Privacy News Web sites using JavaScript to capture data from forms before clicking submit

[SumG]

You might sign up for an account and find that the website requires some data to be submitted within a form, but you will think about the required information. Do you really want to tell this website how much you’re worth or how in debt you are? Then you change your mind and close the page before clicking the Submit button and agreeing to Quicken’s privacy policy.

Researchers have discovered that code from NaviStone used by hundreds of websites, invisibly capture each piece of information as you fill it out in a web form before you could hit ‘Send’ or ‘Submit.’

NaviStone® website visitor tracking technology is changing the way retail and eCommerce companies find new direct mail marketing prospects.

 

[ravi prakash saini]

why people on the wrong side of fence
are always more creative

 

[onreact]

Ouch. This is an awful privacy breach.

Is there a method or tool to find out whether a form is vulnerable to it?

Then you could test a form before even using it.

 

[BugCode]

Not surprise at all...
@ravi prakash saini , the "wrong side fence" is more exciting, [interesting] simple as that. So dudes when they nowadays born, they have in front of them everything "smart" this and that also... so it's obviously they not start training some type of exercise, like swimming, martial arts...when they start grown up. Yes, it has been since internet was "born".

And that site of fence are as you know so many "trusted" peoples/organisations etc.. Like in the "real life" so much everything dissension :/ Sadly religion is so huge % of what cause of that. That we all can read in newspaper and watch daily in news.

Oops, i go too deep with that, but so sad that's the way it is.... Maybe is my time to go nap

E: sorry for that.

 

[Winter Soldier]

Not surprise at all...
@ravi prakash saini , the "wrong side fence" is more exciting, [interesting] simple as that. So dudes when they nowadays born, they have in front of them everything "smart" this and that also... so it's obviously they not start training some type of exercise, like swimming, martial arts...when they start grown up. Yes, it has been since internet was "born".

And that site of fence are as you know so many "trusted" peoples/organisations etc.. Like in the "real life" so much everything dissension :/ Sadly religion is so huge % of what cause of that. That we all can read in newspaper and watch daily in news.

Oops, i go too deep with that, but so sad that's the way it is.... Maybe is my time to go nap

E: sorry for that.

Ah... the Dark Side of the Force

"Powerful you have become, Dooku... The Dark Side I feel in you."

 

[kamla5abi]

Ouch. This is an awful privacy breach.

Is there a method or tool to find out whether a form is vulnerable to it?

Then you could test a form before even using it.

http://gizmodo.com/before-you-hit-submit-this-company-has-already-logge-1795906081

this site shows u examples at the bottom
and how you can see for urself whats being done
but its not as simple as "put in website url somewhere to see if they are doing this"
But i'm sure theres a way to do something like that too

 

[_CyberGhosT_]

JS has become such an issue that I never allow it on most sites. I delete it off of my PC too after a clean install, have for quite some time.
Hopefully the word is getting out to site managers and owners to check for changes and suspicious activity.
Autofill password managers better be taking notice as well, you listening @LastPass @TrueKey lol

 

[Dean Winchestere]

Has anyone confirmed if scriptsafe, noscript can stop this attack? (Thank god I use it!)

 

[ant_gamal]

Anyway to stop this script

 

[_CyberGhosT_]

Has anyone confirmed if scriptsafe, noscript can stop this attack? (Thank god I use it!)

I employ NoScript, and have for ages, along with NetCraft, not sure though if NoScript blocks it.
I would imagine it does. I will do some digging.

 

[SHvFl]

I employ NoScript, and have for ages, along with NetCraft, not sure though if NoScript blocks it.
I would imagine it does. I will do some digging.

If the script is on the same domain and you whitelisted the site for it to work then script will run.

 

[Dean Winchestere]

Kapersky has "secure" keyboard input. Would that stop this type of js from keylogging?

 

[Danielx64]

Kapersky has "secure" keyboard input. Would that stop this type of js from keylogging?

prob not sadly.