DREAM / The Prime Minister resigns and wakes up under the Parisian bridge!

 Kliko këtu për të tjera
Voxpress:

Careful! Thousands of websites look at what you type before you press 'Enter'

2022-05-12 10:45:13Lifestyle SHKRUAR NGA REDAKSIA VOX
Careful! Thousands of websites look at what you type before you press
Illustrative photo

When you sign up for an online newsletter, make a hotel reservation, or browse online, you probably take it for granted that if you mistype your email address three times or change your mind, it does not matter. Actually nothing happens until you press the Submit button, right? Well, maybe not. As with so many assumptions about the web, this is not always the case, according to new research: A staggering number of websites are collecting some or all of your data as you type it into digital form.

Researchers from KU Leuven, Radboud University and the University of Lausanne analyzed the top 100,000 websites, looking at scenarios in which a user is visiting a site while in the European Union and is visiting a site from the United States. They found that 1,844 websites collected the email address of an EU user without their consent, and a large number of 2,950 registered the email of an American user on a form. Many of the sites apparently do not intend to perform data entry, but include third-party marketing and analytics services that cause the behavior.

After specifically crawling pages for password leaks in May 2021, researchers also found 52 websites in which third parties, including Russian tech giant Yandex, were collecting password data before submission. The group uncovered their findings in these locations, and all 52 cases have been resolved since then.

"If there is a Submit button on a form, the reasonable expectation is that it will do something that will submit your data when you click it," says Güneş Acar, a professor and researcher in Radboud University's digital security group and a by study leaders. "We were super surprised by these results. We thought we might find a few hundred websites where your email is collected before you submit, but that has exceeded our expectations so far. ”

The researchers, who will present their findings at the Usenix security conference in August, say they were inspired to investigate what they call "forms derived" from media reports, particularly from Gizmodo, about third-party collect form data regardless of submission status. They point out that, at its core, the behavior is similar to so-called key loggers, who are usually malicious programs that record everything that targets. But on a 1000-page homepage, users will probably not expect their information to be recorded. And in practice, researchers saw some behavioral variations. Some sites recorded keystroke data, but many received full submissions from one field when users clicked on another.

"In some cases, when you click on the next field, they collect the previous one, like you click on the password field and they collect the email, or just click anywhere and they collect all the information at once," says Asuman Senol, an identity researcher at KU Leuven and one of the study co-authors. "We did not expect to find thousands of websites; and in the US, the figures are really high, which is interesting.

Researchers say regional differences may be linked to companies that are more cautious about tracking users and even potentially integrating with fewer third parties, due to the EU's General Data Protection Regulation. But they point out that this is only a possibility, and the study did not examine the explanations for the inequality.

"Through a considerable effort to inform websites and third parties that collect data in this way, the researchers found that an explanation for some of the unexpected data collection may have to do with the challenge of differentiating an action." submit ”from other actions of users on certain web. But researchers point out that from a privacy perspective, this is not an adequate justification.

Since the completion of their work, the group also had a discovery about Meta Pixel and TikTok Pixel, invisible marketing trackers that embed services on their websites to track users across the web and display those ads.

Both claimed in their documentation that a customer could activate "advanced automatic matching", which would trigger data collection when a user submits a form. In practice, however, the researchers found that these tracking pixels were capturing hacked email addresses, a obscure version of email addresses used to identify web users across platforms, before submission. For US users, 8,438 sites may have leaked data to Meta, Facebook's parent company, through pixels, and 7,379 sites may have been leaked to EU users. For TikTok Pixel, the group found 154 sites for US users and 147 for EU users.

Investigators filed a bug report with Meta on March 25, and the company quickly hired an engineer for the case, but the group has not heard an update since. The researchers reported TikTok on April 21 - they discovered TikTok behavior recently - and have not heard from it.

"Privacy risks for users are that they will be tracked even more efficiently; "They can be tracked on different websites, in different sessions, on mobile and desktop," says Acar. "An email address is such a useful identifier for tracking because it is global, unique, constant. You can not clean it just as you clean custom files. It's a very powerful identifier. "

Acar also points out that as tech companies try to break away from cookie-based tracking, addressing privacy concerns, merchants and other analysts will increasingly rely on static IDs like phone numbers and email addresses. .

Since the findings show that deleting data on a pre-submission form may not be enough to protect against all collections, the researchers created a Firefox add-on called LeakInspector to detect fraudulent form collection. And they say they hope their findings will raise awareness of the issue, not just for regular web users, but for website developers and administrators who can proactively check if their systems or any of the third parties using are collecting data from the forms without consent.

Leaked forms are just one more type of data collection to take care of in an already extremely crowded area online.


Në përputhje me standarded JTI

Video

SHIKO KANALIN NE YOUTUBE
×