The code that watches every word you type

Abstract

We have long known that information we provide online can be tracked. Scripts running on websites deposit cookies or track you to other sites. But these seem tame compared with what Steven Englehardt at Princeton University and his colleagues found after combing through hundreds of websites to examine the scripts they run: the widespread use of a type of script called a session replay, which logs everything you do on a website, including what you type before you hit enter. It then sends this information to the third party that has placed the script there. This can bypass traditional privacy measures like https, as while your connection to the site is secure, the third parties have been pre-authorized by the site to watch you there, and how they send the information they glean isn't guaranteed to be private.