Many popular websites see what you type before you hit submit

https://www.wired.com/story/leaky-forms-keyloggers-meta-tiktok-pixel-study/

by amanzi • 4 years ago

204 227 4 years ago

shadowgovt• 4 years ago

This isn't terribly surprising given how many sites are architected so that the page running in your client is just the UI for an app running on a server. Auto completion of addresses, for example, requires this approach unless you want to download the entire planet's address database onto an end user's machine.

Where Google goes, others will follow.

Agamus4• 4 years ago

Every time I see an article like this, it disturbs me to think that it is 2022 and this is news to people.

stewx• 4 years ago

Unless you are ultra-paranoid or cynical, it is pretty reasonable to believe that a site is not submitting the contents of a form before you click the Submit button.

unsupp0rted• 4 years ago

Especially because why would they? What do they gain from seeing first drafts of form submissions?

The closest thing I can think of is as an "abandoned cart" for forms.

"You were about to submit our contact form to ask about our software. Are you still interested in a demo? (we're evil, by the way)"

Agamus4• 4 years ago

Agreed, but it still disturbs me.

And I do think that a normal person must be a bit pathologically skewed, here in 2022, if they are not a little bit cynical or paranoid when they interface with a computer.

Finally, one can be ultra-paranoid, cynical, or just mildly knowledgeable about the technology upon which the entire modern experience depends.

dwringer• 4 years ago

I remember having discussions about this exact thing over 20 years ago. The fact that it's still considered ultra-paranoid or cynical after all this time is unsettling to me.

XCSme10• 4 years ago

As far as I know many support/chat applications do this, so the support rep can see what you typet/think and respond faster. Also useful if the user is trying to scam the company, they can see if the user changes details about their story while typing.

Whenever I talk in a chat pop-up I always assume they see live what I'm typing.

rchaud5• 4 years ago

Why? Most people are not web experts.

There's probably an untold amount of shady data-trading stuff happening whenever I swipe my credit card at a POS somewhere. I don't know because I'm not a payment processor expert.

slingnow2• 4 years ago

You don't have to know the intimate technical details. You just need to have the awareness that "something shady is probably happening as a result of this interaction".

If someone is surprised that in 2022 people are tracking / logging your digital interactions, well, I don't know what to say.

tbm57• 4 years ago

I think it's better that these types of things remain 'news.' It would be much worse to give up ground on privacy.

baal80spam• 4 years ago

Just try to browse the web with noscript (most browsers have a switch to toggle JavaScript, alternatively use uBlock Origin) - many pages won't render at all! It's a really sad state of affairs.

When I need to allow JavaScript on a page - I know all bets are off.

forgotmypw17• 4 years ago

I've noticed over time that requiring JS correlates heavily with low quality content and other abusive behavior, so closing the tab saves me time and nothing of value is lost.

kkfx• 4 years ago

I do that regularly, just allowing few websites and only for certain js, FF Reader also help sometime...

pteraspidomorph• 4 years ago

It's because modern client-side frameworks like react or vue use javascript for routing, and in fact storing every character in a form as you type it is a basic design principle in such frameworks. If you are curious, you can install their respective dev tool extensions so you can tell at a glance which framework a website is using by checking which button lights up in the browser toolbar.

I like the uBlock Origin toggle myself, aka the "naughty website gets no javascript" button.

Agamus4• 4 years ago

I have used this as a general policy for whether or not I interact with a site since about 2004. That policy has kept me 100% off Twitter, Facebook, etc, since they appeared. I highly recommend, for those who can live without the modern web reality.

mcdonje2• 4 years ago

Privacy concerns aside, I'm having trouble understanding the value prop. It's more to build and maintain, requires more bandwidth and storage, and the resulting dataset is mostly noise or not significantly different from what was submitted. Data mining that would be a lot of work for very little gain in most cases.

Dave3of54• 4 years ago

I'm having trouble understanding the value prop

It'll be for abandoned signups.

If someone is literally on the signup page but end up not clicking the submit button you want to find out what stopped them and coerce them somehow to actually clicking the button.

The more data you gather about the process the more you can adapt the signup page to actually get them to click the button. It's really important for startups as one of their KPI's will be new signups per X. Companies like slack, facebook, youtube ..etc have teams of people who are working on this type of thing.

Note: I do not condone this type of invasive analytics but I'm telling you why they do it that's all.

mcdonje2• 4 years ago

I hadn't thought of that, thanks. I suppose if there's a trend of users quitting when they get to a certain sign up field, the company can determine if that field can be changed or removed.

ohwellhere• 4 years ago

I worked for a popular software services company that used this sort of thing on their inbound interest forms.

They found that oftentimes prospective clients would write a first draft that was much more candid about what they wanted and what their budget was, and then they'd revise it to make it more circumspect before submitting.

Going into negotiations, our side had the original unfiltered data.

bennyp1012• 4 years ago

In the article they mention getting emails from sites to follow up.

“Your basket is still here” kinda thing

thedougd2• 4 years ago

I take advantage of this on a few websites. Sears Parts Direct is a good example. Add the items to your cart, fill out your information and do not complete checkout. In a few hours you'll have a 10-20% off coupon in your inbox asking you to finish your checkout.

feoren2• 4 years ago

Adding items to your cart counts as "hitting submit". "Hitting submit" means you asked the site to save some information or change state somehow. You can do what you describe without secretly collecting data that the user didn't want you to collect.

sudobash1• 4 years ago

There was a submission[1] here on HN a while back which went into some detail about the how and why. He got an email from a site that he started to sign up for, but did not hit submit. Using the browser dev tools, he saw that it recorded the email that he put in.

[1] https://news.ycombinator.com/item?id=23384452

Dave3of54• 4 years ago

Btw it's worse that this.

Most popular website are tracking your mouse movements and clicks on their website. It's called a user heatmap and it's meant to be used to see what users are actually clicking on when they drop into your website i.e. everyone highlighted this word on you copy or stopped scrolling after this section that sort of thing.

It's been happening for many years. If you don't want to give websites this data block javascript in your browser by default.

bennyp1012• 4 years ago

I don’t really have a problem with this - as long as it’s not tracking people - I don’t think it’s unreasonable to know where people are clicking most.

Seems fairly sensible to figure out how to optimise the ui

rchaud5• 4 years ago

Precisely. If anything, session recordings are one of the least invasive forms of tracking because they restrict data collection to what you do on the website you're visiting.

They don't record information typed into forms, e.g. addresses, emails, CC numbers. Well, some don't record by default, with others you have to specify that manually.

Either way, it's better than a Facebook or Twitter Like buttons that infest the web and connect your visits with that site to your Twitter/FB account.

ramesh314• 4 years ago

I don’t really have a problem with this - as long as it’s not tracking people

It is. Everything you do is being logged and categorized, and your automatically assigned device fingerprinted user UID (whether you've made an account or not), is associated to all of your actions. Those associations are then dumped into a data lake for data scientists to mine for marketing purposes, and to cross-reference your activities across other sites.

dave5104• 4 years ago

as long as it’s not tracking people

I'm sure some sites don't do this, but plenty do.

Check out FullStory. It's a drop-in Javascript snippet (aka accessible to any marketing/design folks) that records the DOM and rebuilds it as a playable video in their backend as if you were doing a screenshare and recording it.

https://www.fullstory.com/

ramesh314• 4 years ago

Most popular website are tracking your mouse movements and clicks on their website. It's called a user heatmap and it's meant to be used to see what users are actually clicking on when they drop into your website i.e. everyone highlighted this word on you copy or stopped scrolling after this section that sort of thing.

It's even worse than this. They have full HD screen recordings of every single user session, including all values typed into any input field regardless of submission. I can pull up hundreds of thousands of unique user sessions right now and sit there watching everything they did on our sites, going back for years.

Say it with me now:

Every. Single. Interaction. With. Any. Computer. Is. Tracked.

konfusinomicon• 4 years ago

I had a serious moral dilemma when I was tasked with implementing that product for a client. it definitely crosses the digital tracking creepy line

Dave3of54• 4 years ago

It would be really inefficient to store this as a full HD video for thousands of users.

If you store and mouse movements, scroll events, clicks ...etc and you know what the website looked like then you can replay these to produce something that looks like a video. The bonus points is that you can run mathematically analysis on the clickstream to get things like most clicked area and suchlike.

It's actually the same data that's used in the heatmap just a different visualisation.

endemic• 4 years ago

Yeah, I knew about heatmaps, but my eyes were opened further by a product that my current company uses that can replay a user’s actions on the entire site — it’s like watching over their shoulder.

kornhole• 4 years ago

And forms in many pages are analyzing text and typing patterns as you type. This can actually be used to identify someone. I generally resort to typing everything into a notepad and then pasting when ready. Whonix resolves this, but my work on work computer is slowed down by this inefficient process.

kaeruct• 4 years ago

I know of hotjar, it's used in quite a few ecommerce sites. What other tools like it exist?

karaterobot2• 4 years ago

FullStory is a competitor. We used it at a previous company. From a product design perspective, it was amazing to have that tool available, to see where users were running into problems with our application. From a privacy perspective, I can definitely see how it would freak someone out.

tmaly• 4 years ago

could a browser extension be used to scramble the movement and click events?

hnrodey• 4 years ago

In the early days, Instagram silently uploaded your photo before you actually officially posted as a way to improve the "speed" of the user experience. So go ahead and add your filters, the text for the post, etc. because then the moment you clicked Post the app presented like it happened immediately. All for the UX.

Source: Kevin Systrom on Lex Fridman Podcast https://www.youtube.com/watch?v=3pvpNKUPbIY

webo2• 4 years ago

That doesn’t sound bad to me? Email attachments and file uploads have worked like that on the web way before instagram.

SamBam• 4 years ago

For an email file attachment it quite clearly shows it uploading.

The issue with the Instagram model is that it looks like you are just doing things locally on your phone, and haven't uploaded yet. If you have second thoughts and decide not to post the pic, Instagram could keep the photo.

That said, I don't really see why they would do this. What would it gain them to keep millions of discarded photos?

monkeybutton3• 4 years ago

One fun and not so obvious insight learned from tracking what users type is that some users have an average message length longer than what they type.

XCSme10• 4 years ago

I usually type my message, then reread it and optimize/shorten it if possible before submitting. Sometimes I even discard the message entirely.

monkeybutton3• 4 years ago

That would give you an average message length that's shorter than what you typed. In the case that it was longer, it turned out those users were copying and pasting the content, then maybe editing it a bit before sending.

blueatlas• 4 years ago

Is there a browser extension that will show a visual indication of network activity so I know to take a closer look via the network monitor. I know - it might flash all the time, but at least I can take a closer look to assess the sites that I visit regularly.

DerekBickerton4• 4 years ago

Not browser extensions, but firewalls where you can monitor your traffic on the OS:

(TCP View is not really a firewall however, it just lets you inspect traffic, but not block it or filter it)

https://github.com/evilsocket/opensnitch (Linux)

https://www.obdev.at/products/littlesnitch/index.html (Mac)

https://www.glasswire.com/ (Windows)

https://docs.microsoft.com/en-us/sysinternals/downloads/tcpv... (Windows)

dewey2• 4 years ago

That doesn't really help you as if you want to use the website you already allow connections to that host and as far as I know these are mostly aimed at hostnames not the endpoint where the "creepy" request is being fired at.

JKCalhoun4• 4 years ago

Or a browser extension that captures your text in a floating window just over the focused text field — user has to hit Enter/Return before it moves it from floaty window to web document.

(Wondering if some built-in accessibility features in the OS might have something similar.)

DerekBickerton4• 4 years ago

I once lost focus of my terminal and typed in my root password into Stack Overflow (I prolly had too many whiskeys). Glad Stack Overflow didn't have a covert keylogger, and JavaScript was disabled so I got lucky.

Protip: Always make sure the focus is on your terminal when typing in credentials to it, or any input box that holds sensitive info. I sometimes forget to focus Firefox's master password prompt too and end up typing my Firefox master passphrase into other apps!

travisporter• 4 years ago

I cannot begin to express my rage at windows changing focus when typing. Is there no way for it to not do this when receiving input? Feels like it should be an OS feature

tailspin20192• 4 years ago

macOS does this occasionally too, with pop ups sometimes appearing while I type (software update messages etc)

Especially problematic if you happen to hit Enter for a line return and end up accepting the default selected button on the popup instead.

I think there should be some OS-level heuristics-driven functionality to prevent or delay this sort of thing while the user is actually inputting data. And prevent any third party apps from overriding this unless consent is explicitly given (if the app really needs direct control over window focus) similar to how consent is required for apps to record the screen in macOS.

julius• 4 years ago

With OpenBox (linux window manager thing ... included in eg LXDE) there is a configuration option called "Focus new windows when they appear". You can uncheck that (have not tried it myself).

pwg• 4 years ago

This seems to be an artifact of OS's that also decide that "window on top must have keyboard focus" (i.e., MSWin is very bad in this regard). Because the pop-up dialog must be "on top" to be a pop-up, the OS's built in design of "window on top must have keyboard focus" results in the popup gaining keyboard focus, even if you are actively typing into another window at the same time.

On my Linux system, I run Fvwm2, and because on X the decision to grant focus to a window lies with the window manager, I can control who gets focus via my Fvwm2 config. I have Fvwm2 set for focus follows mouse so unless a popup happens to appear, directly under where the mouse cursor happens to be at that moment, the popup can appear, and be "on top" and my keyboard focus is unchanged.

I also have Fvwm2 configured so that a window gaining focus does not in any way change its order in the stack, so I can focus, and type, into a partially obscured window, without ever moving that window up/down from where it sits. An old version of OpenOffice (I think back when it was still called StarOffice) had decided at some point that if the mouse cursor so much as brushed across its window that it would pop itself to the top and take keyboard focus. That happened about two times, then I added a couple lines to my Fvwm2 config to take away StarOffice's ability to both take focus and to raise itself to the top, and it became a properly behaved program that stayed put until I told it specifically to move to the top.

These kinds of irritants can be fixed, but only if the environment one uses gives one the ability to control these miss-behaviors.

spockz• 4 years ago

I seem to recall “do not steal focus” was a hard rule in the macOS human interaction guidelines. However, lately, macOS itself even steals focus and more and more apps steal focus as well. Most notably through authentication/authorisation dialogs.

It is indeed, furiating.

mdaniel• 4 years ago

For sure, and doubly(?) bad when some system dialog pops up, with "Reboot now" or "Confirm, upgrade" selected, so the "enter" key for the command you were cheerfully typing now causes havoc

/me gives Ubuntu the evil eye

tailspin20192• 4 years ago

Related to this, I’m constantly paranoid about entering confidential data into communications apps.

Once having typed a password into Teams, I decided to create a small Keyboard Maestro automation (on Mac) to automatically remove focus from apps like Teams after a short period of inactivity. It’s not intrusive but just ensures that the current focus is not left in the chat message box when I’m not actually typing chat messages.

Additionally I’ve taken to having all comms related apps on a separate machine to my main development machine. This was ostensibly for reasons of reducing distractions, but hugely helps reduce the risk of this sort of accidental input as well.

XCSme10• 4 years ago

Do you think that if they had loggers or if you submitted your search query, anyone could realistically use that information in any way?

DerekBickerton4• 4 years ago

Well they could SSH into my box if they had my root password, so it's a plausible threat.

aendruk• 4 years ago

I once accidentally changed my AIM screen name to my password. Apparently all it took was clicking on your name in the buddy list.

titzer2• 4 years ago

I love how this site rendered the full article but magically transformed itself to hide everything but the first paragraph, the words literally disappearing under my eyes. And then the rest of the page is "enjoy more great articles from Wired". Like, hello, I didn't even enjoy one!?

A dark pattern all too common these days. I hate the modern web.

next_xibalba2• 4 years ago

A dark pattern all too common these days. I hate the modern web.

This is a belief I strongly disagree with that has become pervasive on HN: "I don't like this thing so it is a dark pattern/is toxic, etc." People will, on the one hand, decry the current state of news media and bemoan how Google and/or Facebook have destroyed or perversely mutated it, while, on the other hand, decry the efforts of the news media to monetize (aka get paid) for their efforts.

There is no free lunch. Journalism isn't free. Labor isn't free. We certainly aren't entitled to the free use of the products of each other's labor.

dec0dedab0de• 4 years ago

There is no free lunch. Journalism isn't free. Labor isn't free. We certainly aren't entitled to the free use of the products of each other's labor.

Sure, but it's rude to present something and then take it away. Google used to downrank sites who did this, anyone remember how awful experts exchange was? If they want to have a paywall then they should have a paywall.

jchw3• 4 years ago

Understood.

However, it’s also not my problem to solve. That’s a problem for Wired to solve. How I feel about these UX patterns and business models is not negotiable; it’s an honest reaction. How Wired makes money and deals with free use is negotiable.

The internet has not been kind to many business models, particularly, it has been rough on paying for content. That’s just what happens when copying costs basically $0. You can pirate almost anything and people definitely do. Many people will immediately hop on archive.is if they hit one of these patterns. Personally I often just don’t read the article and leave.

In the end, it isn’t my problem if people don’t like my attitude. Wired is trying to sell to me, so it is absolutely their problem if I don’t like this pattern. And guess what? I am, in fact, a former Wired subscriber. Maybe they make more money now that they paywall, but I don’t even care. I’m still going to hate them for it.

Likewise, I will never like or respect being forced into advertisements. If I like something enough, I will pay for it. I pay for YouTube and it feels like a win/win for me.

Bancakes• 4 years ago

So throw your hands up and close the office. It's a win-win. No wasted effort on their part, and no flow of garbage websites on our part.

notreallyserio• 4 years ago

IMO the dark pattern here is that they ask for money and also show ads. I assume they still show ads to subscribers given their magazine roots (they don't list "no ads" as a benefit). I'm willing to pay for services but not if they still attempt to show me ads.

oauea4• 4 years ago

Go back to the early 2000s and admire all the work people put out for free on the net because they enjoyed doing it. This was thriving, but then people with dollar signs for eyes took over and now we're stuck with them.

ls15• 4 years ago

There is no free lunch. Journalism isn't free. Labor isn't free. We certainly aren't entitled to the free use of the products of each other's labor.

So non-free stories should not get any free promotion on HN then. Non-free outlets are not entitled to get their free share of my attention.

Where can I send the bill for the occasions where they managed to fly under the radar and grab a bit of my attention without paying (me) for it?

titzer2• 4 years ago

There is no free lunch.

It's just a bait and switch. These journalists want all the benefits of the web: free indexing and archiving, free global distribution and rendering, virtual word-of-mouth advertising; a huge and easy revenue generation model. Their production and design costs are nothing compared to two decades ago. They don't own printing presses. The internet pretty much bends over backwards to throw traffic at them, and on top of that, they rip the rug out under your feet as soon as you land there! Like you can't even read the words that they wrote unless you agree to more bother, and they've already made a few cents off you just from the ads that were served! And to boot, the whole show shoved megabytes of crap in your face, which actually costs you money, and they follow you around the internet like an unimaginable creep.

It's like they feel entitled to all this free stuff and the one thing they offer of value they pull back at the last second. Shitty.

denton-scratch3• 4 years ago

Journalism isn't free.

So print newspapers, and sell them. I regard the worldwide web as free to use; I treat sites that don't share my view as not being part of the worldwide web.

The world is full of interesting websites. If a website doesn't want me to read it, that's fine, I'll move on.

logifail• 4 years ago

but magically transformed itself

It loads just fine with NoScript enabled. It also loads instantaneously (well, almost - ~200ms) and doesn't autoplay video or nag about cookies.

JKCalhoun4• 4 years ago

Also in Safari: "Settings for wired.com" —> "Use Reader when available"

But I agree that it sucks to be here. And while I agree that journalism is between a rock and a hard place to all of our detriment, not sure "Wired" is that kind of journalism.

mulmboy• 4 years ago

I'd question whether it's really a dark pattern. Seems like a benign way of monetizing their articles. A little annoying, sure, but nothing "dark", nothing misleading

anderber• 4 years ago

Funny too, turning off JS for Wired not only stopped that behavior but made the page load incredibly fast.

JKCalhoun4• 4 years ago

Funny ha-ha or funny sad?

ShowalkKama• 4 years ago

for anyone else having this issue: https://txtify.it/https://www.wired.com/story/leaky-forms-ke...

or just disable javascript

nwsm• 4 years ago

Is it really a "dark pattern" to charge for content? There have been premium forums and sites since the dawn of the internet. The only difference here is that it is made painfully obvious how easily they could make the content available to you.

I suppose you mean "I hate people making money off the modern web"

karaterobot2• 4 years ago

"Dark pattern" seems like one of those phrases that's in the process of changing its definition. People use it to mean anything in software that they don't like. It used to mean something that tricked the user into paying money or attention. I don't see how this is a trick (I also find it annoying, as you do).

Lio• 4 years ago

I think it's a bit of a trick because instead of just blocking the page unless you're inside the paywall they let you download it and then whip it away from you are you're reading it.

Designing something to deliberately annoy people when they could just be upfront about things seems like a tricksy way to behave IMHO.

ramesh314• 4 years ago

Wait until they find out about Fullstory.

grumple2• 4 years ago

This is pretty common and it's easy to do. It was popularized first by Google search decades ago, then by Facebook search. How do you think they make suggestions as you are typing?

Responsiveness creates a better user experience.

In our use cases we are using this primarily in search fields. In a few places we do queries onblur. The cost of these queries is trivial, directly hitting indexed db columns. I don't think we have any db inserts triggered from this behavior, and we don't log request params as a general rule (except rarely for short term debugging or non-sensitive performance tracking).

JKCalhoun4• 4 years ago

It's wrong to do it on posts though. I have often responded to a comment with a rather heated reply before thinking better of it and hitting the Cancel button. I guess I like to vent but would rather my "venting" not end up in some site's DB.

grumple2• 4 years ago

Totally get it, and it is a problem. I don't like it, and I also don't like clipboard access. Browsers could have a mode that prevents this, similar to how certain features don't work unless a user has interacted with the page (like playing sound). Something like no queries when an input field contains data unless the user submits a form via a click or enter.

chmod7754• 4 years ago

As an EU citizen, do the following: Paste some information about yourself into one of these forms without submitting, then send them an e-mail asking them to delete your personal information. Bonus points for having your lawyer write that mail, so it gets handled by their legal department instead of regular support. Watch them scramble trying to figure out how to even go about that. When gentle reminders to not irresponsibly collect data aren't enough, maybe a kick in the teeth will do.

Shit sites becoming responsible for all the data they soak up couldn't have happened soon enough.

rchaud5• 4 years ago

Or just block the Facebook and Tiktok pixels at the browser level and save yourself the hassle.

mort964• 4 years ago

People keep talking about having "your lawyer" do something as if everyone just walks around with a personal pet lawyer and I never understood it. Are you suggesting that you should hire a law firm at $1000/hour to mildly annoy some website..?

oauea4• 4 years ago

I've never understood it either, and always wondered if it was some American thing? Do they have a favourite lawyer like I have a favourite barber?

chaircher2• 4 years ago

In the EU you're probably looking at the equivalent of $300 on average for a letter like this, and you're more likely to have the disposable income available to do it.

Something like this you can easily do yourself and imo wouldn't be worth the money, however getting a law firm involved in small tasks is a good way to test them with something simple to see if they're any good, and build up a working relationship with one incase you need them for something more serious or time sensitive later on. It's generally a good life skill to get comfortable working with lawyers because at some point all of us will end up in a situation where we need one, and that's really not the point at which you want to deal with that learning curve.

tsol• 4 years ago

Usually "your lawyer" just refers to any lawyer you have a working relationship with, in my experience. I'm guessing this advice is for someone who finds the privacy issue especially heinous

User23• 4 years ago

In California a formulaic demand letter costs around $120.

chmod7754• 4 years ago

People keep talking about having "your lawyer" do something as if everyone just walks around with a personal pet lawyer and I never understood it.

"My dentist" also isn't my personal pet, but it's the dentist I go to. Neither am I my dentist's pet for being "their customer". I'm sure you also know some professionals that you trust and have some sort of relationship with.

Are you suggesting that you should hire a law firm at $1000/hour to mildly annoy some website..?

Not really. But there's usually people who do it for the good cause and later take it to court, often backed by nonprofits. Also that cost is insane, it should absolutely top out at 300 euro/hour. Some specialized lawyers charge a flat amount to send such standard requests.

jermaustin12• 4 years ago

I have an accountant, a lawyer, a dentist, an internist, and plenty of others. All of them are "mine" because they are the ones I use when I need their service. They all aren't on retainer, but instead are basically fee-for-service.

bitwize• 4 years ago

I would probably have phrased it "hire a lawyer to..." Which also conveys that you have to open your wallet -- not something lightly done for many people, although the significant trust-fund wantrepreneur crowd on Hackernews may think nothing of it.

Adraghast2• 4 years ago

Some of the replies you're getting are comical.

"Obviously we don't mean having a lawyer on retainer. That'd be unreasonable. We're talking about the lawyer with whom you maintain a working relationship should you need one. You know, kind of like your accountant!"

duxup5• 4 years ago

I feel like there's a parallel "internet law" that is informed by semi accurate news stories, movies, TV, and a sort of "if I could I'd have a lawyer do X and then I imagine Y will happen" ... that has very little to do with actual law.

nicolas_t2• 4 years ago

I have a lawyer that I have a relationship with and regularly ask questions to. He costs me 375 usd an hour and is great at his job (which I know by having worked with him for a while).

When I was younger, I didn't use to have one and tried to cheapen out by reading contracts carefully without checking with a lawyer. One of those contracts was a rev share in exchange for free work I did (plus some work I paid other contractors to do), I didn't notice that there was an easy way to get out of the contract by the company. Once the company was successful thanks to the work I initially did, they used that to cut me out. If I had used a lawyer back then, I'd still be earning 150k a year from that contract...

So, yeah having a relationship with a lawyer in the same way you have a favorite dentist is worth it. Having the reflex of using a lawyer when possible potentially can save a lot of money down the road. And using a lawyer at first for less impactful work is sometimes a good way to find out if the lawyer is any good.

I'd actually suggest any consultant/contractor to have a lawyer, work with him to review every contract and budget a small percentage of your income on this every year.

robertlagrant3• 4 years ago

People keep talking about having "your lawyer" do something as if everyone just walks around with a personal pet lawyer and I never understood it.

Let me explain: they don't walk around with a personal lawyer. Just as if I buy a chocolate bar it doesn't mean I walk around with a personal sweet shop. You've just radically misunderstood how everything in the world works.

aeturnum3• 4 years ago

Freelancers often have lawyers who: write their contracts, adjust them for new clients, fight over breaches, etc. Founders will have lawyers who do something similar for them via-a-vie their companies. When you have a steady stream of work, you can often ask them to do little things like this as a favor, just like they might ask you to help them with some tech thing.

I think those groups just happen to be massively over-represented on HN.

littlestymaar• 4 years ago

I can't say about other countries, but in France most (if not all) house insurance come with a “legal assistance ” clause which covers this kind of stuff. Depending on the company ou can either use their lawyer or find your own and have fees reimbursed by your insurance (of course the fees are subject to validation by your insurance and the maximum amount depends on your contract)

LargoLasskhyfv• 4 years ago

Since parent wrote about the EU, which .de is a part of, there is this thing called "Rechtsschutzversicherung" und "Prozesskostenübernahmeversicherung".

Also aeons ago in tv-adverts: "Advocard ist Anwalts Liebling!" meaning with this card you are the lawyers favourite.

So basically, yes, with appropriate insurance you can have that done for you :-)

WA• 4 years ago

In the end, they could deny that they have your data and you will never find out.

aritmo• 4 years ago

Why not pay a lawyer to create a template and then let others use for free?

chmod7754• 4 years ago

It's not about what's in the letter, it's about who sent it.

When you personally request something it will get handled by their usual support people, but letters from lawyers usually go straight to legal and get handled there.

Legal saying "what we're doing may be problematic" is much more likely to cause change.

XCSme10• 4 years ago

Does a company break privacy laws if you bring a paper with your personal details and put it in their office without telling anyone?

moreira• 4 years ago

No, but if they have a policy of collecting and saving any papers that people have on them, then they’re responsible for that collection.

Which is what’s happening here - they’re collecting data that the user isn’t even submitting.

tzs• 4 years ago

Watch them scramble trying to figure out how to even go about that.

It won't be much of a scramble. First, they will look at your email to see if you have actually provided enough information in the email to tell whose data you are talking about and to prove that you are that person. If not you will probably get a response telling you what you need to provide.

When you've provided that information, then they will run their standard "delete someone's data" procedure. Whether or not that actually deletes and data that came in via some pre-submit channel will depend on whether they actual realize they have that data.

If they are actually using that as an intentional persistent data collection method, it will probably be in some place that is covered by they normal "delete someone's data" procedure.

If they are using it for some transitory purpose, it is quite possible that any long term storage was accidental and might not be in someplace the "delete someone's data" procedure covers.

In either of these cases it won't cause any scrambling.

Finally, your delete request will probably be added to a database along with enough information to identify whose data was deleted. They need this because GDPR data deletion requests do not require the company to immediately go through all backups deleting your data from them. It is likely to remain on old backup media until the ordinary backup media rotation reuses that media for a new backup.

Hence, they need to keep a record of deletions and who they were for so that if they ever have to restore from backup then can then reapply deletions.

This last is kind of amusing. Where I work we keep very little data on customers beyond what is legally required by the EU. When someone requests data deletion it can actually increase the net amount of data we retain about them. The record of their deletion request can add more data than the deletion request deleted.

matheusmoreira• 4 years ago

Shit sites becoming responsible for all the data they soak up couldn't have happened soon enough.

Yeah, it's amazing! I think we need even harsher laws. Data should be toxic for businesses. They should be aiming to know as little as possible and to forget everything the second business is concluded. They should be too afraid to do what they're getting away with today.

debug-desperado• 4 years ago

You think you're going to get discovery to even prove this? Plausible deniability and even just ignorance will likely cause you to get nowhere with wiping this collected data.

lvncelot• 4 years ago

Bonus points for using the "Nightmare Letter": https://www.linkedin.com/pulse/nightmare-letter-subject-acce...

c22• 4 years ago

Just one more reason to leave javascript disabled. Demand user agents that represent the user.

zagrebian• 4 years ago

Breaking news: Thousands of popular supermarkets see what’s in your cart before you check out

XCSme10• 4 years ago

Also, they can do this online even without JavaScript, the cart is often saved server-side.

HKH2• 4 years ago

I would be shocked if they didn't do that, since it tells you a lot about the user's inhibitions.

ChrisMarshallNY2• 4 years ago

The Wired story seems a bit thin.

Here's the original presentation: https://homes.esat.kuleuven.be/~asenol/leaky-forms/

I had a friend that had his card charged, even though he hadn't actually completed it (He entered the card number and exp. date, but then left the shopping cart, without completing the transaction).

The Web site owners were pretty damn aggressive, when he complained about it, but he was even more aggressive (he has since passed, but he was not someone that you wanted to mess with).

throwawayboise• 4 years ago

He entered the card number and exp. date, but then left the shopping cart, without completing the transaction

I do that somewhat often, for sites that don't reveal shipping charges and other components of the "final price" until the end. Sometimes at that point I'll change my mind. Never been charged, fortunately, but I have worried about the possibility.

throw109204• 4 years ago

I had a friend that had his card charged, even though he hadn't actually completed it

What site? I want to know what it is so I can suggest all of my friends avoid it like the plague.

ChrisMarshallNY2• 4 years ago

I have no idea. He told me about it, years ago.

And then popped his clogs, so he took it to the grave with him.

He was an IT guy, though, so it was probably a nerd site.

duxup5• 4 years ago

How do they know what the difference is between a keylogger and auto-complete?

I use auto complete A LOT and my customer's love it. On the back end I sure could be storing that information (I don't)...

There's some good use cases that easily could be a keylogger, but aren't, or at least we don't know. Even if they store something that isn't auto complete it could be legitimate "hey are people stumbling over those stupid dashes all the time?" exploration of how the users do things.

Real dark patterns, and legit features tend to intermix sometimes and the devil is in the details...

my69thaccount• 4 years ago

Your customers probably wouldn't love auto complete if they knew it was implemented as a key logger. Try doing it client side.

duxup5• 4 years ago

Try doing it client side

Do what client side?

Store all the auto-complete possibilities client side? I think that doesn't make sense.

But my larger point is you can't tell for sure if it is a keylogger or just something else.

hoffspot• 4 years ago

You hit on my first thought. There are numerous legitimate user experience cases where keystroke by keystroke or field by field processing is beneficial. Autocomplete for address data is one I see commonly used. Saving a partially filled out form field by field in the event a user becomes disconnected and would like to complete it later is another. From a security perspective, I know of numerous tools that examine the speed and cadence of the act of typing to discern between bot entry in a field versus human entry. There is also software like FullStory that records everything client side, including mouse movement, so companies can determine exactly how people are interacting with their sites in an effort to improve the UX. And from a tinfoil hat perspective, if a user is interacting with a webpage, they should assume everything they are doing on that page is subject to observation by the page author. If the researchers were surprised by this, I fear it's from inexperience.

zzo38computer• 4 years ago

Even if it is beneficial, the user might still want to disable it. (Possibly a option in the browser for manual/auto calculate; if manual, then events are disabled until you push submit or recalculate. This might improve speed, too. Another thing that might be useful may be ARIA mode (which can also have other advantages, although other things are needed too anyways).)

Saving a partially filled form is something that should be a feature in the browser, you can do "File > Save Form Data" (and then specify the file name) and "File > Recall Form Data".

I generally disable JavaScripts. Sometimes the web page will still be displayed if CSS is also disabled (and sometimes I want to disable CSS anyways), and sometimes links to original data, etc can be found if you view the source.

gbasin• 4 years ago

This is nasty, especially the plaintext password leak. I wonder if you could build a chrome extension to monitor for patterns like this — just like at the payloads being sent while you're typing and pattern-match (without keylogging itself, or maybe allow it but keep it open-source)

denton-scratch3• 4 years ago

Hit "Subscribe" before you can see the article.

I subscribe to exactly one website. If I subscribed to every subscription website that I read, I'd spend more on subscriptions than my income.

So: F12, "display: none". Wut? Really? A one-paragraph article? I guess Wired can join NYT and Washpo as sites I'm not going to visit, because they don't want the likes of me to visit.

cloverich• 4 years ago

Aren't services like Heap effectively worse versions of this? On their landing page they outright list this as their value prop:

Heap collects all the data on your customers - automatically. What they click. Where they go. What they do, even when you’re not looking. All without the need for engineers.

[1] https://heap.io/

Vinnl• 4 years ago

Direct link to the research website: https://homes.esat.kuleuven.be/~asenol/leaky-forms/

gniv• 4 years ago

I wonder if there's a way for ad blockers to block these requests -- the pre-submit non-user-driven requests -- without me turning off JS or anything drastic like that. I suspect the answer is no, but I'm wondering if it's at all feasible for an extension to do that.

fxtentacle2• 4 years ago

Interesting question: If I have a keyboard that malfunctions so that it'll accidentally type gigabytes of data into the form (but never submit it)... is that still a DDoS or just an unfortunate keyboard malfunction?

alwayslikethis• 4 years ago

Would be good if someone modified the extension a bit, and make it send thousands of fake requests to pollute their data if this behavior is detected. Works like Adnauseum which works like ublock origin, except you can set it to click a portion of the ads to waste the advertiser's money while supporting the underlying websites.

fxtentacle2• 4 years ago

Great idea. Ideally, it would find their "contact us" email address and use that so that websites who implement this get a taste of their own medicine.

sam1r• 4 years ago

Correct me if I’m wrong..

But the simplest way to check would be

1. Inspect element > start recording under ‘Network’

2. Press any key, and check for new requests visually that correlate to the time you pressed the key.

danielrhodes3• 4 years ago

Do tech companies really store unbounded amounts of information, like keyboard strokes, from their users? For me this seems hard to believe, at least over the medium to long term.

Storing data is not free and if you plan to use this data for anything it can definitely be not cheap (i.e. cold vs hot storage). When you extrapolate this to the scale of a service like Facebook or Google it becomes insanely expensive. So there would have to be some pretty clear monetary payoff to justify this expenditure. I understand the worries of privacy advocates, but I don't understand the economic incentive of keeping all this data. The only way it could possibly make sense is if it were highly aggregated, but at that point you nullify many of the privacy concerns.

kibwen• 4 years ago

We've known since 2013 that Facebook has been doing this, though they claim they're only storing metadata. It's not that hard to believe.

danielrhodes3• 4 years ago

You're welcome to request your data from Facebook and see if they have this data (assuming they are following the law, which I assume they are). I've requested my data from various companies and they did not have anything even close to this level of detail. That makes me think that if they do store data such as keystrokes or mouse clicks or whatever, it's being stored in a highly aggregated way, which doesn't bother me very much. But I also imagine one of the reasons they are storing data in an aggregated way is: 1) they don't need it at an individual level and/or 2) it's not cost effective.

aeturnum3• 4 years ago

Storing data is not free and if you plan to use this data for anything it can definitely be not cheap

I think there are a lot of companies that are not running out of money and are holding on to a lot of data that might, someday, be valuable. Look at Google's features like spelling correction or search term suggestions - they likely used huge troves of semi-anonymous user input to develop and support them.

When you extrapolate this to the scale of a service like Facebook or Google it becomes insanely expensive

This is just not true. Backblaze is putting their storage cost at ~$0.035 a gigabyte[1], which means you can store a megabyte of data for every human on earth for a bit under $300k a year (about 8 petabytes). Big companies probably can get even lower. This isn't...a negligible cost, but it's very normal at that scale. Google only has ~4.5 billion users and most companies have orders of magnitude fewer.

[1] https://www.backblaze.com/blog/petabytes-on-a-budget-10-year...

danielrhodes3• 4 years ago

Look at Google's features like spelling correction or search term suggestions - they likely used huge troves of semi-anonymous user input to develop and support them.

There's a big difference between data which is directly tied to PII and data which is held in aggregate in terms of privacy. I'm not arguing there can't be leakage here, but it certainly blunts many of the more severe privacy implications. Conflating these two is more sensationalist rather than useful in terms of honing in what is ok vs what is not.

which means you can store a megabyte of data for every human on earth for a bit under $300k a year

Sure, I mean as a slippery slope you could also write this data to paper and keep it indefinitely at a very cheap price. My point here is more: if you plan on using the data, it becomes more and more expensive as your access patterns change. This also has privacy implications because I would imagine the easier the data is to access in raw form the higher the potential privacy cost to the user. If all they are doing with these key strokes is recording somewhere that you might be interested in Corgis and German Shepards based on your keystrokes, as opposed to something more detailed like an accidental paste of your password, I think that changes the conversation.

me_me_mu_mu• 4 years ago

And here I am building my startup making sure I do my best to store as little user information in my servers as possible.

retox• 4 years ago

A while ago I was doing a review of youtuber merch sites to get an idea of the shipping charges to my corner of the world. The PewDiePie merch site requires you to enter an address and email before you can see shipping prices. It's on the same page as the quote generation but the form isn't submitted and an account isn't created. I didn't go any further than looking at the total price before leaving, then I got an email minutes after I closed the tab with a discount code.

Many popular websites see what you type before you hit submit

Related Stories