Hundreds of websites use something called keyloggers, recording your typing, clicks and movements, according to a recent study by Princeton University. Among those sites are the Guardian, Reuters, Samsung, AlJazeera and WordPress.com.
Most of you know that your searches, page views, and even how you scroll on a page are being tracked. But research is highlighting just how complex the tracking can be.
The websites we mentioned above reportedly use something called “session replays,” which helps them record the keystrokes and movements each user makes while navigating a page.
The study, conducted by the Princeton Center for Information Technology Policy, focused on some of the main companies that offer session replay services: SessionCam, UserReplay, FullStory, Clicktale, Yandex, Smartlook, and Hotjar.
It is important to understand why this behavior is dangerous, in addition to your privacy.
The Princeton study reports that most of these services (which are similar to keyloggers) immediately block password fields from registrations, but many of the forms are mobile-friendly. This means that very sensitive information, such as passwords, credit card numbers, and credit card security codes, end up on pages that use these services.
The study explains:
“All companies studied offer some mitigation through automated processing, but this varies significantly from provider to provider. UserReplay and SessionCam replace all user inputs (keystrokes) with masking text of equivalent length, while FullStory, Hotjar and Smartlook completely block specific input fields.”
It should be mentioned that all of this information is usually shared when a user registers for a service or makes a payment and is expected to be and remain completely confidential.
Paul Edon, director of security firm Tripwire, told BBC News that "the first concern is the legality of recording people's keystrokes without first informing them of the fact. If these sites don't warn the user about the fact that they are recording their keystrokes, then I would classify it under the category of 'illegal activity.'"
Let us mention once again that big names like Microsoft, WordPress.com, Reuters, and Samsung, spy on the privacy of their users.
