How sites steal your personal data from you.

[DronVR]

How sites steal your personal data from you.

In this article I want to talk about the fact that most sites collect all the information about you during your stay on the pages.

Each keystroke, entered data, etc., all this is recorded and can be played.

Approximately 500 sites from the top Alexa use so-called scripts (session replay scripts). A complete list can be seen on this the link . Such tools were developed to better understand user behavior on the site. But their functionality allows you to play the session on the site and analyze every click, transitions, etc.

Such methods are used absolutely secretly and you may not even notice how all your data falls into the right hands. Such data may be sold or used for a targeted attack. For example, such scripts can easily pull out a bank card number, month and year of expiration of the card, as well as other information that was used on the page. This is especially interesting on sites with registration forms, etc.

Example replay script
Among the most intrusive and anti-user replay scripts, solutions from FullStory, Hotjar, Yandex and Smartlook are distinguished. These companies "wind up" all the information, including name, mail, phone number, social security number, and passwords. The last 4 digits of bank cards are also recorded. Additionally, you can see on the video how the applications from FullStory work. You can monitor users even in real time.

FullStory Work​

In addition, with the help of such solutions, owners can configure them in more detail, so you can add additional filters to obtain information. It should be noted that Yandex, Hotjar and Smartlook use unprotected HTTP to transfer data.

Such surveillance can be seen on sites, microsoft.com, adobe.com or godaddy.com, but also on sites from which this is not to be expected. For example, walgreens.com was convicted of collecting visitors' medical information and even “recording” prescription data (and then transferring this data to FullStory). Another example, the website of Bonobos, which "leaked" the full numbers of visitors' bank cards, also in favor of FullStory.

How can I protect myself from tracking?
To do this, use the Ghostery utility. It is installed as a utility in the Chrome or FireFox browser.

Ghostery​

Ghostery monitors the “invisible” side of the Internet, where spies, network bugs, pixels and beacons work on advertising sites, behavioral information providers, website owners and various companies that monitor your activity on the Internet. Ghostery recognizes web bugs from more than 500 similar companies, including Facebook and Google.

The program has very flexible settings and you can open the panel and see which trackers can be separately blocked.

Ghostery highlights the main areas:

Advertising. Site analytics. Interaction with customers. Social networks. The important thing. Audio / video player. Ad for adults. Comments
To begin, I recommend blocking all items, and then adapt and add some sites to white lists or disable certain groups of trackers that are necessary for working on some sites.

After setting up, go to adobe.com. And you can immediately see how the program blocked access to some trackers. This can be seen in the screenshot.

Ghostery​

It should be noted that you can select the trust mode and then the program will not block and restrict access. You can also stop the program. In addition, everything is absolutely accurately displayed and shown from which category a particular "bug" was blocked.

Conclusion
With the help of this software you can go over any of your sites and find out how much everything is collected about you. Therefore, this software is a fairly simple and good solution that can protect against tracking and receiving data through different platforms and javascript backdors.

Source @Kevin Mitnick

 

[НСК-СБ]

How can I protect myself from tracking?
To do this, use the Ghostery utility.

Thanks for the advice, installed just in case, although there is another protection.