't something an individual can solve on their own.

beat2• 8 years ago

I deal with it mostly by asking myself what "privacy" I'm really concerned about. Let's see... I don't want anyone actually stealing my money. I don't want sensitive security information that can be used to steal my money (ie passwords) falling into unauthorized hands.

But my personal history? My photos? Words I've written? Oh well. If someone wants that stuff, they can probably get it. And the gaping maw of robotic commerce doesn't actually care about me personally, it only cares what it can sell me.

I'm not worried about the police or some authoritarian tyranny on a personal level, on the level where what I say on the internet matters. I worry about it in an impersonal way. When the robot overlords are rounding up the granola-munching people of south Minneapolis for extermination, they won't be checking our internet history first.

extralego2• 8 years ago

Like you, I don’t worry about it on a personal level.

Unlike you, I do worry about how such a breach of human rights affects my neighbors today.

This is a matter of prejudice and discrimination on a level we have never contended with.

The people most vulnerable are those who do have something to hide. Even if it’s not something I want them to hide (sex offenses are a popular example), I still support due process by a public justice system. I think anything else is asking for tyranny, so I think it’s important we consider those who are more likely to be marginalized.

Some things people might want to hide to prevent unjust prejudice and discrimination against them:

-Unpopular political views: It is in the interest of a healthy democracy to protect freedom of opinion . In the event that we fear their opinion, it is in our own interest that they feel free to educate themselves and grow. Freedom of access to education resources free of prejudice should not be confused with supporting online communities of hate.

-Lower/working class: discriminated against by potential employers, hampering the social mobility possible in our society

-Sick people: discriminated against by insurance companies, employers, advertisers

-People with STDs: The discrimination here is especially in humane. And separately, we should all understand the role that freedom of information and research resources has played in the progress we’ve made here.

-People of color: classically discriminated against by law enforcement and others

-Parents: well known to be targets of extreme advertising

-Aspiring parents: discriminated against by potential employers

plurgid• 8 years ago

But my personal history? My photos? Words I've written? Oh well. If someone wants that stuff, they can probably get it. And the gaping maw of robotic commerce doesn't actually care about me personally, it only cares what it can sell me. > I'm not worried about the police or some authoritarian tyranny on a personal level, on the level where what I say on the internet matters.

Yeah, but then 2016 happened. This sort of "tactical positioning" on internet privacy is where I was prior to that year. The fact of the mater is that "personal threat exposure", while not completely irrelevant, misses the forest for the trees.

It's not YOU they're trying to manipulate, it's the herd. And it works. And that eventually comes around to impacting you just as personally as if you'd posted your bank account number and ssn on facebook.

y-c-o-m-b• 8 years ago

Even if you truly have "nothing" to hide, how much do you trust these companies in securing the information from you they harvest? It's not necessarily the companies i'm worried about. It's the people that hack those companies i'm worried about. Once the hackers obtain that information, they can clone you and do all kinds of nasty fraud in your name. They can literally ruin your life.

EDIT: By clone I mean virtual clone of course, not Arnold Schwarzenegger "The 6th Day" clones

andrei_says_• 8 years ago

You quickly moved into hyperbole. You may not be rounded up, “just” unable to get a job, health insurance or car insurance (at viable prices).

If you are an activist, you may get arrested for an unrelated crime, like getting stopped after you had a few drinks (because geolocation) or discredited if you are not out as a gay person or for anything else which might garnish your image in any way.

Your ability to fly, or your airport experience could be influenced by invisible forces like driving around certain places or writing favorably toward certain policies or religions.

If you are a good looking woman you may be creepily stalked and tracked.

And let’s not kid ourself about the fact that more and more of this data will be sold and resold until it becomes a commodity available to anyone who is willing to pay a nominal price.

Believing in the story that your activity and data don’t matter because you don’t matter is in a way resigning to never become someone who might matter. And this is by design.

Privacy matters a huge deal. Especially in an assymetric situation.

https://www.ted.com/talks/glenn_greenwald_why_privacy_matter...

mindslight• 8 years ago

The type of passwords you're referencing can't actually be used to steal your money, as they only control access to reversible accounts. Timely monitoring of your banks' ledgers is far more important than securing passwords. (Though passwords leaking will certainly cause a headache!)

Meanwhile, behavioral surveillance most certainly can be used to steal your money eg the pricing games that airlines and insurance companies commonly play, tailored to the individual level. Slowly accumulating a savings account named for some elective goal, someone dies across the country, and you need to get there in a day? Time to jack your airline prices. You'd hope age-old market competition would preclude this, but communications tech has been undermining that as well.

flukus• 8 years ago

Let's see... I don't want anyone actually stealing my money.

If online shopping sites start charging you 10% more based on your profile indicating you can afford it would you consider that stealing? How about if they just "customize" what products you're shown and you only see the high end ones?

This is on top of all the soft manipulation advertising already does, it's entire reason for existence is to make you buy something you otherwise wouldn't have. It's not stealing but it still involves less money in your wallet.

ryandrake• 8 years ago

I stay sane by believing that as long as I stay active in the tech industry and do my best to constantly push to make things a little better, then I’m doing net good. The worst thing we can do is throw up our hands and admit defeat.

I try not to think about all those engineers out there on the other side, acting in opposition to user privacy, happily writing all this monitoring, tracking, fingerprinting, and profiling software. Many are probably readers here. I hope the paycheck is worth it.

pishpash2• 8 years ago

It has all been predicted, and when you throw hordes of PhD's at the problem, solutions will come. I think we should heed the more serious warnings about AI too and not be so cavalier.

bogomipz2• 8 years ago

I completely agree its exhausting and I think that's by design.

And even given the measures you outlined, if your friend uses FB,Google services you will be exposed to those services via their address book being hoovered up, their photo tagging, their WIFI etc.

I think legislation and regulation is the only thing that's going to provide any meaningful recourse.

rurounijones• 8 years ago

Does anyone else feel a sense of overwhelming futility with respect to internet privacy?

You had me at overwhelming futility

LeftTurnSignal• 8 years ago

Almost all of my friends are this way now. They just gave up on any sense of privacy and accepted it. I can't say I blame them. They have different needs / wants than I do, but I will admit it's pretty disheartening too.

I haven't given up yet, but it's such a pain in the ass if you don't keep up on it. I ended up just ditching any service that doesn't respect my privacy or at the very least, stick with ones that say they respect it.

If there's anything real important I have a few friends who usually let me know. I still do miss some events but I figure if no one remembered to ask me, it's not important, or I'm not that important. Either way, it's not my issue.

tdb7893• 8 years ago

Emotionally I didn't want companies to know about my life but practically it's going okay. Having companies know random information about me doesn't really affect my day to day life much (except for I have more targeted ads, which honestly isn't a negative).

Nasrudith• 8 years ago

I see it as an unfortunate consequence corollary to freedom of math and speech. If you give people the right to record and calculate everything they know it allows for invasive analytics in an attempt to soothsay by automating superstitions. If you don't have them then it opens abuses such as reporting that a scumbag serial Ponzi schemer convicted of doing so is "violating his right to be forgotten" and reporting that the local police just spend four hours loitering in diners and coffee shops is "illicitly tracking law enforcement". Restricting others to try to prevent it would prove lossy to freedom overall. Even a "no financialization" limit would allow shutting down a voting record of congress mapped to donor contributions because they are making money off of someone else's data if they try to cover their costs in any way.

I believe that the achievable thing to aim for is a transparent society instead of a half-mirror one.

blitmap• 8 years ago

I am probably very unaware of a Chrome or Firefox extension that allows this:

I wish I could Browse to... and set scripts to run before a page is navigated to. I know you can do this from the Dev Tools console just by hooking into events, but i wish there were something more user-friendly so it'd be easy to pass around scripts to average users. Simply to unreference or wrap JS APIs that allow things like this. You'd still need to be impossibly aware of what new API Google is introducing in Chrome every week. I wish they defined subsets of JS, like how there's a C++ embedded standard and such. I know in JS land you go by feature detection not profile selection (like OpenGL?).

We're just learning more ways to sandbox I suppose.

PS: I want the ability to easily re-order the scripts that run before/after an event fires.

Too• 8 years ago

Greasemonkey does exactly what you ask for, it's super easy to use and has a big library of website enhancers already.

vbezhenar• 8 years ago

I never cared much about that stuff. I trust big corporations, I always opt-in for telemetry and similar stuff, because I genuinely believe that it helps to make better software. And yes, I enjoy all fancy features and never had any problems with that. It's hard for me to understand people who don't want to use Windows 10 because of telemetry. It's awesome OS, who cares. It's not like Windows 98 was open source, you never really know what was collected back then, at least they are honest this time.

tcfunk• 8 years ago

Throw an Amazon Echo in the corner and at least you can control your lights and play Jeopardy.

This is where I have landed, sadly. Especially now that I have a family, I simply don't have time or energy to think about privacy all the time. And that's the only way you can fight it, is to think about it constantly.

codegeek• 8 years ago

I am totally with you on this. I only care about protecting what really matters to me. You cannot win. Companies are getting smarter on how to track you and they WILL track you no matter what you do. Hey I may be getting tracked right now typing all this. Who cares. Go ahead, show me some stupid ads. I won't click on them anyway. Or yea, get some sales guy to call my cell because I was labeled as a potential lead for some stuff based on a page I visited. I never pick up unknown calls. Next.

godelski• 8 years ago

I have a few comments on this subject.

1) We are in tech. So what we do signals to others. How much we care signals to the public how much they care. If we don't, then why should they? And if they don't, how does legislation pass to prevent extreme invasion? It is in our (and companies') nature to push boundaries. If we don't get upset and do something then they push back.

2) There is more that I care about than Company X has Y data on me. Do I trust that company to be secure? Maybe now, but later? And that's where the government issue comes in. It isn't always about what the government is now, but can become. It should always be set up to be that IF there somehow became a dictator or oligarch, that they couldn't gain trivial access to tools that would exert extreme control.

Or can a foreign adversary exert control by using these tools (cough Russia cough)?

Yes, that kind of thing is unlikely in America, but it is much more likely to happen in other countries and what we do in the First World affects them. I personally am not worried about Trump trying to become dictator, but do we really want to set the ground for someone 50-100 years down the line that might try? Or do we want to make such an action as difficult as possible? And if they do gain that power we want to limit it as much as possible. (What happens when your system fails? Design FOR failure)

3) The argument of "we'll always be fighting" is a sadly true, but one that you can't let yourself be disheartened by. Because that would be like someone saying "well hackers are always going to try to get into my bank account, so I might as well let them." Currently we are the underdogs, and that is why it is so much harder now. But the only way to change that is to gain a critical mass.

So I ask, even if you don't think there is anything you can do and you can not take the steps to add more than minimal protection, then TALK about it. To me, the worst thing that can happen is that the public becomes (stays) complacent. While they are complacent and do not understand the consequences, then there can be no change and it will be a fruitless fight. But I think right now we have the best opportunity we've had in a long time to convince average people to care. (Facebook, Equifax, GDPR, Russian Hacks (which show how VERY real the adversarial abuse of data from non-malicious actors can be), etc).

cm2187• 8 years ago

It's not like you have a choice for everything. You want a phone? Chose your evil: apple or google. And try using one of those without an account.

blakesterz2• 8 years ago

After reading this one I'm not sure this is as bad as I thought it would be based on the headline:

"On new account applications, for example, behavioral biometric systems pay close attention to where and when applicants pause. A legitimate applicant typically types personal information — their name, their address, their Social Security number — fluidly, with few breaks. A scammer will often either cut and paste or take breaks to consult their notes."

It's currently used to do security checks. And it's being done while your interacting with the site/app. Seems like a useful security check, though I suppose there's some potential for abuse, somehow?

I think Google's CAPCHTCA thing does this too? It watches how your mouse moves and knows your a real person (or something close to that).

lugg• 8 years ago

It's a signal. False positives need to be handled in some way. For captcha, they give you a captcha. For payments type stuff it's likely just one of hundreds of signals you can use to build a score that can raise a manual review above a certain threshold.

There is a company or two in this space that do an OK job of it.

delinka• 8 years ago

The easy way around this as a scammer is to have the reference material visible beside the screen. I suspect it's another layer to augment existing verification checks. I do wonder about the false negative rate.

athenot• 8 years ago

Unfortunately, this simplistic behavior modeling ends up being incompatible with autofill and password managers.

Bartweiss2• 8 years ago

My bank's in-app password reset tool clears all fields and requires you to restart if the app is suspended mid-form. It also disables copy + paste into the app fields. And, their identity verification involves texting you a 10-digit security code, which falls just outside of most people's working memory.

And I use it often, because their password requirements are incredibly specific - so specific they cripple the search space - and they won't allow password manager pasting. Of course, if I made my password "dragondragondragon1!", they'd happily accept it and I'd never have to use their torturous interface.

It's amazing how far security features can go in being both anti-user and anti-security.

21• 8 years ago

though I suppose there's some potential for abuse, somehow?

One day you want to post online a video obtained through illegal means (for example you film animal abuse in a US abatory), you buy a burner phone and go to an open Wifi, but the behavioral fingerprint you left behind while using YouTube is used to track you down.

I guess this is still fair game, you were breaking the law after all, but you get the idea.

jack_pp• 8 years ago

I really really doubt you could get such a specific fingerprint and even so, you could automate video uploading to YouTube in a script

boboboba2• 8 years ago

I guess it's a good thing that nobody with kids, a disability, or any other distractions ever fills out online forms when other things are happening in their homes, then!

I have often had my typing of personal information interrupted by my dog coming up and pushing my hand while I'm typing. Guess I wouldn't be able to apply for a loan from these people. Sheesh. What useless poppycock.

pishpash2• 8 years ago

Banks have been reocrding you non-stop to use for "voiceprint," under the existing disclaimer and guise of "training purposes," also highly invasive.

walterbell2• 8 years ago

We need a list of banks which do and don't track their users this way, or at least allow their customers to opt out.

soared• 8 years ago

FUD. Provide some proof when you make a claim like that. If you've ever worked outside of dev you know how a paper trail or physical recording is critical for everything that happens in a businesses. You think a bank would let a customer and rep make account changes over the phone and not have a recording of that? What happens when there is a disagreement about what was said?

giarc• 8 years ago

Journalists need to realize that likely every app is doing this. Look at the companies providing this data (FullStory, MouseFlow, AppSee etc etc), they are industry agnostic. It's as easy as installing a library or adding a few lines of code and voila, you have this same data.

Bartweiss2• 8 years ago

This would be a huge improvement in the quality of these stories.

There's a meaningful difference between something like Red Shell, where a few games gathered data that most others don't collect, and the stream of "apps log events!" stories which find some examples and present them as company-specific outrages instead of a nasty practice across the industry. Without understanding that, it's hard to have a useful discussion about tracking.

sailfast4• 8 years ago

I understand these metrics are easy to capture, but only if the browser / device makes it accessible via APIs. How difficult would it be to notify users (like GPS use, or Notifications on a phone) that X information is also being captured and allow for an opt-in?

It's not trivial as obviously applications need to know at some level where users are clicking / tapping to function, but does the device need to share that with the code being executed and/or can it hide that layer?

I'd pay good money (or pay money to support) a browser that did this well on mobile / desktop. (Tails browser has similar prompts for this kind of thing)

Admittedly, I am not well versed in the lower-level workings of the browser, so this may be a stupid thing to ask for.

Raphmedia• 8 years ago

How would the browser know which to block?

`onClick(){fetchAllForumTopics();}` vs `onClick(){sendTrackingData();}`. Both are simple ajax calls.

Even if you somehow managed to know which calls to block, you could simply hack it by calling a jpg with extra parameters and then have the server save those:

`onClick(){body.css({backgroundImage: 'http :// mysite.com/ images/ logo.png?x=123&y=512&elementName=BankAccountNumber'});}`

notyourwork• 8 years ago

Even ignoring that knowing where you click is as simple as knowing what feature you use. If you login then I know you clicked login, if you perform a search then I know you clicked on the search input. Usage of an element tells you where a user clicks. It misses things like clicking on whitespace or where your cursor traverses.

sailfast4• 8 years ago

I wasn't thinking of blocking specific function calls so much as that data not being available to the browser at all to send in the first place, providing the ability to selectively block mouse x,y coordinates tracking, etc before the code on the page was executed.

Again, this may not be possible without breaking the web given the structure of the browser and what pages need to render at a low level. Perhaps client-side middleware that only passes user data when an action is performed rather than constantly streaming coordinate and interaction data all the time?

CuriousSkeptic• 8 years ago

I’m thinking broadcast models of publication is inherently less privacy invasive.

So a browser only functioning over a federated content addressable web fetching content from trusted cache nodes could help isolate the problem to only vet information intentionally meant to be communicated leaving pure consumption reasonably private.

chapium• 8 years ago

I for one, prefer not to be harassed by popups all day. What you propose is EU check for cookies, EU check for privacy statement, GPS check accelerometer check, keyboard check?

Ok, now we are getting a little ridiculous. If keyboard usage can be checked, that would be a warning for nearly every website. This reminds me of the app usage warnings on Android, which request access for every phone function. Or in California, the "Known to the state of California to cause cancer" notices that are in literally every restaurant.

When everything has a warning sign on it, nothing does. Opt-in just trains the user to ignore all of the prompts. A better solution in my opinion, would be to improve browser security and don't allow these APIs to be exploited beyond narrow use cases. In the interim, extensions could be used to reduce the effectiveness of all manner of data collecting.

There also is something to be said about user habits. For example, some websites are very intrusive with ads. My solution? I don't visit that site and find the information elsewhere. This is where extensions or browser features would be great. What if we created a privacy index on each site? Then the user could choose whether a visit to that site is necessary.

sailfast4• 8 years ago

What I am asking for above was precisely what you suggest, a way to prevent the browser from making those APIs available for significant tracking purposes. Initially this might be "hey do you want to share your finger motions / accelerometer with this app" and I'd be OK with a number of pop-ups on first app open, but I'm a customer, not an app developer so I don't really care about the impact on adoption - I care about the privacy.

tinus_hn• 8 years ago

You can’t easily block this without blocking a lot of legitimate behavior like rollover menus.

jasonlotito3• 8 years ago

This has been going on for more than a decade. I implemented something like this back in 2004 for a payments page. The goal was completely focused on 1) fighting fraud 2) finding problems with filling out forms and 3) improving the experience for users.

People can argue that these things can be used for nefarious purposes, such as serving up targeted ads, but that's literally every browser you've ever used. That's literally the internet, and how it works.

thecombjelly2• 8 years ago

This is abuse and wrong. Just as it is abuse and wrong for every website or app that does something similar. And this couldn't exist if we as software creators didn't make it. We as the creators of software need to look at everything we create for its potential to be used against people and if it could potentially be used to abuse someone, like say exposing interfaces that can be used for biometrics, we need to refuse to make it. People have survived for ages without your software and they might be better off if it stays that way. Don't be a part of this.

boboboba2• 8 years ago

But how would that work? If I work on a word processing application, that application can be used to write horrible lies and propaganda that many people would believe. Are you saying I shouldn't work on such a product because of that?

If you look at the story of how browser cookies came about[0], it wasn't for advertising and tracking people. It was just intended to be a simple way to allow users to keep state between web pages to provide services the people wanted. It was later hijacked by ad companies to do surveillance and then the government hopped on board.

[0] https://en.wikipedia.org/wiki/HTTP_cookie#History

thecombjelly2• 8 years ago

I think you make a great point. We _should_ question whether it's a good idea to make the word processor. I'm not saying it shouldn't necessarily be made but we should think about how it can be used and if the potential for harm is too high or if it can be mitigated. My point is these things should always be kept in mind and we need to not be afraid of not making the technology.

walterbell2• 8 years ago

Because your reaction is so individual, it’s hard for a fraudulent user to fake.

Malware can record behavioral user data from a compromised device then replay/modify to simulate the human on that device or another. Yet another arms race for black marketable behavioral "signatures".

rconti• 8 years ago

Is this why the New York Times webpage scrolling stops working every time my mouse arrow ends up over an ad?

rahimnathwani• 8 years ago

"Then the visitor typed on the numerical strip at the top of a keyboard, not the side number pad the customer typically used."

How can a browser-based app detect whether I'm using the number pad or not?

Banks and Retailers Are Tracking How You Type, Swipe and Tap

Related Stories