A very large number of websites collect some or all of data as they type in digital form.
See also: Ukraine: Government websites hacked with Fake News
Researchers from KU Leuven, Radboud University , and the University of Lausanne analyzed 100,000 top websites, examining scenarios in which a user in the European Union and one in the United States visit a website. They found that 1,844 websites collected an EU user’s email address without their consent, while 2,950 logged email . Many of the websites appear not to intend to do any data logging themselves, but instead integrate third-party marketing and analytics services that do this.
The researchers also discovered 52 websites where third parties, including Russian tech giant Yandex, were collecting random password data before the user submitted it. The team disclosed its findings on those sites , and all 52 cases have since been resolved.
See also: eBike phishing websites promote scams through Google Ads
The research findings will be presented at the Usenix security conference in August, showing that they sought to investigate what they call “ Leaky Forms ” from media reports, particularly from Gizmodo, about third parties collecting form data regardless of its submission status. They point out that at its core, the behavior is similar to so-called key loggers , which are typically malicious programs that record everything a target types.
However, on a top-tier site, users probably wouldn't expect their information to be collected. In practice, the researchers saw a few variations of this behavior. Some sites record keystroke data, but many record full submissions from one field when users clicked on the next.
The researchers say the differences in data collection may be related to some companies being more cautious about tracking users due to the EU's General Data Protection Regulation. But they stress that this is only one possibility and the study did not examine explanations for this disparity.
See also: Idaho government websites taken over by hackers
Since the findings suggest that deleting data from a form before submitting it may not be enough to protect you from having your data collected, the researchers created a Firefox called LeakInspector to detect information collection from form submissions. And they say they hope their findings will raise awareness about the issue, not only for regular web users, but also for developers and website administrators who can proactively check whether their own systems , or any of the third parties they work with, are collecting data from forms without consent.
