Browser Spyware: Watching Where You Linger

An Anonymous Coward writes: "Just when you you'd installed Junkbuster and thought it was safe to go back onto the web, the BBC runs this story which tells you that webshites will soon(?) be able to tell whether you are reading the page, what parts of it are of interest to you, etc. Guess we can expect porn sites to be the first to take advantage of this." Or perhaps someone else is already doing this, and hasn't told you.

Comments

Use smart settings to avoid this:

[hardaker]

If you carefully configure your web browser I would think you could avoid being tracked:

• Turn off javascript support. This is likely how their doing their "what part of the page you're looking at" tricks (watching the scrollbar usage).
  
• Don't accept cookies. Don't go to sites that force you to accept them.
  
• Turn off auto-loading of images. This is the one that no-one does, but with the increasing frequency of single pixel tracking images, it might be a wise thing to do. Junkbuster is certainly a good alternative, but it won't catch everything.
  
• Konqueror has the ability to change your user agent. It'd be cool to write a "random" mode to it where it randomly selected from it's list of user agents to send to the remote site ;-)
  

Re:Use smart settings to avoid this:

[UM_Maverick]

have you actually used the web lately? Your ideas are great in theory, but in practice they take you back about 6 years. E-commerce goes out the window w/out cookies. Many sites become unusable w/out javascript (Not just sites that do "onclick=location.href", but there are many sites that actually use javascript *well*). Turning off images means that you won't see half of most sites...and the list goes on...

Now I know what you're going to say: "If site X won't let me browse my way, then I don't need site X". Well, damn near every site out there is becoming site X. Whether you like it or not, that's the way the world is moving, and you can either accept their way of doing things, or stay in 1995.

Hmm...just re-read that, and it sounds like a flame...I really didn't intend it to be...just meant it to be more of a wake-up call.

Re:Use smart settings to avoid this:

[hardaker]

• It seems like it'd be a good idea if Konqueror added an option to ignore single-pixel tracking images... should we submit this to bugs.kde.org?

It's a good point, however I don't think it'll help. Many sites are finding otherways of getting around that like using forms parameters within the URL itself. Eventually they'll get intelligent and name the larger images with a tracker extension, but still return the same image. IE, src="logo.jpg-234987575" and merely have their nifty web server strip the extension off (and use it) before returning the image to the caller. You don't need 1x1 imagse when you can use real images.

Re:Is it just me or is the web becoming too annoyi

[Greyfox]

Konqueror and Mozilla both allow you to disable popups while allowing JavaScript to run. I believe that at least Konqueror and possibly Mozilla as well will allow you disable or enable features on a site by site basis. The web has become a whole lot less obnoxious since I set Mozilla up to disable popups and animation. I highly recommend running a browser that will let you do this. Mozilla is now fast enough that I can actually tolerate using it and has been since a CVS build about a month and a half ago.

Browser security settings?

[Xenophon Fenderson,]

How difficult is it to configure one's web browser so that it rejects most of the scripting junk out there? If you are using IE, check out the security zones feature that allows you to toggle scripting, cookies, and so forth depending on to which of four security zones a particular site belongs. I'm sure the free browsers have something much more sophisticated. Use it!

Re:Client side cooperation required

[stikves]

No it is not necessary. The site can have two "frames". One of them would be the main frame filling the entire window, the other will be the tracking frame, which is insivible (or 1 pixel high).

Then the javascript code in the main window will fill a string with your mouse movement like:

(100,100)-(110,100)-(110,109)-...

After the buffer is filled enough, it will update the hidden frame with a code like:

TrackerFrame.URL = "http://server/track.cgi?" + str;

That's it. That's all. Your tracking is complete.

Re:Sinister...

[D Anderson n'Swaart]

Heh, I can just see that this is going to entail enough new code in webpages running the service that I won't need to worry about them getting hold of any cursor movements; the damn thing will load so slowly on my dialup that I'll get sick of waiting and close it.

I can imagine it now: hundreds of hits a day showing that the only widget the cursor moves to is to close the browser window. Confusion in the corporate ranks as a solution is desperately sought to the mysterious problem causing so much loss of revenue. Complete site redesign at the cost of millions. And hopefully, they'll run out of possibilities and twig to the idea of removing the spyware, and voila, hits increas again. Bleh, yeah right.

Re:Sinister...

[Isofarro]

If a JavaScript or a Java applet can subtly catch your mouse movements, then they can be imbedded in hidden inputs on the web page

No ifs about it. Javascript has quite a number of mouse dependant event-handlers, onMouseOver, onMouseOut, onMove, onClick, onMouseDown, onMouseUp.

Getting the details back to the server is even easier, just condense mousemovements into a bunch of characters (like Logo commands), stick them into a query string.

Now use a hidden image (a transparent 1x1 gif), useing javascript you can change this object on the fly - change the src attribute of that image to a cgi script, with the query string attached, plus a timestamp (making the url unique, thus not cached). The cgi-script then stores/analyses/ignores the data presented, and returns a status 204 - No change.

Its too simple, really.

On the plus side, hopefully it will convince more and more people to disable Javascript - and then boycott any websites that rely/insist on having it enabled. There's enough sites out there as competition to safely avoid intrusive websites - if not, then there's a niche market you can join.

Oh brother ...

[Christianfreak]

Typical /. "Big brother is watching us" paranoia. Come on! Did no one read the article? Some interesting points about it:

• No client software required: In other words its a stupid Javascript. Translation you can turn it off
• They only tested 17 people. Translation either the MIT student doing this is an idiot or the BBC article is hype. I vote for "C" both.

This is not Your Rights Online nor is it news. Lets go back to bashing M$oft.

Rant Mode OFF.

The bread, milk, and fresh fruits are scattered.

[laetus]

Just because a store researches something doesn't mean they're going to make the shopping experience better for the consumer.

Case in point: The grocery store you referenced. Haven't YOU ever noticed that the dairy, bread, and fresh vegetables/fruits are scattered at different corners of the store.

And you know why, to make you wander the other aisles to get you to buy crap you didn't originally walk in to get.

More details

[Trollsfire]

The article is a little short on details as to how the technology works, and there has been some speculation already. However, this being academic research, let us not forget that more details are (often) readily available. The Project Proposal (pdf format, 138K) and a brief paper (pdf format, 77K) are available from MIT's web site.

Their stated motivation is:

Content providers have a vested interest in the results of mouse movement data analysis. Our system provides the means to find out exactly how users mavigate their page and thus affords an extensive user model.

The technique they used was to "add Javascript externally to an existing web page." They mention using barnesandnobel.com, amazon.com, and ashford.com explicitely, but more had to be used given the nature of the tasks given. This seems to imply that they are able to, as a third party, add the javascript tracking to already existing sites. However, they also may be using the fact that they control the testing environment to do this, such as by inserting the code using an http proxy. Details related to how the code was introduced are not given, and would be necessary to determine how much of a privacy threat this is.

Re:Is it just me or is the web becoming too annoyi

[wurp]

Mozilla definitely does allow you to disable popups. See http://www.mozilla.org/projects/security/component s/configPolicy.html

Even more off-topic:
Does anyone know how to make Mozilla lie about what User-Agent it is? My bank software rejects Mozilla, claiming it's not compatible. I'm pretty sure it is, and I want to try to make Mozilla claim to be IE on that domain.

Re:Is it just me or is the web becoming too annoyi

[unapersson]

In Mozilla you can disable any javascript method or property on a site by site basis.

So you can disable window.open, OnClose and other annoying methods.

Deny scripts access to data on your browser, screen dimensions etc.

See here for info on how to do it.

Example: Stopping popups in Mozilla

[bgarcia]

Disabling pop-ups entirely is irritating as many genuinly useful sites use pop-ups when a link is clicked.

If you go to the link given in the parent post, you'll see that it can be configured on a site-by-site basis.

Most pop-up ads come from one of the usual banner-ad sites, not the actual website, so this feature works pretty well.

Here's my user.js file - you may find it useful. I allow pop-ups by default, except for the listed sites.

// Stop animated gifs after one iteration.
user_pref("image.animation_mode", "once");

// Stop windows from popping up when they finish loading pages.
user_pref("mozilla.widget.raise-on-setfocus", false);

// Block these sites from opening their own windows
user_pref("capability.policy.strict.sites", "http://www.car-truck.com http://www.cnn.com http://www.dictionary.com http://media.admonitor.net http://popup.zmedia.com http://ad.doubleclick.net http://www.netsol.com http://rd.yahoo.com");
user_pref("capability.policy.strict.Window.open", "noAccess");

Link to project homepage

[eram]

I found the Web page of project "Cheese" at MIT. They don't seem to be using their own mouse tracking technique yet. The publication that the researchers have produced doesn't provide much more information than the BBC article.

Re:NADaemon....new Spyware on the scene?!

[Phantom_24]

It seems its from a company called NetActive Inc. and the file version is 4.2.3 (build Lithium)!