Browser Spyware: Watching Where You Linger

An Anonymous Coward writes: "Just when you you'd installed Junkbuster and thought it was safe to go back onto the web, the BBC runs this story which tells you that webshites will soon(?) be able to tell whether you are reading the page, what parts of it are of interest to you, etc. Guess we can expect porn sites to be the first to take advantage of this." Or perhaps someone else is already doing this, and hasn't told you.

Comments

marketing

[Spagornasm]

Get ready for the "marketing geniuses" to take advantage of this...by having new windows pop up right when you move your mouse to the back button...

Anyone else up for using keyboard shortcuts now?

What matters is who they tell,

[firewort]

What matters here is who they tell, and who they sell it to.

I can't stop them from tracking (yet.) I do turn off all activeX, ask on cookies, no scripting, etc... but if they can get around my disabled browsing habits, then what matters is who they tell.

Time to go back to safeweb, as well.

Deus Ex

[FortKnox]

Or perhaps someone else is already doing this, and hasn't told you.

Somebody was up late playing Deus Ex last night, right timothy??

Is it just me or is the web becoming too annoying

[smartin]

I wish sites would realize that pissing off their viewers with popups and big honking ads, does not make the viewer more likely to visit the advertisers site or buy their product. It has quite the opposite effect. I've stopped going to some sites that I like for the simple reason that I really F*ing hate popups!

Use smart settings to avoid this:

[hardaker]

If you carefully configure your web browser I would think you could avoid being tracked:

• Turn off javascript support. This is likely how their doing their "what part of the page you're looking at" tricks (watching the scrollbar usage).
  
• Don't accept cookies. Don't go to sites that force you to accept them.
  
• Turn off auto-loading of images. This is the one that no-one does, but with the increasing frequency of single pixel tracking images, it might be a wise thing to do. Junkbuster is certainly a good alternative, but it won't catch everything.
  
• Konqueror has the ability to change your user agent. It'd be cool to write a "random" mode to it where it randomly selected from it's list of user agents to send to the remote site ;-)
  

Re:Use smart settings to avoid this:

[Grishnakh]

It seems like it'd be a good idea if Konqueror added an option to ignore single-pixel tracking images... should we submit this to bugs.kde.org?

Re:Use smart settings to avoid this:

[UM_Maverick]

have you actually used the web lately? Your ideas are great in theory, but in practice they take you back about 6 years. E-commerce goes out the window w/out cookies. Many sites become unusable w/out javascript (Not just sites that do "onclick=location.href", but there are many sites that actually use javascript *well*). Turning off images means that you won't see half of most sites...and the list goes on...

Now I know what you're going to say: "If site X won't let me browse my way, then I don't need site X". Well, damn near every site out there is becoming site X. Whether you like it or not, that's the way the world is moving, and you can either accept their way of doing things, or stay in 1995.

Hmm...just re-read that, and it sounds like a flame...I really didn't intend it to be...just meant it to be more of a wake-up call.

Re:Use smart settings to avoid this:

[hardaker]

• It seems like it'd be a good idea if Konqueror added an option to ignore single-pixel tracking images... should we submit this to bugs.kde.org?

It's a good point, however I don't think it'll help. Many sites are finding otherways of getting around that like using forms parameters within the URL itself. Eventually they'll get intelligent and name the larger images with a tracker extension, but still return the same image. IE, src="logo.jpg-234987575" and merely have their nifty web server strip the extension off (and use it) before returning the image to the caller. You don't need 1x1 imagse when you can use real images.

Re:Use smart settings to avoid this:

[cyberdonny]

have you actually used the web lately? Your ideas are great in theory, but in practice they take you back about 6 years. E-commerce goes out the window w/out cookies. Many sites become unusable w/out javascript (Not just sites that do "onclick=location.href", ...

Actually, I usually surf with javascript turned off, and the sites where this causes problems can be counted on the fingers of one hand. And for those rare sites I have the choice of

• not there going again
• just allowing those sites in my konqueror browser's javascript ACL.

Of course, if you're in the habit of surfing to porn sites, you might be somewhat more dependant on javascript...

...but there are many sites that actually use javascript *well*).

Actually, using javascript well should mean to not make an obligation out of it, but to use it solely to provide additional and optional functionality. The site should still stay useable even if the user doesn't want or isn't able to use javascript. You know, blind people who are bound to surf using lynx (because their braille lines, or text-to-speech engines only support text browsers) cannot just turn on javascript, even if they wanted!

Re:Use smart settings to avoid this:

[mosch]

No, because single pixel gifs have legitimate purposes too. Not to mention the fact that any image can be a "tracking" image.

Example: Let's say you want to draw a horizontal bar with a rounded edge, ala slashdot. You can make an image that has the rounded edge, then a seperate image that's simply a one pixel gif of the same color, that you then stretch by using height and width attributes on the img tag.

This will prevent the color differences between the two images, as they'll both be using the same graphics library to display. This however also minimizes download time, because all you really need to make a colored bar is one pixel of the exact color you want.

Be less paranoid.

Re:Use smart settings to avoid this:

[Ed Avis]

We really need a browser that lets you *selectively* disable Javascript. I think the default setting should be to have JS turned on, but with a few particularly obnoxious features (popping up new windows, adding hooks to the scrollbar or mouse movement) turned off. You should be able to adjust these preferences on a site-by-site basis.

Online molesters are targetting OUR KIDS!

[BillyGoatThree]

For crying out loud, /., lighten up. Remember back in '95 when you couldn't turn on the TV or read a news magazine without some lame story about online stalking or pedophiles in chatrooms? And we all mocked them by saying "that's no different than real-life, what's all the hullabaloo"?

"Brick and mortar" stores do exactly this same thing. Many have cameras, the rest use "secret shoppers" (people who look like they are shopping but are really watching YOU) to discourage shoplifting, check competitor prices AND research in-store "migratory patterns". For instance, haven't you ever noticed that ALL grocery stores have the fresh fruits and vegetables right by the door?

This isn't "Your Rights Online". This is "Translating Nothing Cares About In RealLife Into A Scare Story About 'The Net' In Order To Attract Eyeballs To Slashdot."

"Cheese"?

[Anoriymous Coward]

The system developed by the team at MIT is called Cheese, since they are following the mouse, like a mouse follows cheese.

Wouldn't a better title have been "Cat"? Or perhaps "Rodent Stalker"?

Eh?

[stripes]

"I can tell because when you read a webpage, you do one of a couple of things. You either shovel the mouse off to the right so that it is out of the way, or you will walk down the page with your mouse," he told the BBC's Go Digital programme.

Yeah....or I'm one of the 5% of the computer market with a Mac and I'm one of the 90% of Mac users that have discovered that when I type the mouse goes away. So I press down arrow and *poof* I don't need to move the mouse out of the way, and my finger is right where I need it to scroll down to read more of the story.

(Or I could turn off JavaScript, which is a good idea because it gets rid of a lot of irritating popup and popunder ads -- which is a pretty good idea, even 'tho it breaks a few sites)

Re:Is it just me or is the web becoming too annoyi

[Greyfox]

Konqueror and Mozilla both allow you to disable popups while allowing JavaScript to run. I believe that at least Konqueror and possibly Mozilla as well will allow you disable or enable features on a site by site basis. The web has become a whole lot less obnoxious since I set Mozilla up to disable popups and animation. I highly recommend running a browser that will let you do this. Mozilla is now fast enough that I can actually tolerate using it and has been since a CVS build about a month and a half ago.

Enough...

[Ronin Developer]

First spyware and then web bugs. What needs to happen is that the public has to say "Enough is Enough" and not use products or services that violate their privacy or utilize these types of tools.

Unfortunately, the average person takes what is available to them simply because of the convienience of doing so. Apathy sucks, doesn't it.

Anybody up to writing an HTTP proxy or filter that strips out this info as it is being returned to the offending site? I guess it should then redirect the user to a site informing them of what has or was about to happened. Maybe the internet community should develop an RBL-like list for websites that pull this stunt? Anyone up for an RFC?

Here's a thought...remember Dr. Hawking's fear that machines may someday subjugate us? Image a concious website that maniputes us into doing whatever it wants us to do or believe. Damn...my computer is calling me again....

Re:What's so bad about direct marketing?

[UberOogie]

Personally, if companies can direct moderate amounts...

Stop right there, because that's your answer. It will never be moderate. As soon as they can, it is in the marketers best interest to get as much advertising to you as they can in the shortest amount of time, and the more they know, the more they will.

It is sad, but in the future, we'll probably look back fondly on things like PeoplePC which gave only one advertiser the keys to the car...

Reading the article

[daviddennis]

While reading the article, I left the mouse in the main browser window and used the keyboard to scroll. So if their system was used, it would make it appear that I was not reading the article, even though I did in fact read it.

Really, if you stay on a page for more than a few seconds, you're probably reading it. And that would surely be simple enough to determine, although you'd have to figure out a bulletproof way to put up an invisible frame in order to send the information to the mother ship. It would probably be easiest done in Java, which can do that without pulling up a web page, but many people have non-working Java, so even that's not foolproof.

Unfortunately for the people who created this model, once people become aware of how it works, it will no longer function. People who would formerly hover the mouse over a link would simply refrain from doing so and therefore give the system no useful data. I also suspect individual personal styles are going to be different enough to stymie them in the end. I am not convinced that people only visit links directly if they have been to the site before, for example.

For the person who said a scroll mouse would defeat this system, I'm sure signals from the scroll wheel can be read as well.

When I am hesitating between multiple items, I will often put them in my cart, look at the total and then remove the one that makes the total too high, or that I'm unsure about. Anything I put in my cart and took out, and any abandoned shopping cart contents, would be a ripe selling weapon that can already be used without relying on this technique.

I think this one's too flaky for practical use. But as always, we'll see.

D

I don't get this...

[update()]

The story is interesting, and but the description of it here seems so far off that I briefly wondered if I'd hit the wrong link.

Look, since day one of the commercial web, sites have obsessively tracked how many hits they get, where they're coming from, how a user moves through the pages, where they spend time and how often they return. (As if Andover/OSDN isn't doing all of those things -- or is this like with web bugs where we're just supposed to care about them on other sites?) That's one of the great edges the net was going to have over other media. To the degree that people are bothered by that and to the degree that they're technically sophisticated, they turned off cookies and otherwise interfered. And what does Junkbuster have to do with anything?

What this seems to be is an incremental advance in tracking how pages are read -- there's a little added feedback about mouse movements and maybe scrolling. As always, if this takes off it will be trivial to block for those who know and care about such things. And everyone else has far more important privacy invasion being done to them.

Weaknesses in the Theory

[martyb]

Though what they propose probably has some application to the majority of users, I'm just as sure there are others who would not fit their expectations:

• Keyboard-centric:Though most users primarily use a mouse, I've found in many cases it is much faster for me to keep my hands on the keyboard and navigate with page-up/page-down and cursor keys. Menu navigation can be much quicker too as I can make choices with keyboard shortcuts and mnemonics without first having to wait for each menu and submenu to paint.
  
• Large display: Use a 21" monitor running at 1600 x 1200. That means there are many pages where there's no need to scroll; and those that need it, well, just use the page-down or arrow keys.
  
• Touch screens There's no "hovering" or mouse trail; just TAP and you are there, with no record of any "path" across the screen. This will become more prevalent with PDAs.
  

Besides, cheese is often placed in a mousetrap. This kind of technology feels like users are the ones being tempted by the cheese; what kind of trap are we getting into?

Re:Sinister...

[ptgThug]

I was thinking the same thing, how can they do this since web browsing involves stateless, connectoinless technologies.

So I thought about it, and here is a possiblity:

If a JavaScript or a Java applet can subtly catch your mouse movements, then they can be imbedded in hidden inputs on the web page. Every link on that page fires off a JavaScript which will submit the form and then redirect you to which ever page you requested. The mouse movement data can only be reported if you select another page.

In all honesty, paying attention to your actions is the same thing any brick and mortar shop owner can do why watching you walk down the aisles. When stores were smaller and people friendlier, shop owners made it their job to remember your name, your family, and your preferences (The usual, Mr Smith?). What this technology is trying to do is no different than that, it is just not always being done by not-so-friendly people.

Excite may already be doing this

[Compulawyer]

I have noticed that when I log into Excite, some pages I view have been loading a 1 X 1 Applet that is transmitting information (at least time spent on the page) back to servers. As far as I am concerned the only uses for a 1 X 1 ANYTHING on a web page are no good.

I have not yet grabbed the applet and tried to decompile it (mostly for lack of time), so I do not know exactly what it is doing in addition to sending time information, but it struck me as extremely obnoxious.

I am stuck using Win98 and Netscape 4.7 at work, so I cannot use a more enlightened browser that selectively grants/denies JavaScript and Java access by domain name. So...I am stuck being watched to a certain extent.

Is it just me or is anyone else sick and tired of being treated like some company's asset? I am tired of the companies I deal with trying to suck every possible dime out of the relationship they have with me -- ESPECIALLY when it comes to selling my personal information.

Re:marketing - how's this for annoying

[marcop]

check out the Majestic game advert at: http://www.scifi.com/farscape/ . Looks like what you mention is not too far away!

Re:Client side cooperation required

[stikves]

No it is not necessary. The site can have two "frames". One of them would be the main frame filling the entire window, the other will be the tracking frame, which is insivible (or 1 pixel high).

Then the javascript code in the main window will fill a string with your mouse movement like:

(100,100)-(110,100)-(110,109)-...

After the buffer is filled enough, it will update the hidden frame with a code like:

TrackerFrame.URL = "http://server/track.cgi?" + str;

That's it. That's all. Your tracking is complete.

It would be nice to know....

[pjrc]

... as the author of a modestly-sized website (about 100 pages), it would be nice to know which parts people are actually reading. Actually, what I've often wanted to know is what parts confuse my readers and where they need more help. Sometimes I get this via email questions, but still it's very hard to know what to do to improve specific parts of the site.

Of course, there probably would be abuses of privacy by "marketing firms", but in the case of website that actually try to provide really useful information, this sort of feedback could really help direct the very limited time and effort towards improving the parts of the site that really need it. In my own case, it's often the classic example of a long-time expert not being able to identify with the pains of brand new users.

Of course, there is the traditional usability study approach. Maybe someday I'll spend some money and do it.

Re:Sinister...

[Isofarro]

If a JavaScript or a Java applet can subtly catch your mouse movements, then they can be imbedded in hidden inputs on the web page

No ifs about it. Javascript has quite a number of mouse dependant event-handlers, onMouseOver, onMouseOut, onMove, onClick, onMouseDown, onMouseUp.

Getting the details back to the server is even easier, just condense mousemovements into a bunch of characters (like Logo commands), stick them into a query string.

Now use a hidden image (a transparent 1x1 gif), useing javascript you can change this object on the fly - change the src attribute of that image to a cgi script, with the query string attached, plus a timestamp (making the url unique, thus not cached). The cgi-script then stores/analyses/ignores the data presented, and returns a status 204 - No change.

Its too simple, really.

On the plus side, hopefully it will convince more and more people to disable Javascript - and then boycott any websites that rely/insist on having it enabled. There's enough sites out there as competition to safely avoid intrusive websites - if not, then there's a niche market you can join.

Oh brother ...

[Christianfreak]

Typical /. "Big brother is watching us" paranoia. Come on! Did no one read the article? Some interesting points about it:

• No client software required: In other words its a stupid Javascript. Translation you can turn it off
• They only tested 17 people. Translation either the MIT student doing this is an idiot or the BBC article is hype. I vote for "C" both.

This is not Your Rights Online nor is it news. Lets go back to bashing M$oft.

Rant Mode OFF.

The bread, milk, and fresh fruits are scattered.

[laetus]

Just because a store researches something doesn't mean they're going to make the shopping experience better for the consumer.

Case in point: The grocery store you referenced. Haven't YOU ever noticed that the dairy, bread, and fresh vegetables/fruits are scattered at different corners of the store.

And you know why, to make you wander the other aisles to get you to buy crap you didn't originally walk in to get.

Re:Is it just me or is the web becoming too annoyi

[wurp]

Mozilla definitely does allow you to disable popups. See http://www.mozilla.org/projects/security/component s/configPolicy.html

Even more off-topic:
Does anyone know how to make Mozilla lie about what User-Agent it is? My bank software rejects Mozilla, claiming it's not compatible. I'm pretty sure it is, and I want to try to make Mozilla claim to be IE on that domain.

Several answers

[Croaker]

I have a mutli-level armored approach to browsing:

1. I installed Bugnosis which is designed specifically to deal with single pixels images that might be web bugs.
2. I use Proxomitron to do Javascript filtering. It cuts out the worst examples of Javascript annoyances (popups, leaving the page triggers, etc.) The filters are editable, so you can customize them yourself to filter out things like this spy script.
3. I route everything through Junkbuster, which gets rid of the ads that Proxomitron misses.

All of the above besides Junkbuster are Windows-only. The first one is specific to IE, but I end up using that anyhow, since it's the most stable Windows browser.

I can browse most sites that don't do stupid shit like refuse to serve pages to me if they cannot detect my browser (in which case, they are probably crap, anyhow). For shopping sites, I can just add the site to Junkbuster, or bypass the protection through Proxomitron. I am pop-up ad free, and I give out minimal information about myself. The other better way of browsing I could see would be to use an anonymous proxy, which would protect my IP addess.

Of course, this would bet better implemented via the browser. I was using Konqueror a lot at home under Linux, but it began crashing too much for my tastes. There, I've just stuck to using Mozilla with Junkbuster. Javascripts still sometimes get through, though.

Re:Is it just me or is the web becoming too annoyi

[iso]

On the topic of pop-ups, I've read through the page you cited, but I still have one more question: does Mozilla have the ability to enable pop-ups only from clicking on a link? Disabling pop-ups entirely is irritating as many genuinly useful sites use pop-ups when a link is clicked. It seems that the Mozilla solution is to add each legitimate site by hand; hardly an optimal solution.

FWIW, OmniWeb has this feature.

- j

Re:Is it just me or is the web becoming too annoyi

[niteshad]

I hate commercials on TV, but they have to pay for the content. Therefore, I stopped watching, but I don't complain about it - there's no point. Who likes popups? You could use technology to circumvent them, but this is unethical at best.

Unethical? What about the fact that I'm the one paying to download their advertisement? Since I'm the one paying for my connection to the Internet, and all of the traffic on that connection, I have the right to decide what content is appropriate on that connection. If I decide to block useless ads and popups that's entirely my right.

In general, I think that companies which try all of these very annoying advertising strategies are ultimately wasting their time and money. They should go read the Cluetrain Manifesto and get a clue.

It's all in the logs.

[malkavian]

Well, one thing that strikes me about this is:

For all this data collected from all the surfers to a busy site, where on earth are they going to store it all for any length of time??

I work for a company with a sizable web traffic (250 million pageviews/month). The bane of my life is the logs. Processing them, and storing them for the length of time to draw meaningful trends takes a huge amount of space. All of which needs to be on a RAID, just in case..
Then, of course, there's the software to mine this collection of data, the amount of time required to search the disks for the relevant data, and the setting of the resolution of the data capture from the mouse (needs to be pretty fine resolution to achieve any meaningful results)...
Just think, if they adopted this scheme, it'd be great fun to write a device driver for a pseudomouse that sat the cursor over the web browser, and randomly moved it around, generating millions of data events, all of which get logged on the web site archives...
It's fine to do this for a small scale site, with plenty of funding, but I think there'd be huge problems with the sheer logistics of collecting and analysing this data for anyone without almost bottomless pockets as far as funding goes...
Personally, I don't reckon this will be a big brother tech anytime in the near future...

Cheers,

Malk

Re:It's all in the logs.

[markmoss]

For all this data collected from all the surfers to a busy site, where on earth are they going to store it all for any length of time??

Duh. Most of the posts crying "invasion of privacy" have been far off the mark. This isn't technology for tracking individual users -- maybe it could do that, but recording every mouse movement individually would overload most servers. It's an attempt to collect stats on what parts of the page draws attention. Occasionally someone would use that to improve their web site. Mostly, advertisers are going to try to use it to find out if anyone even _looks_ at their ad. I don't think tracking mouse movements will do that too well, but in the absence of equipment to spot where your eyes are looking, they'll record the mouse movements and try to deduce something, then some dumb suits in marketing will take this faulty data as gospel.

And the real problem arises if this is actually accurate enough to reveal that no one looks at the ads... The first generation of spyware revealed that no one clicks on banner ads -- and millions of $ were pulled out of internet web sites and put into TV and magazine ads instead. No one looks at those either, but there is no way of showing just _how much_ we don't look at them. Improve the tools for measuring user interest in ads, and you are going to lose even more ad $...