Browser Spyware: Watching Where You Linger

An Anonymous Coward writes: "Just when you you'd installed Junkbuster and thought it was safe to go back onto the web, the BBC runs this story which tells you that webshites will soon(?) be able to tell whether you are reading the page, what parts of it are of interest to you, etc. Guess we can expect porn sites to be the first to take advantage of this." Or perhaps someone else is already doing this, and hasn't told you.

Comments

Sinister...

[jedwards]

"I can tell because when you read a webpage, you do one of a couple of things. You either shovel the mouse off to the right ..."

I guess I shall just have to become left handed then.

Re:Sinister...

[ptgThug]

I was thinking the same thing, how can they do this since web browsing involves stateless, connectoinless technologies.

So I thought about it, and here is a possiblity:

If a JavaScript or a Java applet can subtly catch your mouse movements, then they can be imbedded in hidden inputs on the web page. Every link on that page fires off a JavaScript which will submit the form and then redirect you to which ever page you requested. The mouse movement data can only be reported if you select another page.

In all honesty, paying attention to your actions is the same thing any brick and mortar shop owner can do why watching you walk down the aisles. When stores were smaller and people friendlier, shop owners made it their job to remember your name, your family, and your preferences (The usual, Mr Smith?). What this technology is trying to do is no different than that, it is just not always being done by not-so-friendly people.

Re:Sinister...

[D Anderson n'Swaart]

Heh, I can just see that this is going to entail enough new code in webpages running the service that I won't need to worry about them getting hold of any cursor movements; the damn thing will load so slowly on my dialup that I'll get sick of waiting and close it.

I can imagine it now: hundreds of hits a day showing that the only widget the cursor moves to is to close the browser window. Confusion in the corporate ranks as a solution is desperately sought to the mysterious problem causing so much loss of revenue. Complete site redesign at the cost of millions. And hopefully, they'll run out of possibilities and twig to the idea of removing the spyware, and voila, hits increas again. Bleh, yeah right.

Re:Sinister...

[Arker]

Left-handed people probably move the mouse to the right side too, because that's where the scrollbar is.

Not necessarily. I get the scrollbar on nearly all of my programs situated properly - on the left. However, I rarely actually use a scrollbar anyway - preferring to use the keyboard whenever possible, and page-up/page-down almost always works. So even with the scrollbars on the left, the mouse pointer is most often shoved out of the way to the top-right corner of screen, simply because that's the most natural-feeling place to flick it. So I'd guess a leftie would tend toward the top left?

Re:Sinister...

[Isofarro]

If a JavaScript or a Java applet can subtly catch your mouse movements, then they can be imbedded in hidden inputs on the web page

No ifs about it. Javascript has quite a number of mouse dependant event-handlers, onMouseOver, onMouseOut, onMove, onClick, onMouseDown, onMouseUp.

Getting the details back to the server is even easier, just condense mousemovements into a bunch of characters (like Logo commands), stick them into a query string.

Now use a hidden image (a transparent 1x1 gif), useing javascript you can change this object on the fly - change the src attribute of that image to a cgi script, with the query string attached, plus a timestamp (making the url unique, thus not cached). The cgi-script then stores/analyses/ignores the data presented, and returns a status 204 - No change.

Its too simple, really.

On the plus side, hopefully it will convince more and more people to disable Javascript - and then boycott any websites that rely/insist on having it enabled. There's enough sites out there as competition to safely avoid intrusive websites - if not, then there's a niche market you can join.

Re:Sinister...

[guuyuk]

Your example of when stores were smaller and people friendlier has a minor flaw. You, as a patron of that store, often knew as much abour the shopkeeper as he/she did about you. We don't have that option in this case.

Interesting thought to have a Javascript that makes a webpage act as a giant rollover. Perhaps one which tracks cursor coordinates in realtime, along with mouse button presses...

Re:Sinister...

[Dolly_Llama]

In all honesty, paying attention to your actions is the same thing any brick and mortar shop owner can do why watching you walk down the aisles

No. I am using my hardware, and my bandwidth and watching it in my home. This is more like Victoria's Secret setting up an X10 in my bathroom to do "market research" on how i view their catalog.

Re:Sinister...

[kubrick]

I did something like this for an online art project, used during a live performance (locally only, to 4 machines via a LAN) -- HTML pages calling Javascript that generated new pages and also called a Perl script which collected 'votes' onClick and returned the relevant HTTP header (empty response). All this within about 12 borderless frames... urk.

If I'd been given more time to do it, and the ideas hadn't kept changing, I'm sure that could have been better engineered. :)

Re:Sinister...

[DunbarTheInept]

You should download the site and look at it in private, this way you don't interact with the site the same way you would interact in the store.

That's how HTTP is *supposed* to work already. The connection only lives long enough to download the page. After that you *are* reading a downloaded copy on your own machine.

The original poster, who said that this sort of thing is going on already, is only half right. Yes, in meatspace you have surveilence in stores, but that surveilence ends when you leave the doors of the store. This technology is like making the boundries of the store vague, so you don't know when you are back in your own "private" space again.

Re:Sinister...

[Mike1024]

Hey,

Javascript has quite a number of mouse dependant event-handlers, onMouseOver, onMouseOut, onMove, onClick, onMouseDown, onMouseUp.

Indeed. But there could be an issue, in MSIE at least; have you ever had a site with, for example, some text that follows the cursor around? If you open another window on top of that, the text follows the cursor around on the back page, even as you look at the front page.

If you couldn't work around this, the system would, well, suck.

Michael

marketing

[Spagornasm]

Get ready for the "marketing geniuses" to take advantage of this...by having new windows pop up right when you move your mouse to the back button...

Anyone else up for using keyboard shortcuts now?

Re:marketing

[solaris_system]

first of all we are assuming that the 'marketing genius'' can figure how to take advantage of this technology

Re:marketing

[marxmarv]

Anyone else up for using keyboard shortcuts now?

Here's a little snippet from PlanetEmu, a French emulation site:

<script>
<!--
function ctrlDown() {
if (event.ctrlLeft) {
alert("La source ne regarde que nous :)");
}
else {
if (event.ctrlKey) {
alert("La source ne regarde que nous :)");
}
}
document.body.focus();
}
// --> </script>

Browse with Javascript and Java off. View source to get to whatever you may need. Most importantly, take your business elsewhere and tell lame web designers why.

-jhp

Popups will only get worse

[liquidweb]

The nightmares will begin tonight of a microsoft paperclip assistant style popup that pops up right as I read something. Of course I'm probably dooming us all by mentioning this idea, ah the irony.

Must hit post before I think about repercusions.

What matters is who they tell,

[firewort]

What matters here is who they tell, and who they sell it to.

I can't stop them from tracking (yet.) I do turn off all activeX, ask on cookies, no scripting, etc... but if they can get around my disabled browsing habits, then what matters is who they tell.

Time to go back to safeweb, as well.

Deus Ex

[FortKnox]

Or perhaps someone else is already doing this, and hasn't told you.

Somebody was up late playing Deus Ex last night, right timothy??

A better idea....

[wackysootroom]

....be able to tell whether you are reading the page, what parts of it are of interest to you, etc. Guess we can expect porn sites to be the first to take advantage of this." Or perhaps someone else is already doing this, and hasn't told you.

Does anyone actually *READ* porn sites? Maybe the keyboard needs a 'moisture detector' to see when and if the user is drooling, then send the result back to the spy server.

Re:A better idea....

[stilwebm]

The don't read the pages really, but the will scroll down looking at the pictures much like they would when they're reading text. The difference is it would appear that they might be re-reading the same area several times. I think it could be very interesting to see where the mouse travels on a porn site...

Is it just me or is the web becoming too annoying

[smartin]

I wish sites would realize that pissing off their viewers with popups and big honking ads, does not make the viewer more likely to visit the advertisers site or buy their product. It has quite the opposite effect. I've stopped going to some sites that I like for the simple reason that I really F*ing hate popups!

This would be easy to resist

[Carmody]

Unlike other forms of spyware, this would be easy to resist... Wouldn't people who were concerned about their privacy just get in the habit of swirling their mouse around while reading web pages?

I can't give a logical reason why this particular technology disturbs me more than other types of spyware, but for some reason the idea of my mouse movements being tracked just makes my skin crawl... Does anyone else have that sort of gut-level revulsion?

Re:This would be easy to resist

[saider]

There is no constitutional gauruntee for privacy. The closest thing would be the fourth amendment which prohibits unreasonable search and siezure. The constitution generally limits government power instead of granting freedoms. For instance, the government cannot arbitrarily force you to take a drug test (without a warrant, which requires some evidence of wrongdoing), but a company can force you to do so as a condition for employment. Technically, if you refuse the drug test, your prospective employer can show you the door.

(Offtopic) One should note that most companies do not rigidly enforce this and a short talk will usually result in them dropping the request.

Use smart settings to avoid this:

[hardaker]

If you carefully configure your web browser I would think you could avoid being tracked:

• Turn off javascript support. This is likely how their doing their "what part of the page you're looking at" tricks (watching the scrollbar usage).
  
• Don't accept cookies. Don't go to sites that force you to accept them.
  
• Turn off auto-loading of images. This is the one that no-one does, but with the increasing frequency of single pixel tracking images, it might be a wise thing to do. Junkbuster is certainly a good alternative, but it won't catch everything.
  
• Konqueror has the ability to change your user agent. It'd be cool to write a "random" mode to it where it randomly selected from it's list of user agents to send to the remote site ;-)
  

Re:Use smart settings to avoid this:

[Grishnakh]

It seems like it'd be a good idea if Konqueror added an option to ignore single-pixel tracking images... should we submit this to bugs.kde.org?

Re:Use smart settings to avoid this:

[UM_Maverick]

have you actually used the web lately? Your ideas are great in theory, but in practice they take you back about 6 years. E-commerce goes out the window w/out cookies. Many sites become unusable w/out javascript (Not just sites that do "onclick=location.href", but there are many sites that actually use javascript *well*). Turning off images means that you won't see half of most sites...and the list goes on...

Now I know what you're going to say: "If site X won't let me browse my way, then I don't need site X". Well, damn near every site out there is becoming site X. Whether you like it or not, that's the way the world is moving, and you can either accept their way of doing things, or stay in 1995.

Hmm...just re-read that, and it sounds like a flame...I really didn't intend it to be...just meant it to be more of a wake-up call.

Re:Use smart settings to avoid this:

[Chetmurray]

I find if I close my eyes while I browse, all the big bad men who spend all their lives tracking me go away.

That or type left handed - that always throws them off. Gotta run before they figure out my whereabouts from this post.

Chet

Re:Use smart settings to avoid this:

[hardaker]

• It seems like it'd be a good idea if Konqueror added an option to ignore single-pixel tracking images... should we submit this to bugs.kde.org?

It's a good point, however I don't think it'll help. Many sites are finding otherways of getting around that like using forms parameters within the URL itself. Eventually they'll get intelligent and name the larger images with a tracker extension, but still return the same image. IE, src="logo.jpg-234987575" and merely have their nifty web server strip the extension off (and use it) before returning the image to the caller. You don't need 1x1 imagse when you can use real images.

Re:Use smart settings to avoid this:

[stikves]

I totally agree. You cannot use Yahoo! mail attachments without javascript popup windows. You cannot use freshmeat (efficiently) without cookies. It will be too hard to browse cartoonnetwork.com without images.

And single pixel images are used in many sites. Again, freshmeat uses single pixel images for thin lines. (I also use them too).

Anyway, forget it. Web is no longer a medium to distribute content, but now formatting and layout.

Re:Use smart settings to avoid this:

[hardaker]

• have you actually used the web lately?

not in years, no.

• E-commerce goes out the window w/out cookies.

The way I figure it, if you have to buy something then you're stuck turning on those features. However, since you're submitting your address, credit-cards and other personal-info to them it's unlikely you'll care much about mere tracking information. They've already got you, essentially.

• Many sites become unusable w/out javascript

Actually, I've been amazed at the number that do work. You're right, of course, many require them. And I do have Konqueror configured to allow JS on some sites. However, by default preference setting is "off" for any "untrusted" site. The sites that I generally turn them on for are E-commerce (as you mentioned above) and other account-type sites where I have accounts located there.

Re:Use smart settings to avoid this:

[cyberdonny]

have you actually used the web lately? Your ideas are great in theory, but in practice they take you back about 6 years. E-commerce goes out the window w/out cookies. Many sites become unusable w/out javascript (Not just sites that do "onclick=location.href", ...

Actually, I usually surf with javascript turned off, and the sites where this causes problems can be counted on the fingers of one hand. And for those rare sites I have the choice of

• not there going again
• just allowing those sites in my konqueror browser's javascript ACL.

Of course, if you're in the habit of surfing to porn sites, you might be somewhat more dependant on javascript...

...but there are many sites that actually use javascript *well*).

Actually, using javascript well should mean to not make an obligation out of it, but to use it solely to provide additional and optional functionality. The site should still stay useable even if the user doesn't want or isn't able to use javascript. You know, blind people who are bound to surf using lynx (because their braille lines, or text-to-speech engines only support text browsers) cannot just turn on javascript, even if they wanted!

Re:Use smart settings to avoid this:

[mosch]

No, because single pixel gifs have legitimate purposes too. Not to mention the fact that any image can be a "tracking" image.

Example: Let's say you want to draw a horizontal bar with a rounded edge, ala slashdot. You can make an image that has the rounded edge, then a seperate image that's simply a one pixel gif of the same color, that you then stretch by using height and width attributes on the img tag.

This will prevent the color differences between the two images, as they'll both be using the same graphics library to display. This however also minimizes download time, because all you really need to make a colored bar is one pixel of the exact color you want.

Be less paranoid.

Re:Use smart settings to avoid this:

[Ed Avis]

We really need a browser that lets you *selectively* disable Javascript. I think the default setting should be to have JS turned on, but with a few particularly obnoxious features (popping up new windows, adding hooks to the scrollbar or mouse movement) turned off. You should be able to adjust these preferences on a site-by-site basis.

Re:Use smart settings to avoid this:

[Arker]

I have ACLs for cookies, the sites that actually have some legitimate reason to use them are allowed, the ad-tracker sites are dissallowed. Works great. You can do this in Opera and Konqueror and (I think) Mozilla.

I turn off image loading regularly, and the number of sites that are worth loading and won't work without images I can count on one hand. There's... my bank. Hrmm... can't think of even one more right off, although there probably is.

Same comment for javascript. It's always been more abused than used, and except for my bank I can get by just fine with it turned off.

Now I know what you're going to say: "If site X won't let me browse my way, then I don't need site X". Well, damn near every site out there is becoming site X. Whether you like it or not, that's the way the world is moving, and you can either accept their way of doing things, or stay in 1995.

How many web sites are there out there? Now how many of those are actually worthwhile? Big difference. If you think looking for content, rather than glitzy layout, is "stay[ing] in 1995" then you are the one that needs a wake-up call.

Doing whatever everyone else is doing, just so you can feel like you're current, is not a commendable or desirable habit.

Re:Use smart settings to avoid this:

[leviramsey]

Example: Let's say you want to draw a horizontal bar with a rounded edge, ala slashdot. You can make an image that has the rounded edge, then a seperate image that's simply a one pixel gif of the same color, that you then stretch by using height and width attributes on the img tag.

I believe the problem is with grpahics that are 1x1 pixel and not scaled by the img attributes. So I would block any gif that's 1x1 and not scaled in the HTML (or any graphic that's explicitly scaled to 1x1). These are the dangerous ones, and your example does not fall into this category.

Re:Use smart settings to avoid this:

[Eimi Metamorphoumai]

Try Galeon. In the Preferences you can disable popups and disable status bar rewrites. You can also turn on and off javascript from a menu option (and like all GTK menu options, you can bind any key you want to it). In the latest CVS, you can even disable/enable popups from a menu item. Useful.

Re:Use smart settings to avoid this:

[mosch]

I would block any gif that's 1x1 and not scaled in the HTML

That's still a broken concept. If browsers start blocking unscaled 1x1 images, they'll scale their 1x1 image to be 1x2, and then what? Block all 1x2 images as well? It's a slippery slope.

These are the dangerous ones, and your example does not fall into this category.

The fact that they're small does not make them "dangerous". Any image, whatsoever, can be used as a bug. You could use my example of a large horizontal bar as a bug, or the title graphic of the page, or the image used on the search graphic. Every single image on a page can be a "bug". Additionally, every link can contain trackable identifiers if the website designer so wishes.

Re:Use smart settings to avoid this:

[jovlinger]

The 1x1 gifs are only useful in email: they already know to whom they served the page. However, they are really useful when embedded in html mail. They let the sender know that you tend to read your pr0n spam rather than just delete it immediately.

So what is needed is to only accept html email that is self-contained (ie, all the ref'd images are attachments in the same email).

As for javascript, all you need to do is disable mouseovers. I know many sites that rely on javascript, but can't think of a single one that relies on mouseovers.

Re:Use smart settings to avoid this:

[cyberdonny]

There are many effective uses of popups. One common example is popup help messages that don't force the user to navigate away from the page they were using. (I hate it when I've spent five minutes filling out a form, click on a "help" link, and have all of that information lost.)

What's wrong with <a href="help.html" target="newframe"> ? As you see, having linked pages appear in a new window is perfectly doable in plain HTML. And if you really want to be fancy, just put the damn javascript link into a document.write clause, and a plain HTML link between <NOSCRIPT> tags. Javascript's language designers have supplied great backwards compatibility tools, but unfortunately nowadays the <NOSCRIPT> tags are hardly ever used for that puropose. Instead boorish web designers use them for such intelligent messages as "You're a moron for not using javascript, and a cheap bastard for having a screen with a resolution below 1600x1200"...

Re:Use smart settings to avoid this:

[jesser]

You can't specify the size of the window a targeted link will open in. You have to use javascript to do that.

I agree with you that web designers should try to make their sites work even when you don't have javascript enabled. A simpler way to do that is to have the link href to the help page, but then have an onclick handler that opens the help page in a new window and returns false. (Unfortunately, onclick triggers for right-clicking on links in some browsers, and links don't have an "oncommand" event like buttons do.)

Re:Use smart settings to avoid this:

[Fred Ferrigno]

They let the sender know that you tend to read your pr0n spam rather than just delete it immediately.

It doesn't seem like they're putting that information to good use. I delete all the spam I get (or at least I don't read it) and they still send me more.

Re:Use smart settings to avoid this:

[crucini]

logo.jpg-234987575

I wonder if we could make a filter that intelligently detects the 'arbitrary identifier' and replaces it with equivalent random characters of the same set. In this case it's pretty obvious. Of course the ultimate counter-weapon to that detector would be making all the image URL's identically formatted strings of base64 crap. But for the time being there might be some way to automate the anti-bug filter.

Of course this is ultimately futile since the server has the data anyway - web bugs are just a cheap way of sharing data with another server.

The ultimate filtering would be collaberative. If I got logo.jpg-234987575 (11k) as the first IMG on the page, and you got logo.jpg-332215533 (also 11k) our software could communicate (ala RBL) and reach a shared decision that the numeric portion is a tracking number. Then future clients (in our network) would randomly generate the number.

Re:Use smart settings to avoid this:

[hearingaid]

The 1x1 gifs are only useful in email: they already know to whom they served the page. However, they are really useful when embedded in html mail. They let the sender know that you tend to read your pr0n spam rather than just delete it immediately.

This is incorrect. Many mailers (e.g. Netscape) will automatically start downloading the HTML-linked images when you click on the name in your subject list (e.g. to delete it).

They cannot deduce anything from this behaviour.

Online molesters are targetting OUR KIDS!

[BillyGoatThree]

For crying out loud, /., lighten up. Remember back in '95 when you couldn't turn on the TV or read a news magazine without some lame story about online stalking or pedophiles in chatrooms? And we all mocked them by saying "that's no different than real-life, what's all the hullabaloo"?

"Brick and mortar" stores do exactly this same thing. Many have cameras, the rest use "secret shoppers" (people who look like they are shopping but are really watching YOU) to discourage shoplifting, check competitor prices AND research in-store "migratory patterns". For instance, haven't you ever noticed that ALL grocery stores have the fresh fruits and vegetables right by the door?

This isn't "Your Rights Online". This is "Translating Nothing Cares About In RealLife Into A Scare Story About 'The Net' In Order To Attract Eyeballs To Slashdot."

Re:Online molesters are targetting OUR KIDS!

[D Anderson n'Swaart]

Now put those cameras in your house, and a couple of secret siblings too, and see if it's still okay.

Re:Online molesters are targetting OUR KIDS!

[ajs]

How did this get modded up? Isn't this obvious troll material.

Please, someone bounce it back down.

Now, getting to what the article actually says: I'm getting closer and closer to the opinion that we're in the middle of a war on privacy (to use a US-world-view phrase). It started out with the usual garbage about how companies needed to know how good their advertising was (to which I ask "why?").

But, this clearly crosses the line. No one needs to know that on a page with 7 stories, I spent more time looking at the one on penguins. There is no good excuse for this.

"Cheese"?

[Anoriymous Coward]

The system developed by the team at MIT is called Cheese, since they are following the mouse, like a mouse follows cheese.

Wouldn't a better title have been "Cat"? Or perhaps "Rodent Stalker"?

Re:"Cheese"?

[Fortissimo]

This one struck me as odd, too. Don't believe I've ever seen a mouse "follow" cheese. Wasn't even aware that cheese could move. The MIT folks may be brilliant, but they ain't creative.

Re:"Cheese"?

[interiot]

In the spirit of FBI's tactless naming scheme, how 'bout Mousivore(TM)?

Re:"Cheese"?

[crucini]

Perhaps DEATH OF RATS?

SQUEAK.

You're not fooling anyone.

SQUEAK.

Get out of my browser this minute!

SQUEAK.

And what did you do with my mouse movement data?

"It's shoved it in a table in Oracle," said a voice from the shelves on the other side of the room.

This is garbage

[Velex]

Oh, come on. This is pure garbage. How much info could one possibly glean from whatever javascript the researchers were using to capture the mouse movements? For me, whom uses the keyboard excessively and only moves the mouse when I'm sure I want to click on a link, there isn't anything that they can possibly gather. Besides, if they want to monitor my mouse movements, maybe they can see how quickly my reflexes to close pop-up windows before I even know what's in them come into play.

Eh?

[stripes]

"I can tell because when you read a webpage, you do one of a couple of things. You either shovel the mouse off to the right so that it is out of the way, or you will walk down the page with your mouse," he told the BBC's Go Digital programme.

Yeah....or I'm one of the 5% of the computer market with a Mac and I'm one of the 90% of Mac users that have discovered that when I type the mouse goes away. So I press down arrow and *poof* I don't need to move the mouse out of the way, and my finger is right where I need it to scroll down to read more of the story.

(Or I could turn off JavaScript, which is a good idea because it gets rid of a lot of irritating popup and popunder ads -- which is a pretty good idea, even 'tho it breaks a few sites)

Re:Eh?

[stripes]

Linux+Xfree86

Really? FreeBSD+Xfree86 does not, and I would have assume that was going to be driven by the X server not the OS under it. Which version of Xfree86? Maybe I'll have to get X running on my Linux box and see if it really does blank there...

Re:Eh?

[stripes]

Since you're on FBSD, you'll want to download the source from wherever it came from, or just grab the original tarball from the Debian archive.

Thanks, it looks like one can just cd to /usr/ports/misc/unclutter and type make install.... now that one has a clue as to what the program is named.

Re:Eh?

[stripes]

That would explain your retard attitude. That can be turned on in Windows if it is desired. Of course, MacOS is the same retard-OS that requires you to use the mouse for basically everything. One can do effectively bugger-all on a Mac without a mouse.

Well, I know it's just a troll, but what the hell.

I bought the Mac to see how good a Unix OS X is. I'm rather a bit happier with how much real stuff I can do with it from the command line that I have ever been in my brief encounters with Winblows.

So what can I do without a mouse? I can log in, switch to the terminal app (I have it auto start), fire up ssh-agent and start some ssh tunnels (Apple nicely provides ssh, but it also pretty much compiles out of the box). I can read my mail with mutt (I had to compile it myself). I will note that Apples GUI mail reader is pretty nice, it does need a mouse for some things though. Let's see, what else? I haven't bothered with w3m, so no mouseless web browsing, but I don't really do that on Unix boxes anyway (i.e. I use the mouse there). I can vi files, which I like more then Apple's textedit app. Pretty much whatever you could do on a "real" unix without a mouse.

With a little mousing I can get a nice VNC windows (over the ssh tunnel) to a "real" Unix box and,um, use the mouse remotely :-)

Client side cooperation required

[image]

I, for one, won't run a client that allows a site to profile me in this way.

If I understand this correctly, this technology would require the client to send data to the server about mouse movements, etc, for tracking purposes.

So I could simply elect not to use this type of software, correct?

Re:Client side cooperation required

[stikves]

No it is not necessary. The site can have two "frames". One of them would be the main frame filling the entire window, the other will be the tracking frame, which is insivible (or 1 pixel high).

Then the javascript code in the main window will fill a string with your mouse movement like:

(100,100)-(110,100)-(110,109)-...

After the buffer is filled enough, it will update the hidden frame with a code like:

TrackerFrame.URL = "http://server/track.cgi?" + str;

That's it. That's all. Your tracking is complete.

Maybe not so bad...

[NetJunkie]

Making web sites easier to use and catoring the content to what the users expect isn't a bad thing. Microsoft does very similar things in their GUI design. They get a large group of people together and have them do common tasks and watch every mouse movement and click and find ways to speed up the process.

Sure, I don't want someone tracking me, but keeping aggregate data wouldn't be bad. By doing this maybe they can speed up access to information instead of having me hunt around for what I want.

Re:What's so bad about direct marketing?

[stilwebm]

The problem is, there will always be misdirected marketing as long as our interests are inferred rather than taken directly from us. Sure, some methods will produce better results. But if I get up from my desk, I push my keyboard tray in, and the mouse almost always moves. So they will think that because the pointer stops on a pantyhose ad for several minutes that I am suddenly very interested in pantyhose. OK, so I've never seen pantyhose ads on the net, but you get the point...

Re:Is it just me or is the web becoming too annoyi

[Greyfox]

Konqueror and Mozilla both allow you to disable popups while allowing JavaScript to run. I believe that at least Konqueror and possibly Mozilla as well will allow you disable or enable features on a site by site basis. The web has become a whole lot less obnoxious since I set Mozilla up to disable popups and animation. I highly recommend running a browser that will let you do this. Mozilla is now fast enough that I can actually tolerate using it and has been since a CVS build about a month and a half ago.

Enough...

[Ronin Developer]

First spyware and then web bugs. What needs to happen is that the public has to say "Enough is Enough" and not use products or services that violate their privacy or utilize these types of tools.

Unfortunately, the average person takes what is available to them simply because of the convienience of doing so. Apathy sucks, doesn't it.

Anybody up to writing an HTTP proxy or filter that strips out this info as it is being returned to the offending site? I guess it should then redirect the user to a site informing them of what has or was about to happened. Maybe the internet community should develop an RBL-like list for websites that pull this stunt? Anyone up for an RFC?

Here's a thought...remember Dr. Hawking's fear that machines may someday subjugate us? Image a concious website that maniputes us into doing whatever it wants us to do or believe. Damn...my computer is calling me again....

Re:What's so bad about direct marketing?

[UberOogie]

Personally, if companies can direct moderate amounts...

Stop right there, because that's your answer. It will never be moderate. As soon as they can, it is in the marketers best interest to get as much advertising to you as they can in the shortest amount of time, and the more they know, the more they will.

It is sad, but in the future, we'll probably look back fondly on things like PeoplePC which gave only one advertiser the keys to the car...

Reading the article

[daviddennis]

While reading the article, I left the mouse in the main browser window and used the keyboard to scroll. So if their system was used, it would make it appear that I was not reading the article, even though I did in fact read it.

Really, if you stay on a page for more than a few seconds, you're probably reading it. And that would surely be simple enough to determine, although you'd have to figure out a bulletproof way to put up an invisible frame in order to send the information to the mother ship. It would probably be easiest done in Java, which can do that without pulling up a web page, but many people have non-working Java, so even that's not foolproof.

Unfortunately for the people who created this model, once people become aware of how it works, it will no longer function. People who would formerly hover the mouse over a link would simply refrain from doing so and therefore give the system no useful data. I also suspect individual personal styles are going to be different enough to stymie them in the end. I am not convinced that people only visit links directly if they have been to the site before, for example.

For the person who said a scroll mouse would defeat this system, I'm sure signals from the scroll wheel can be read as well.

When I am hesitating between multiple items, I will often put them in my cart, look at the total and then remove the one that makes the total too high, or that I'm unsure about. Anything I put in my cart and took out, and any abandoned shopping cart contents, would be a ripe selling weapon that can already be used without relying on this technique.

I think this one's too flaky for practical use. But as always, we'll see.

D

Info, info everywhere, but not a thought to think.

[refrain]

This is yet a little more frightening...

I think that the idea that some AI code can tell what I'm truly interested in and what I'm going to buy is ridiculousness. While it may be true that most people do work in similar ways with the interfaces of web-published documents, what goes on in the individual mind during the process is certainly unknowable.

This technology sounds like it could cause more harm than good. I can see this sort of thing narrowing the scope yet again of what content is available online.

This will lead to the customisation of individual users' content without them even being aware that it is happening. "Can you imagine if I can actually tell that you wanted to press a link but didn't". (What?! Maybe there's a reason why I didn't!?)

It's bad enough that content it already spoon-fed to most people already - does it have to be chewed for us now first too? And when the people are only exposed to the things that the corporations will believe that we're interest in, it will lead further to the atrophy of the collective consumer consciousness.

Fortunately for me, I'm still using the 10th Edition of the Newspeak Dictionary... perhaps I'm a dying breed. *shrug*

I don't get this...

[update()]

The story is interesting, and but the description of it here seems so far off that I briefly wondered if I'd hit the wrong link.

Look, since day one of the commercial web, sites have obsessively tracked how many hits they get, where they're coming from, how a user moves through the pages, where they spend time and how often they return. (As if Andover/OSDN isn't doing all of those things -- or is this like with web bugs where we're just supposed to care about them on other sites?) That's one of the great edges the net was going to have over other media. To the degree that people are bothered by that and to the degree that they're technically sophisticated, they turned off cookies and otherwise interfered. And what does Junkbuster have to do with anything?

What this seems to be is an incremental advance in tracking how pages are read -- there's a little added feedback about mouse movements and maybe scrolling. As always, if this takes off it will be trivial to block for those who know and care about such things. And everyone else has far more important privacy invasion being done to them.

It's called JavaScript

[Hilary Rosen]

and it's enabled by default on all major commercial browsers. Yes, you can turn it off, but then you'll miss out on the gee-whiz stuff that sites put up in lieu of content.

<rant>
What really pisses me off is sites that have information that I want (in HTML) but won't give it unless I pass through their flash corridor.
</rant>

Weaknesses in the Theory

[martyb]

Though what they propose probably has some application to the majority of users, I'm just as sure there are others who would not fit their expectations:

• Keyboard-centric:Though most users primarily use a mouse, I've found in many cases it is much faster for me to keep my hands on the keyboard and navigate with page-up/page-down and cursor keys. Menu navigation can be much quicker too as I can make choices with keyboard shortcuts and mnemonics without first having to wait for each menu and submenu to paint.
  
• Large display: Use a 21" monitor running at 1600 x 1200. That means there are many pages where there's no need to scroll; and those that need it, well, just use the page-down or arrow keys.
  
• Touch screens There's no "hovering" or mouse trail; just TAP and you are there, with no record of any "path" across the screen. This will become more prevalent with PDAs.
  

Besides, cheese is often placed in a mousetrap. This kind of technology feels like users are the ones being tempted by the cheese; what kind of trap are we getting into?

Re:Weaknesses in the Theory

[thelexx]

Recently I started using a pen tablet, got totally hooked and use it for 99% of my pointer input now. I'd be interested to know how their system works with one for the same reason you mention with a touch screen. Once you use a tablet for a little while your brain figures out the aspect ratio and you can pull the pen out of the input field and put it back down somewhere else with decent accuracy. As a result the pointer disappears and reappears across the screen. Anyway, just one more wrinkle for them to iron heh...

LEXX

Excite may already be doing this

[Compulawyer]

I have noticed that when I log into Excite, some pages I view have been loading a 1 X 1 Applet that is transmitting information (at least time spent on the page) back to servers. As far as I am concerned the only uses for a 1 X 1 ANYTHING on a web page are no good.

I have not yet grabbed the applet and tried to decompile it (mostly for lack of time), so I do not know exactly what it is doing in addition to sending time information, but it struck me as extremely obnoxious.

I am stuck using Win98 and Netscape 4.7 at work, so I cannot use a more enlightened browser that selectively grants/denies JavaScript and Java access by domain name. So...I am stuck being watched to a certain extent.

Is it just me or is anyone else sick and tired of being treated like some company's asset? I am tired of the companies I deal with trying to suck every possible dime out of the relationship they have with me -- ESPECIALLY when it comes to selling my personal information.

Re:Excite may already be doing this

[Compulawyer]

I don't use IE because the sysadmins at my work have tweaked it so much and restricted the ability to shut off cookies and java/jscript. I do resaearch that has to be kept confidential - if I can't take minimum steps to protect that confidentiality, I can't use the software.

Re:Excite may already be doing this

[Compulawyer]

A 1 X 1 gfx MIGHT BE a spacer -- then again, it could be a web bug (IMHO, it is more likely to be a web bug - I haven't seen too many tables that need anything moved by only 1 pixel). Although I agree - everything 1 X 1 is not NECESSARILY bad, but how effective is something 1 X 1 as a presentation item on a web page? Remember, HTML is primarily used for data presentation, not data formatting. That's XML's territory.

Re:Excite may already be doing this

[Compulawyer]

I couldn't agree more that HTML has become the presentation layer - see my other post. Data formatting is for XML.

Browser security settings?

[Xenophon Fenderson,]

How difficult is it to configure one's web browser so that it rejects most of the scripting junk out there? If you are using IE, check out the security zones feature that allows you to toggle scripting, cookies, and so forth depending on to which of four security zones a particular site belongs. I'm sure the free browsers have something much more sophisticated. Use it!

Re:No client-saide participation: scripting

[Darth Paul]

Lynx? Never heard of it, my fave browser is telnet to port 80!

But you never know, some marketroid can probably read meaning into how fast you can type GET / HTTP/1.0

Re:marketing - how's this for annoying

[marcop]

check out the Majestic game advert at: http://www.scifi.com/farscape/ . Looks like what you mention is not too far away!

So can I do this back to them?

[TomRC]

Wouldn't it be illegal if I tried to insert something into their web server to spy on what information they're collecting about me while I'm viewing their web page? Is my computer not protected by the same laws that theirs are?

I suppose you could argue that I'm leaving myself open to such invasion if I don't disable scripting - so why doesn't that argument hold when a web site doesn't close known security holes? At least there're valid reasons for wanting to leave scripting enabled!

Hmm - if I declare my actions in browsing their website - mouse movements other than intentional feedback like clicking on a link - to be copyrighted material, could I get protection from the DMCA? Then that script to spy on me would be a tool designed to crack my copy protection scheme (which would consist of recording all mouse movements to a file with "(C) 2001" at the top and encrypting it by XORing with a 'secret' key). The fact that they intercept it before I record it just means that they have found a technical means of bypassing my protections).

It would be nice to know....

[pjrc]

... as the author of a modestly-sized website (about 100 pages), it would be nice to know which parts people are actually reading. Actually, what I've often wanted to know is what parts confuse my readers and where they need more help. Sometimes I get this via email questions, but still it's very hard to know what to do to improve specific parts of the site.

Of course, there probably would be abuses of privacy by "marketing firms", but in the case of website that actually try to provide really useful information, this sort of feedback could really help direct the very limited time and effort towards improving the parts of the site that really need it. In my own case, it's often the classic example of a long-time expert not being able to identify with the pains of brand new users.

Of course, there is the traditional usability study approach. Maybe someday I'll spend some money and do it.

Presumptuous [MIT] nimrods...

[Saeger]

"So when you act like you know where you are going on a place where you have no reason to know, then we know you have been there before."

I don't know about the rest of you, but when I visit any website, even one I've never seen before, I use my eyeballs before I move the mouse--it's naturally much more efficient that way. In fact, most of the time it's my scrollwheel that's moving, and not the mouse itself.

Honestly, I consider my mouse movement patterns almost completely useless, and I have no idea what good a website that "changed according to mouse behaviour" could possibly do me. Well, maybe links that I almost never hover could be tucked away; but I doubt ads would be included in that bunch.

Eye-tracking has much greater potential...

Grey area between Opt-Out and Opt-In

[Sloppy]

This collection technique is implemented using current technology and does not require any additional software on the user's browser.

This suggests that it's probably done with Javascript. People that care about privacy, security, and avoiding annoyances, haven't had Javascript enabled in 5 years. Although that technically makes it "opt-out", turning off Javascript is such a basic an almost automatic thing that web users do, that it's practically "opt-in."

Required Web Privacy Software (for Windows Users)

[Quarters]

1) WebWasher (www.webwasher.de). It blocks cookies, scripts animations, web bugs, referer URLs, images, and a whole host of other things. It is highly configurable can be used as a proxy server if you have an in-house LAN connected to a shared broadband connection, and is much more powerful than Guidescope (which Junkbuster recommends for use under Windows).

2) Ad-Aware 5.6 (www.lavasoftusa.com). Run this at least once a week. It will find any ad tracking cookies, spy-ware and various other privacy invading data/programs that get left on your machine. The new version scans your memory, your registry, and your entire HD (very quickly). It finds and removes everything privacy invasion related.

Re:What's so bad about direct marketing?

[UberOogie]

But when the messages start piling up, for things I'm not interested in, then they just all get deleted, and the e-tailor looses out.

No, the e-tailor doesn't.

The more carpet-bombing they do, the more return they get, with a near-zero investment. And the more info they have, the more they can do it and make it look like they're not doing it.

This is proven Internet marketing practice. Do you know why every half-wit and his brother spams? Because people make it profitable for them to do so. "Legitimate" Internet companies have to play a closer line, but it all works out to the more they send out, the more they get back in. Period.

You want to chill your very soul? Read a marketing trade mag. I think that would change your mind pretty quick.

Say hello to Webwasher and Proximitron

[Desiato_Hotblack]

I guess that filtering the javascript involved would do the trick, or selectively writing a filter with Proximitron to catch the cookies, etc..

This shouldn't be too hard to defeat, regardless.

What gall for trying though. It reminds me of a Gibson story, (fuzzy on the details) but essentially "sensing" the patterns in someone's data enabled the corporations of the future to do precise targeting of consumers. Scary how we inch towards that every passing year.

Hotblack_Desiato

Oh brother ...

[Christianfreak]

Typical /. "Big brother is watching us" paranoia. Come on! Did no one read the article? Some interesting points about it:

• No client software required: In other words its a stupid Javascript. Translation you can turn it off
• They only tested 17 people. Translation either the MIT student doing this is an idiot or the BBC article is hype. I vote for "C" both.

This is not Your Rights Online nor is it news. Lets go back to bashing M$oft.

Rant Mode OFF.

The bread, milk, and fresh fruits are scattered.

[laetus]

Just because a store researches something doesn't mean they're going to make the shopping experience better for the consumer.

Case in point: The grocery store you referenced. Haven't YOU ever noticed that the dairy, bread, and fresh vegetables/fruits are scattered at different corners of the store.

And you know why, to make you wander the other aisles to get you to buy crap you didn't originally walk in to get.

no prob here

[Cardhore]

I don't browse webshites.

Paranoia setting in on Slashdot

[M_Talon]

Ok folks, before everyone goes ballistic about the latest way to monitor what goes on in a browser (I'm probably too late), consider this. If they really see how we ignore banner ads and slam close popup windows, is this a bad thing? Maybe the Evil Marketing People(tm) will finally realize what doesn't work with ads and quit doing them. Maybe they'll realize that more-intrusive-ad!=more-attention.

Sometimes you have to look at things for what they can do positively, not just negatively.

Re:Paranoia setting in on Slashdot

[markmoss]

The basic problem with them developing better tools to show how much we DON'T pay attention to the !@#$% ads is that it puts web sites at a disadvantage with respect to TV where the dumb suits paying a million $ a minute for ad time have no way of finding out that no one is watching.

Re:What's so bad about direct marketing?

[jimhill]

"[T]he Internet is as public as Grand Central Station, or Central Park. People should have no reasonable expectation of privacy on the internet."

That depends on what you mean by "reasonable expectation of privacy." I am well aware that when I go to a public area such as Grand Central Station that I might been observed by people who know me or people who don't, and that I might or might not be aware of it.

However, I do not consider it likely that someone who knows nearly everything about me will track where I go in Grand Central Station, what I do there, how long I take to do it, whether I do it alone, and so forth -- and I damn sure don't consider it likely that this mysterious individual about whom I will know almost nothing will have the ability and the desire to sell what he has learned about me to a third party so that that third party may increase what _it_ knows about me. Some people think that way, but in general we mock and deride them for being paranoid. Yet on the Web, we mutely accept such a state of affairs and often mistakenly tell people that such is no different from our daily life.

The legal phrase "reasonable expectation of privacy" is like "shadows and penumbras" -- it gives the lawyers and the IANALs something to quote and sound very wise but it doesn't _mean_ anything other than what the judge of the moment thinks it means. That's not a solid legal footing for anything. And with technology far outpacing our legal system, perhaps even this shifting-sand legal foundation should be revisited.

If I may address your initial point, that you are satisfied with moderate advertising in exchange for some surrender of your personal privacy, I don't think that many would disagree. However, the Web and indeed any purchase that involves either plastic or corporations or both will not permit that bargain. They _demand_ that you surrender everything about yourself (and they will fill in the gaps by "sharing information" with their "partners" to "serve you better") and they then bombard you with promotional materials that have only the most tenuous connection to your purchasing interests. And yet people continue to happily accept that, in exchange for a nickel off here or a rebate coupon there -- and these people are fouling it up for the rest of us who _don't_ share your opinion that a little marketing is worth a little privacy. When I buy groceries, I have to fight off the "Frequent shopper card?" chirping from the clerk. When I want a thirty-cent resistor at Radio Shack I have to deal with "Home address?" from the clerk. It's time to return to the day when a business transaction consisted of a person giving money for a product, no more, no less. Keep your advertising and your targeted marketing and your insiders-only discounts. Just gimme my damn resistor, sir.

Two Methods to Defeat/Confuse this.

[Jeremiah Cornelius]

1) Voice navigation - I think that I finally found an everyday use for this...

2) Run your own Spider - Jam the recording site with "Noise" web traffic associated with your cookie/session. A good spider/robot could simulate mouse coordinates, etc.

Just a couple of quick thoughts. I'm sure there are more...

jeremiah cornelius

Re:Is it just me or is the web becoming too annoyi

[Mr. Slippery]

Adverisers are pissing of people who watch television too. You get used to it...

Or you leave the room, or you hit the "mute" button. Or you tape, and skip over the commericals during playback.

Brick and mortar stores != the WWW...

[Svartalf]

I could almost buy the tracking "migratory patterns" argument- but they get that without needing any of the other spyware. Hell, the server tracks that as usage log information. The other reasons are just non-valid (Checking competitor prices? Go hit their site. Shoplifters? Don't make me laugh...).

There is NO good reason for the spyware. If the hit info isn't giving them things they like, maybe there is a reason for it. Could be they're doing something wrong- or maybe they bet on the wrong thing...

Why need this?

[Heem]

Why do people need all this fancy mouse tracking.
(grumpy old man)
In MY day, we looked at the logs to see what people are looking at
(/grumpy old man)

More details

[Trollsfire]

The article is a little short on details as to how the technology works, and there has been some speculation already. However, this being academic research, let us not forget that more details are (often) readily available. The Project Proposal (pdf format, 138K) and a brief paper (pdf format, 77K) are available from MIT's web site.

Their stated motivation is:

Content providers have a vested interest in the results of mouse movement data analysis. Our system provides the means to find out exactly how users mavigate their page and thus affords an extensive user model.

The technique they used was to "add Javascript externally to an existing web page." They mention using barnesandnobel.com, amazon.com, and ashford.com explicitely, but more had to be used given the nature of the tasks given. This seems to imply that they are able to, as a third party, add the javascript tracking to already existing sites. However, they also may be using the fact that they control the testing environment to do this, such as by inserting the code using an http proxy. Details related to how the code was introduced are not given, and would be necessary to determine how much of a privacy threat this is.

Re:Is it just me or is the web becoming too annoyi

[wurp]

Mozilla definitely does allow you to disable popups. See http://www.mozilla.org/projects/security/component s/configPolicy.html

Even more off-topic:
Does anyone know how to make Mozilla lie about what User-Agent it is? My bank software rejects Mozilla, claiming it's not compatible. I'm pretty sure it is, and I want to try to make Mozilla claim to be IE on that domain.

Re:the more invasive they get

[ichimunki]

except that as long as the invasiveness is largely invisible, no one will really know except those of us who can decipher JavaScript or other embedded objects in pages... and just think how much extra work it will be to decipher what is actually happening in an applet or a similarly embedded object where the source isn't easily viewed via "View Source". The only time the public knows or cares is when you give them an active demonstration on the TV news. Or when something goes wrong and it becomes painfully obvious, i.e. trojaned applets and things like that.

Re:What??

[brunes69]

It's not too difficult to look into your statusbar as you hover over a link.

Re:Is it just me or is the web becoming too annoyi

[unapersson]

In Mozilla you can disable any javascript method or property on a site by site basis.

So you can disable window.open, OnClose and other annoying methods.

Deny scripts access to data on your browser, screen dimensions etc.

See here for info on how to do it.

This is Stupid!

[PotatoHead]

Reality check here...

People are going to collect information on the sites you visit. If you don't like it, there are some easy ways to get around the problem.

Personally, I don't mind most sites looking my stats over. This sort of thing keeps a lot of sites free. There are worse options like interrupted browsing. All they have to do is remove the page from direct access and lots of bad things happen. Let the marketing departments pay for something easy that those of us who want to can get around. The alternatives are harder and costly.

1. Fast connection means nothing because you have to wait along with everyone else for the ad server to show you the ad, then the page....

2. Searching becomes harder.

3. The web becomes less cross-platform as the ads require tools not avaliable everywhere.

So,

Use an anon service and surf that way if it is a problem.

Or here is another option. Enable your usual blocking tools hit the page and copy the page to local storage and read as long as you want.

I will do this anyway from time to time because I want to archive some content for reading later offline or on a PDA.

Big deal.

I'd wager its already happening.

[sheetsda]

Or perhaps someone else is already doing this, and hasn't told you.

Lets see... I think its doubleclick.com that places ad banners that track people across server boundaries then sells the results. Web servers moniter traffic and analyze logs to find out which pages are getting hit most frequently. I'd bet with a little bit of creative Java (or maybe even JavaScript) you could tell how far down the page someone is(can anyone verify or disprove this?), from that figure out their reading speed, what sections of the page they weren't interested enough to read, and which they just skimmed, and who knows what else. Combine these technologies and there you have it, you have an exact picture of what interests a specific person. Throw in an IP address, and maybe some demographic information and you have an awesome marketing tool, with no new technology involved. I wouldn't say "perhaps", I think its a sure bet someone is already doing this.

This is pointless for geeks

[Calle Ballz]

The targets specified in this article were obviously computer illiterate run of the mill folk living the average life. The kind of person that actually reads the help files that come with microsoft products. Also, the kind of person that can't read anything without a physical reference point, i.e. a mouse cursor. For people like myself... who don't hold on to the mouse unless the intention is on clicking what is being looked it... it wouldn't work. And I dont' shove my cursor off to the right, It's not that big, it does fine right where it's at.

Difficult?

[jallen02]

This would take me a week to implement in JavaScript. Set up listeners for nearly and and all mouse events. Log them using a Javascript Object. Serialize it to XML or some tighter data format. Analyze later. The tricky part is the analysis and figuring out exactly what you want to have listeners for. Still.. not that difficult at all.

Jeremy

His method isn't perfect.

[sheetsda]

"I can tell because when you read a webpage, you do one of a couple of things. You either shovel the mouse off to the right so that it is out of the way, or you will walk down the page with your mouse," he told the BBC's Go Digital programme.

Upon reading this I looked at my mouse cursors position. It was dead in the middle of the screen, over some of the text I had read before I scrolled down using my mouse wheel, and had been there since I opened the page. (I take the second case he descibes as 'you use the mouse to hold the vertical position on the page where you're currently reading', as oppose to 'you use your mouse wheel to scroll')

This should not be too difficult to implement

[Anemophilous Coward]

From the article:

"I can tell because when you read a webpage, you do one of a couple of things. You either shovel the mouse off to the right so that it is out of the way, or you will walk down the page with your mouse,"

I'm presuming here that what the person means by walking your mouse down the page, is that you are "reading" the text with your mouse pointer (like using your finger in a book). Many people here mention that they get around this by using their scroll wheel. They can probably track scroll wheel movements pretty easy. A simplistic method would be in javascript. You should just need something like:

if (browser is IE)

document.onmouseover = call function here;

if (browser is Netscape)

document.addEventListener("mouseover", call function here, true);

in your scripting area. I think this will take care of 'tracking' your mouse anywhere on the screen. So if the mouse is anywhere over the document, an event is fired off calling the function. I'm sure you've seen a site that has those anoying 'mouse trails' that can follow your cursor...similar concept. It's not limited to links, so provided your mouse pointer is anywhere over the page, it will track it. If you are using the scroll wheel, the page moves under the mouse...but the pointer ends up over a different section of page. Thus it looks like the mouse has moved. So the function could start a timer every time it is called. This could give you an idea of how long they spend viewing a portion of the screen before moving on (scrolling down, etc.).

Now, you could probably circumvent this by putting the mouse cursor off of the browser window altogether and use the arrow keys to scroll. Put you'll probably need to tab between the links in order to get to the one you want. This selects each link, which again should be viewable through a javascript event (can remember the handler off top of head, onfocus perhaps?) tagged to each link.

Other parts of the article mention being able to provide you with a site that tailors itself to you on the fly. Simple server-side scripting will do this. However, I fear sites becoming over-zealous with a feature like this. Many sites end up only providing you with common content it thinks you want, while hiding the content it thinks you don't want. This is to presumably speed up my experience because I wont have to see the other site information downloaded (quicker access over those modem links). After a while, I might not know what said site has to fully offer, as I get 'stuck in a rut' so to speak. They would need a 'show everything site has' (site map) link on everything single page to help offset this. Unfortunately, many sites don't adhear to this simple requirement. Consequently, many users never use certain sites to their full potential.

- A non-productive mind is with absolutely zero balance.

- AC

Several answers

[Croaker]

I have a mutli-level armored approach to browsing:

1. I installed Bugnosis which is designed specifically to deal with single pixels images that might be web bugs.
2. I use Proxomitron to do Javascript filtering. It cuts out the worst examples of Javascript annoyances (popups, leaving the page triggers, etc.) The filters are editable, so you can customize them yourself to filter out things like this spy script.
3. I route everything through Junkbuster, which gets rid of the ads that Proxomitron misses.

All of the above besides Junkbuster are Windows-only. The first one is specific to IE, but I end up using that anyhow, since it's the most stable Windows browser.

I can browse most sites that don't do stupid shit like refuse to serve pages to me if they cannot detect my browser (in which case, they are probably crap, anyhow). For shopping sites, I can just add the site to Junkbuster, or bypass the protection through Proxomitron. I am pop-up ad free, and I give out minimal information about myself. The other better way of browsing I could see would be to use an anonymous proxy, which would protect my IP addess.

Of course, this would bet better implemented via the browser. I was using Konqueror a lot at home under Linux, but it began crashing too much for my tastes. There, I've just stuck to using Mozilla with Junkbuster. Javascripts still sometimes get through, though.

Re:The bread, milk, and fresh fruits are scattered

[cancrman]

Duh. The comic shop I used to work at (Action Comics. Quite an original name, no?) did this with the new comics. They were along the back wall so people would have to walk past all of the games/toys/cards and other assorted whatnot to get their biweekly X-Men fix. This isn't bad for the consumer. Sure you've got to walk an extra 15 feet or so (God forbid) but you also get to be exposed to different crap that you might not have been exposed to before (impulse buy!). Unfortuantely, this did not work for Action and they are now long out of business.

Mozilla patch or option

[Nohea]

Since the crucial part is not the javascript getting mouse positions, the crucial part is javascript communicating those positions back to the web server.
Mozilla already has fine-grained control over which sites you allow to send cookies to. Someone could add another fine-grained feature to control what sites you allow javascript to send http GET/POST commands to. It could also set which javascript commands you want to enable. This is already the case with window.open()

I also thought maybe we could make the broswer show you what info it is posting back, and let you approve it. But then, sites would just encode it so its not human-readable.

So this is a complicated issue, but one we can deal with, since we have Open Source Mozilla.

Re:Is it just me or is the web becoming too annoyi

[iso]

On the topic of pop-ups, I've read through the page you cited, but I still have one more question: does Mozilla have the ability to enable pop-ups only from clicking on a link? Disabling pop-ups entirely is irritating as many genuinly useful sites use pop-ups when a link is clicked. It seems that the Mozilla solution is to add each legitimate site by hand; hardly an optimal solution.

FWIW, OmniWeb has this feature.

- j

made by MIT

[josepha48]

of course this was made by the 'academics'.. again MIT creates something without thinking should they .. this is always the case though. To many people think more important of can we do this rather than should we do this.

Why isn't MIT trying to figure out how to make SMTP a secure method of communication. Or adding a better way of removing spam off mailservers.

You know what I'd rather see, is a way of an end user setting up server side spam filters so that one does not have to download spam email to the machine and have the email client do the filtering. This would eliminate 50% of my junk email and probably yours too.

Why cant they create something useful to the users.. guess this means that there needs to be a privacy project started on sourceforge... Whats a good name for that???

Re:Is it just me or is the web becoming too annoyi

[smartin]

You get used to it (or have you stopped watching television?)

Actually I don't watch television any more, i watch Tivo :). Anyway, my point wasn't that advertising isn't necessary or ok at some level, my point was that the totally in your face advertising can't possibly be selling more product, it is probably selling less due to the fact that the advertisers are pissing off rather than attracting customers.

Hasn't anyone been paying attention?

[drew_kime]

However, I do not consider it likely that someone who knows nearly everything about me will track where I go in Grand Central Station, what I do there, how long I take to do it, whether I do it alone, and so forth -- and I damn sure don't consider it likely that this mysterious individual about whom I will know almost nothing will have the ability and the desire to sell what he has learned about me to a third party so that that third party may increase what _it_ knows about me.

There already are people tracking your every move in public places. These people already are selling some of your personal information to third parties. Question is, do enough people care about this to do anything about it?

./sig

Good luck tracking my browsing interests

[Dwonis]

They're going to have a tough time with me, considering I usually switch between an average of 10 browser windows at one time...

Example: Stopping popups in Mozilla

[bgarcia]

Disabling pop-ups entirely is irritating as many genuinly useful sites use pop-ups when a link is clicked.

If you go to the link given in the parent post, you'll see that it can be configured on a site-by-site basis.

Most pop-up ads come from one of the usual banner-ad sites, not the actual website, so this feature works pretty well.

Here's my user.js file - you may find it useful. I allow pop-ups by default, except for the listed sites.

// Stop animated gifs after one iteration.
user_pref("image.animation_mode", "once");

// Stop windows from popping up when they finish loading pages.
user_pref("mozilla.widget.raise-on-setfocus", false);

// Block these sites from opening their own windows
user_pref("capability.policy.strict.sites", "http://www.car-truck.com http://www.cnn.com http://www.dictionary.com http://media.admonitor.net http://popup.zmedia.com http://ad.doubleclick.net http://www.netsol.com http://rd.yahoo.com");
user_pref("capability.policy.strict.Window.open", "noAccess");

Re:Is it just me or is the web becoming too annoyi

[niteshad]

I hate commercials on TV, but they have to pay for the content. Therefore, I stopped watching, but I don't complain about it - there's no point. Who likes popups? You could use technology to circumvent them, but this is unethical at best.

Unethical? What about the fact that I'm the one paying to download their advertisement? Since I'm the one paying for my connection to the Internet, and all of the traffic on that connection, I have the right to decide what content is appropriate on that connection. If I decide to block useless ads and popups that's entirely my right.

In general, I think that companies which try all of these very annoying advertising strategies are ultimately wasting their time and money. They should go read the Cluetrain Manifesto and get a clue.

What about Gesturing?

[Phrogman]

Doesn't the latest version of Opera support mouse gestures a la Black & White? Wouldn't this wreak havoc on any data they gather using this mouse position tracking system? I can just see hordes of Opera-using /.ers descending on the first website to employ this methodology for the sole purpose of screwing up the stats...

Link to project homepage

[eram]

I found the Web page of project "Cheese" at MIT. They don't seem to be using their own mouse tracking technique yet. The publication that the researchers have produced doesn't provide much more information than the BBC article.

Re:It *is* a wakeup call. to javascript sites.

[WNight]

Likely in the same way they'll find out that it's because their entire inventory is tacky and overpriced. That way is... who cares? It's their problem.

They'll either find out and correct it, or continue what they're doing with less customers, perhaps drastically less.

You could, if you're bored, write them an email and explain this, but I doubt any company that hired an IE5-obsessed, javascript-dependent monkey to do their pages has any clue about reading feedback from their users.

Companies that took the time to research the net, even only in so much as finding a consultant who wasn't an idiot, won't have javascript dependant pages, and will periodically try out any new browsers (both by searching for them, and by checking the server logs for user-agent strings) to make sure that their site is properly functional in all browsers.

Re:What's so bad about direct marketing?

[UberOogie]

Actually, what I ment by them losing out, is losing out on my sale.

This has been my point since I started: Your sale doesn't matter. They will get sales, and much more sales, through carpet-bombing. That is what works. That is why it will never be a moderate amount of targeted advertising. It is in their best interest to get the most advertising to the most people, and if they can fake tailor it to you, that's fine, but your sale doesn't matter. The percentage sales they would get from doing advertising "by the rules" would not be the same as doing it en masse.

So they won't.

It's all in the logs.

[malkavian]

Well, one thing that strikes me about this is:

For all this data collected from all the surfers to a busy site, where on earth are they going to store it all for any length of time??

I work for a company with a sizable web traffic (250 million pageviews/month). The bane of my life is the logs. Processing them, and storing them for the length of time to draw meaningful trends takes a huge amount of space. All of which needs to be on a RAID, just in case..
Then, of course, there's the software to mine this collection of data, the amount of time required to search the disks for the relevant data, and the setting of the resolution of the data capture from the mouse (needs to be pretty fine resolution to achieve any meaningful results)...
Just think, if they adopted this scheme, it'd be great fun to write a device driver for a pseudomouse that sat the cursor over the web browser, and randomly moved it around, generating millions of data events, all of which get logged on the web site archives...
It's fine to do this for a small scale site, with plenty of funding, but I think there'd be huge problems with the sheer logistics of collecting and analysing this data for anyone without almost bottomless pockets as far as funding goes...
Personally, I don't reckon this will be a big brother tech anytime in the near future...

Cheers,

Malk

Re:It's all in the logs.

[markmoss]

For all this data collected from all the surfers to a busy site, where on earth are they going to store it all for any length of time??

Duh. Most of the posts crying "invasion of privacy" have been far off the mark. This isn't technology for tracking individual users -- maybe it could do that, but recording every mouse movement individually would overload most servers. It's an attempt to collect stats on what parts of the page draws attention. Occasionally someone would use that to improve their web site. Mostly, advertisers are going to try to use it to find out if anyone even _looks_ at their ad. I don't think tracking mouse movements will do that too well, but in the absence of equipment to spot where your eyes are looking, they'll record the mouse movements and try to deduce something, then some dumb suits in marketing will take this faulty data as gospel.

And the real problem arises if this is actually accurate enough to reveal that no one looks at the ads... The first generation of spyware revealed that no one clicks on banner ads -- and millions of $ were pulled out of internet web sites and put into TV and magazine ads instead. No one looks at those either, but there is no way of showing just _how much_ we don't look at them. Improve the tools for measuring user interest in ads, and you are going to lose even more ad $...

Re:It's all in the logs.

[malkavian]

Couldn't agree more.
Still, all comes back to them making something someone actually wants to look at, rather than trying to ram it down their throats...

webshites?

[ntr0py]

is that a bit of a freudian slip?

Re:Is it just me or is the web becoming too annoyi

[jesser]

Even more off-topic:
Does anyone know how to make Mozilla lie about what User-Agent it is? My bank software rejects Mozilla, claiming it's not compatible. I'm pretty sure it is, and I want to try to make Mozilla claim to be IE on that domain.

The pref is called "general.useragent.override". See http://mozilla.org/unix/customizing.html for an example and instructions on how to set the pref if you're not familiar with prefs.js and user.js. (Note that even though the URL contains "unix", most of the prefs there work equally well on all platforms Mozilla runs on.)

Adding something to the preferences panel to allow changing the useragent without editing a text file is bug 46029.

Re:Is it just me or is the web becoming too annoyi

[jesser]

Two weeks ago, Rob Ginda and Mitch Stoltz added a weaker version of what you're asking for. Instead of only allowing pop-ups for click/enter, it blocks pop-ups for onload, inline scripts (run before onload), onunload, and timer events. This is effective against most existing pop-ups, but will stop being effective when aggressive advertisers realize they can use onfocus or onmouseover instead of onload (if they think enough people are using Mozilla and enable this pref).

To block pop-ups in onload and onunload events, add this line to your prefs.js file (or to a user.js file in the same directory):

user_pref("dom.disable_open_during_load", true);

blocking via hosts - Part 1 of 2

[UnknownSoldier]

I'm not the only one, but I posted an abridged version. I'm also not the orginal author - I just collected the data from various sources and put them into one HOSTS file.

I'll post mine when I get home tonite.

For Win NT4 / NT5 the hosts is found in
%SystemRoot%\system32\drivers\etc\

Re:Is it just me or is the web becoming too annoyi

[Teferi]

Hey, wow, finally someone else who uses NetCaptor!
What's also cool is that they have a version that's going to use Gecko in the works, too...

Reasonable expectations.

[Arandir]

I can't believe that people are upset over this. Wake up, smell the coffee, and welcome to the real world. Please notice that this reality does not precisely follow your expectations. Part of growing up is learning to deal with it.

If you stand up, walk to the corner, enter a liquor store, and buy a pack of condoms, PEOPLE ARE GOING TO KNOW ABOUT IT! Do you expect the clerk to wear blindfolds so he doesn't know who he is selling to?

It is perfectly reasonable, and expected by most people, that their actions which interact with other people will not be private. You call your mother on the phone and you mother will know about it. Duh! You talk to your mother in a crowded room and lots of people will know about it. You shout to your mother from across Grand Central Station, and hundreds of people will know about it.

That is why the law has a certain thing known as "reasonable expectation of privacy". The information about your website is already collected and available to the website. Go peruse your own apache logs if you don't believe me. They know what files you visited and in what order. Do you really expect them, if they are in the business of marketing a product, not to corrolate that information? They would be stupid if they did not.

You cannot expect that you will live life in a vacumn. You cannot expect that online businesses will behave differently than brick-and-mortor businesses. You cannot expect that one party in a transaction will forget all details about it after it concludes.

Not so sinister

[T1girl]

You're correct. I'm left-handed, mouse right-handed and use the mousewheel instead of the scrollbar whenever possible. I can be jotting down notes or checking items off a list with a pen in my left hand while I wheel/scroll with the right hand. The only thing that's hard for me to do with the mouse in my right hand is freehand drawing. I think most left-handed people develop some degree of ambidexterity.

The best thing about being left-handed is that you're always in your right mind.

Mouse cleaners

[ehiris]

"I can tell because when you read a webpage, you do one of a couple of things. You either shovel the mouse off to the right so that it is out of the way, or you will walk down the page with your mouse,"

What would a circular motion of the mouse mean? Is my mouse dirty? Maybe they could automaticaly send some mouse cleaning consultant over.

It's damn simple

[Lord Kestrel]

If you're concerned about this, disable javascript and/or vbscript.
I always have two browsers on my computers. One that prompts for cookies and has java and javascript enabled, and the other rejects all cookies, and has java and javascript disabled. I use the secure(r) one for cruising the web, and if I need to go to a useful site that requires javascript and/or cookies, I use the less secure one.

Forced to watch ads, BY LAW!

[Frank T. Lofaro Jr.]

That's part of the reason there is the DMCA and the possibly-soon-to-be SSSCA. To make skipping commercials illegal. (*) Heck, with DVDs it is illegal to make a player that lets you skip unskippable ads - you either have to violate the CSS license or implement CSS yourself, which is a DMCA violation.

(*) It won't strictly be illegal - that would raise an outcry. Just that getting around the technology that stops you would be an illegal "act of circumvention". That way anyone that tries to give you control could be painted as an "evil hacker", likewise for anyone using any circumvention methods.

After all, only "evil people" try to make the computer do anything it isn't designed for, or do anything the computer tries to prohibit. The machine is "always right", since the "nice" corporations made them.

(The above was heavily laced with sarcasm - obviously I am oppossed to DMCA/SSSCA).

Re:NADaemon....new Spyware on the scene?!

[Phantom_24]

It seems its from a company called NetActive Inc. and the file version is 4.2.3 (build Lithium)!

Re:Is it just me or is the web becoming too annoyi

[tshak]

Since I'm the one paying for my connection to the Internet, and all of the traffic on that connection, I have the right to decide what content is appropriate

EXACTLY! You have the RIGHT to decide if their ads are not the type of content you want on your pipe - don't go to their site and you won't see the ads. You're argument is like stating, "I shouldn't have to pay for this book, I have the RIGHT to view this book, so I'm going to steal it".
It's not your right to circumvent their revenue model Do you really believe that you have some God Given Right to have access to a website's content? If you want their content, you have to agree to their revenue model to use it (monthly subscription fee, advertising, etc.) If a site requires a $10 monthly fee, is it okay to hack an account on their system? Filtering ads is no different.

Note to moderators, I just got modded down for a legit post in this thread - please do not mod based on personal opinion or bias.

Mickey Mouse. Santa Recruit.

[crovira]

He sees you when you're sleeping.
He knows when you're awake.
He knows if you've surfed for porn.
don't jack-off for goodness sake.

Re:OmniWeb: Mac OS X

[ravenskana]

If you like OmniWeb, also check out iCab for OS X

It allows you to filter InScript/JavaScript on a site by site basis. For each site, you can allow/disallow the following:

-access 'Referer'
-access history
-write in status line
-create cookies
-ask for cookies
-open windows
-change window size/location
-hide toolbars

It also has excellent cookie filtering. Between OmniWeb and iCab I can deny anything. :)

Re:What's so bad about direct marketing?

[pjrc]

it is in the marketers best interest to get as much advertising to you as they can in the shortest amount of time, and the more they know, the more they will.

This will saddly remain true for scams and fraud, where the goal is to find a few hundred desparate/stupid people among many millions, with no regard for pissing off everyone with the good sense to know they're not going to "get rich quick".

But for marketing legitimate products and services, more will not always be better for advertisers. Ultimately sales are what matters, and pissing off customers and damaging ones reputation among them just doesn't make good long-term business sense. Sure, there are some examples of mass-mailing, but in the long run semi-targeted email is what will work for legit products. There are plenty of people like Mike that don't mind getting a few messages a week that are actually along his line of interest.

It's crap this these (all received in my inbox within the last few days) that will be the things that make sense to mass-email without any targeting. Just inside anyone reading this doesn't know what true garbage anyone who's publically visible and widely distributes their email address has to put up with, here's a little sampling (about 20%) of the spams I've received in the last 4 days:

You have been specially selected to qualify for the following:
Premium Vacation Package and Pentium PC Giveaway To review the details of the please click on the link with the confirmation number below:

RECEIVE ALL YOUR CABLE CHANNELS TODAY!!! With our NEW GLOBAL 2600 Cable Converter/Decoder!
Get all your favorite premium channels like HBO, Spice, Cinemax, ESPN PayPer View Etc...
Never miss another T.V show again!
The GLOBAL 2600 works on 99% of all cable system coast to coast!
You will never have to rent or buy another cable box again!
100% Bulletproof! Meaning it will never get deprogrammed!
This ad is sent in accordence with all applicable laws
yeah, right, like the DMCA, traffic'ng in circumvention devices, et all

Judgment Courses offers an extensive training
course in "How to Collect Money Judgments"
If you are like many people, you are not even sure what a Money Judgment is and why processing Money Judgments can earn you very substantial income...

Save up to 75% on term life insurance!
Get FREE quotes inst antly from top insurance companies
(yadda, yadda, yadda)

NEW CD ROM is helping to Create HUGE FORTUNES!!
Free Info:
* What if you could make a full time income handing/sending out a $1.25 CD ROM?
* What if the company paid you EVERY DAY?
* What if it was a New York Stock Exchange Company?
* What if there was no "real" competition and everybody needs our service?
* What if you got paid when somebody goes to your website and views the hottest video presentation ever and signs up?
If you are the least bit curious about why this CD ROM is making us Fortunes, all you need to do is simply send an email to:

SNORING-IS IT AFFECTING YOUR LIFE? This product has been featured on National TV.
Does snoring keep you up at night!! Tired of having to sleep in separate rooms because of snoring!! Tired of hearing how your snoring kept someone up all night!! Just Tired of being tired because of someones snoring!!
There is a safe, natural solution to your snoring problem!!
* Works first time, every time
* All natural product
* No side effects
* Guaranteed results
For more information visit our site (We have been working on the site and it may not be available..if it is not, please follow the instructions below..thanks in advance!
yep, they know they're a spammer and their lame website at a tripod.com user account will be shut down within an hour or two

MAJOR CONTRACT ANNOUNCEMENTS AND HUGE NEWSLETTER COVERAGE THIS WEEK FOR XXXX !!!
Revenues for XXXX, a 10-year old, fully-reporting company, have skyrocketed 600% higher this year to over $8 Million on substantial US Government and Insurance
on and on... they really want to pump and dump this poor penny stock, don't they? ... and here's another lame stock tip, from a forged address as a russian server, no less:

OTCBB Stock Alert's Last Two Picks:
XXXX from $ .60 to $2.50 in 10 days for a GAIN OF OVER 400%!!!
XXXX from $ .49 to $1.62 in 7 days for a GAIN OF OVER 300%!!!
HERE IS OUR NEXT EXPLOSIVE STOCK PICK:
company name removed (OTCBB: XXXX)
BUY AT $0.92
SELL TARGET $4.60 = DIAMOND PLAY !!!!

snipped a bunch of horseshit about how this isn't a get rich quick scheme ... "well, what does work then" it goes on
I'm looking for the entrepreneurial minded, GOAL = getting leaders who are not only seeking to create wealth in their own liv= es, but also in the lives of others, and do all this in the comfort of you= r own home! If you think you fit this criteria, I invite you to make this = call. It could change your entire life!!!

Well, that's about 20% of the spams I've received in the last 4 days. There were some really amazing ones in there but they were a giant mess of html... not easy to copy into slashdot. I kept holding out for one of the really dumb sex pills ads... ah, here it was (yet again) on Sept 5th:

End Erectile Dysfunction Forever With This Groundbreaking New Method And FREE YOURSELF From Expensive Pills And Useless Herbal Concoctions NOT A PUMP!
*Enlarge it
*Improve performance
*Increase sensation
If you are like the millions of men who seek to reclaim their sexual power or simply increase their size and endurance, THIS IS FOR YOU!
The Male Performance Method is a comprehensive regimen of doctor-recommended excercises and diet tips that is GUARANTEED to increase your size and performance in 30 days or your money back.
Of nearly TWO THOUSAND men who have tried this method , only 2 - TWO - have not seen any improvement. You just can't argue with those statistics!
When you try the Male Performance Method for just two weeks, you and your partner will FEEL the difference. Just imagine the look on her face when she sees what you can become in this short time...

The old saying goes:

If it sounds too good to be true....

Two major differences

[crucini]

1. The information which a bricks and mortar store records about you is not easily indexable, searchable, correlatable (word?). They cannot easily and cheaply ask "what was Joe Schmoe's average speed?" Or "Did Schmoe gaze longer at steaks or pork chops?" The info is there for them if it's important, but it's not automatically in a database for data mining.
   
2. The customer in a store has no reasonable expectation of privacy. He sees one-way mirrors and camera domes everywhere. There is usually a sign at the entrance warning of video surveillance. In contrast, the web user has a reasonable expectation of privacy while navigating within a page. According to a common understanding of the web, reading a page which has been downloaded does not transmit signals to a remote server. If the user were aware of the privacy invasion he might feel more constrained in the information he reveals; clearly anyone who uses this invasive technique is counting on user ignorance.
   

In keeping with that second point, I'd like to point out the dishonesty of the researcher claiming this will help to be 'more responsive to customers' or whatever cant he used. Commercial web sites have already shown their utter unresponsiveness to customers. Even when a customer took the time to compose a detailed email explaining what was wrong with a site, it was either discarded or read with gales of laughter. I know because I was there. If web sites want to serve customers better, they could start by reading and responding to email. Second, watch the error log and fix bugs. Third, watch the access log and find 'dead ends' where people give up. There is no need to spy on customers.