I told a friend about my start up and she jumped on it immediately. I opened the tool and watched her interaction. Then I told her "oh so you opened the dev tools" She immediately ended the session. "How did you know? That's creepy". It was the first time I've actually felt like these tools invade privacy.
Yeah, we include it in our terms and condition and privacy page, but I don't think users truly grasp how those tools work. I understand that all analytics tools provide this feature now, but its always creepy to know someone can watch what you are doing.
It's things like hiding your online activity from your partner / boss / parent / ex, making sure nobody knows you just went to a gay club, hiding the fact that you're playing video games from that one guy you don't actually want to play with, not giving out your phone number to the parents of your students, that sort of thing.
For most people, E2E and VPNs are useless gimmicks that just make life unnecessarily difficult, but vanishing messages and incognito mode are life-saving features.
For the majority of people I don’t think it’s true that they don’t care, but rather that they don’t know, don’t understand the implications, or don’t have the luxury of being able to do anything about it.
In the instances where I was able to have a longer discussion with someone to really explain what’s going on, they did care. Even if they previously said they didn’t.
the people doing the "analytics" (surveillance) like their privacy too, because they are doing creepy stuff and don't want people to know it. And even if they aren't doing creepy stuff, the data might be used that way in the future (profile building, psychological tricks, personalized pricing, sharing behavior with others, etc)
Since you did collect the metrics, you had direct knowledge of how many users opened the T&C and scrolled down to the place where you mention you're recording their session.
Would be interesting if you can share an aggregate statistic of that.
Everyone understands websites use analytics and tracking, but people dont want to be reminded of it. Which is why people hate those FB ads which exactly match what you searched for 24 hours ago.
People don't want it to be misused is the actual point.
Please be honest with yourself. People don't read terms and conditions. There's a good chance you don't read terms and conditions. And even if you do, odds are better than even that you don't fully understand all the legal implications.
Terms and conditions pages nowadays are there mostly to provide legal protection under the guise of "the user told us that they read these by ticking a box on our signup page; it's hardly our fault if they didn't."
Nobody reads that stuff.
If you have only the event, you can basically re-create a playback of that action if you want.
Now, if you track all actions of interest, than that's basically almost the same as a full session recording.
(It might not work on touch screens.)
the capability is there, your local hardware determines how seamless it would be.
Mental framing of a tech is weird.
for (let i = 0; i < 1000; i++) { document.querySelector(".button")?.click(); }
ETA: It also took a few seconds to get around to telling me (from the bottom up):
Subject has clicked on the button a thousand times.
Subject has clicked on the button one hundred times.
Subject clicks less than most other subjects.
Subject has run script to click on the button ten times within one second.
Subject has clicked on the button nine times within one second.
Subject has clicked on the button eight times within one second.
[0]: https://developer.mozilla.org/en-US/docs/Web/API/Event/isTru...
"What's the point?" she asked.
I said, "You can click it."
"But what's the big deal?" she was baffled.
"You can click it,“ I said.
“That's the big deal."
>In the main engineering room, there was a whoop and cry of success.
>Our company financial controller and acting HR lady, Jen, came in to see what incredible things the engineers and artists had come up with. Everyone was staring at a television set hooked up to a development box for the Sony Playstation. There, on the screen, against a single-color background, was a black triangle.
>“It’s a black triangle,” she said in an amused but sarcastic voice. One of the engine programmers tried to explain, but she shook her head and went back to her office. I could almost hear her thoughts… “We’ve got ten months to deliver two games to Sony, and they are cheering over a black triangle? THAT took them nearly a month to develop?”
Where you're just sitting there clicking over and over
Apps know when we’re on WiFi, when we force quit, have potential to have motion sensor access if opting in…
Not sure the presentation needed for acceptance into the App Store. As a security checkup tool or something…
or ist it more of an ö? (im German btw but can also definitely spot a dutch English speaker :) best way to tell is to have them say "I have an idea!"
In my case, though, after carefully enabling only scripts from the site and the Cloudflare CDN, but not enabling XHR/websockets back to the source page, or any cookies, the only thing that happens for me is:
1. I see a button and an exhortation to click the button.
2. I click the button.
3. The site goes "Subject has clicked the button."
4. The site goes "...".
...and then nothing else happens, no matter where I click or move my mouse. In the background I can see attempted websocket connections, but I'm blocking those so they can't happen.
If the aim of the game is to open people's eyes to the dangers of online tracking, it feels like there should be a reward mechanism if such tracking is blocked!
Click (2016) - https://news.ycombinator.com/item?id=35841679 - May 2023 (35 comments)
Click - https://news.ycombinator.com/item?id=26518290 - March 2021 (243 comments)
Click click click - A browser-based game on online profiling. - https://news.ycombinator.com/item?id=18636038 - Dec 2018 (1 comment)
A demonstration of browser events used to monitor online behaviour - https://news.ycombinator.com/item?id=12985644 - Nov 2016 (165 comments)
http://cdnjs.cloudflare.com/ajax/libs/gsap/1.18.0/TweenMax.m...
Some of the Javascript is served via plain HTTP as well as HTTPS
https://clickclickclick.click/bundle.js
This is 14 MB of Javascript
Using HTTP/1.1, the norm in 2016, I counted 233 chunks
Might as well just ask the user to download a 15 MB executable, e.g., a "game", and run it
Developers often refer to this idea of the "browser sandbox" but there are lots of things that are permitted inside this "sandbox" that some users would consider part of their "threat model"
For example, gratuitous data collection, surveillance and advertising
Thinking of input as a series of discrete events is an interesting cognitive model that many experienced programmers take for granted!
Some of my favorite projects:
https://studiomoniker.com/projects/radio-garden
Presumably it's a simple matter to send something back to a server, but I've really never thought about the mechanisms involved.