Hacker News Reader

Comment by beervirus | Hacker News Reader

Sounds creepy af. It's stuff like this that makes me keep javascript disabled whenever possible.

Naah, just install adnauseum [1] and thank advertisers for forcing you to use adblocker. Let them pay for all the manace they couse to you and help ad networks to build completely wrong profile on you.

[1] https://adnauseam.io/

Hehe yes since i installed adnauseum i love ad's...and i love that they have to pay for it, atm at 5732$ ;)

Make sure you keep all your software up to date. Malvertising is pretty common, and adnauseum does a great job at firing payloads on your machine.

It is the equivalent of installing an app that silently opens every attachment that is emailed to you.

They deny this, but I have no idea how accurate the denial is.

https://github.com/dhowe/AdNauseam/wiki/FAQ#does-adnauseams-...

Had the same idea, but my OS is so uncommon that malware probably does not exist (if it's not a targeted attack).

They should make it so that it talks to a VM (with no persistent storage) and sends the links to be opened to it (with the current browser's context such as cookies, etc so attribution still works).

It's also blocked by default by uBlock Origin, fortunately.

Funny you should say that, I just blacklisted hotjar this morning in noscript!

I think it goes so far as to be unethical, because it takes advantage of a gap in understanding[1] where most users aren't even aware of the possibility of this being possible.

[1] https://quinnkeast.com/writing/the-possibility-gap-its-time-...

On the one hand, I agree that the capability is concerning, but if it only records the behavior within a single visit and doesn't correlate it with an account, or across multiple visits, or across websites at all, I think that that probably wouldn't be much of an issue, for me at least.

However, I don't see a way to allow that without also making the aforementioned unwanted connections also possible.

Here's the documentation for passing a user identifier to Hotjar:

https://help.hotjar.com/hc/en-us/articles/360033640653-Ident...

This is a bit better than it used to be. At one point the documentation had a field for User Email Address, and only a footnote in some documentation suggested it be hashed. Still, for a company that chooses to use the feature, the session recording can be tied back to the user account and any data already associated with it.

thanks

Hashing email addresses doesn't really work. Most people don't use unique addresses per service and its easy to get a large list of email addresses that you can hash and do lookups in.

Reply on news.ycombinator.com