Researchers from Princeton University’s Centre for Information Technology Policy (CITP) has discovered that 482 of the world’s top 50,000 sites as sorted by Alexa ranking, are running keylogger codes that are capable of recording everything that visitors are typing without their knowledge.
The researchers conducted their research by looking at seven of the most popular session replay companies on the market and testing their products on a series of test pages.
Keyloggers have been known for years, and have been synonymous with a result from pirated downloads and spyware that finds its way onto people's PC. But with technology and the internet reaching more people, keyloggers have being used in one of the most intrusive ways possible.
It shows that Wordpress.com, Microsoft.com, Adobe.com and Spotify.com all use these tracking scripts. The Telegraph website also has a tracking culprit along with BBC Good Food. But these sites haven’t been listed for doing more than simply using the software.
Webites that seem to actually record and send the data away to a third-party, include Russian search website Yandex, HP's website and others.
"Collection of page content by third-party replay scripts may cause sensitive information such as medical conditions, credit card details, and other personal information displayed on a page to leak to the third-party as part of the recording," the researchers wrote in their post.
With this capability, popular websites can know more about visitors, despite the visitors didn't want to share anything with them.
For example, be it a site search or text chat with an assistant. If users have started filling out a form with email addresses, phone numbers or personal details, but then decided to not follow through and navigate way, those websites already have the information they wanted.
According to those website, t's not actually their intention to obtain this information. Instead it's a direct consequence of using something called a "Session Replay Script". These web scripts are used to track engagement and help with UX design to inform site owners how they can improve a visitor’s journey through their website.
Unfortunately, these scripts are able to record practically everything and send them away to be analyzed.
But what makes this case worse is that the data can't "reasonably be expected to be kept anonymous".
