[andrewmackrodt]

Lots of websites you would not expect do this; it's not for spying on users but to improve the user experience.

Being able to aggregate data or inspect individual sessions is a useful tool to learn how users navigate with a site.

Keyboard keystrokes get captured too but the systems are intelligent enough to filter out passwords and payment details.

I don't really like this form of monitoring either but I've seen it in several companies.

[pmlnr]

> Keyboard keystrokes get captured too but the systems are intelligent enough to filter out passwords and payment details.

Sure. Except they are not.

[orwin]

> Keyboard keystrokes get captured too but the systems are intelligent enough to filter out passwords and payment details.

Citation needed. But i did not realize that before, so thank you very much for this information, i will desactivate js on every page with a password field from now on.

[r721]

Relevant:

"Following the recent report that Mixpanel, a popular analytics provider, had been inadvertently collecting passwords that users typed into websites, we took a deeper look. While Mixpanel characterized it as a “bug, plain and simple” — one that it had fixed — we found that:

- Mixpanel continues to grab passwords on some sites, even with the patched version of its code.

- The problem is not limited to Mixpanel; also affected are session replay scripts, which we revealed earlier to be scooping up various other types of sensitive information.

- There is no foolproof way for these third party scripts to prevent password collection, given their intended functionality. In some cases, password collection happens due to extremely subtle interactions between code from different entities."

https://freedom-to-tinker.com/2018/02/26/no-boundaries-for-c...

[seba_dos1]

I have worked in the past on a tool that recorded user sessions on websites and keystroke collection didn't end up implemented only because we were a small enough company that my strong stance against it could actually block it. It was a feature that often came up from the product team after discussions with customers, and IIRC some competitors already had it implemented back then.

Our own prototype, from before I've actively joined that particular project, tested on some live website helpfully displayed all the content of some textarea of some request form that somebody started to fill in, but afterwards decided not to include some of the details. That was a big eye-opener for me that it's absolutely not a right thing to do. We have ended up implementing a debounced indicator "some typing activity is occurring right now on this field", but we still had to deal with feature requests about content collection.

Judging from quality of some of those competing solutions, I certainly wouldn't bet that they're "intelligent enough". Maybe in 75% of the most common cases, maybe.

[lightbyte]

Just because it may help out the company and you've seen others do it doesn't make it any less spying on your users.

It would also help out Facebook if someone sent them a daily minute-by-minute log of what I was doing. That doesn't mean they should go try and do it.

[Luuseens]

There are some posts from Princeton on password and CC leaks for trackers such as this, e.g.

https://freedom-to-tinker.com/2017/11/15/no-boundaries-exfil...

[Applejinx]

>it's not for spying on users but to improve the user experience

So, it's for spying on users. What happens then?