The Patriots

by Allen Williams

A few weeks ago, I decided to have a look at one of the web visitor data recording companies out there to see what kind of information they could collect.. Motherboard reports that a Princeton study revealed that over 400 companies (so far) record your every keystroke and them transmit it to a third party website.  

Typical companies providing this service are FullStory, SessionCam, SmartLook, UserReplay, etc.  I opted to try SmartLook simply because the ’geniuses’ at Webnode provided a convenient widget to insert their tracking code.

It just isn’t enough today that American Intelligence agencies are spying on everyone with their Prism software, but they are partnering with major business and social media like the CIA’s 600 million contract with Amazon .com  for cloud access.  We already know that Facebook and until recently Twitter provide information to the CIA.  The bad news here is that all purchases through Amazon are retained on their cloud servers and the CIA will have access.  You can be certain that any cloud service that your application communicates with will be available to the intelligence services as well as a host of unknown third parties because the data is NOT encrypted.

It’s far better to get the ‘mark’ to provide personalized data on him or herself to the tracking recorder thinking that he’s browsing anonymously or at least ignored  but “…many of these companies have dashboards where clients can playback the recordings they collect.   Yandex, Hotjar, and Smartlook’s dashboards run non-encrypted HTTP pages, rather than much more secure, encrypted HTTPS pages.”  The biggest liability is that once the data is removed from your site all control is lost, virtually anyone could have access to this data and you’d never know.

I was curious to find out just what could be collected by SmartLook.  However, I was surprised to find that the actual service is quite haphazard.  Either SmartLook is developing their recording software ‘on the fly’ as the saying goes or you really don’t get much on the ‘free’ side.  But upgrading the service means you’re paying to have your readers spied on.

Fortunately, the SmartLook collected data is not totally accurate or reliable.  Primarily because the staff is not well organized, knowledgeable or well versed in English.  After adding their code to The Patriot’s header and getting nothing, I contacted SmartLook support where a woman named Sofie informed me by email that  “In one case Only in webnode premium you can add code directly to the HTML header of the whole website.  In webnode free, you need to install the code in all pages you wish to track.”   Anyone, who is remotely conscious or understands the language, knows that free websites don’t have custom registered URLs as we do, ergo, we are a premium user!   So this individual is likely responding with canned phrases from the company’s data forum without any understanding of what was conveyed because they can’t communicate beyond an elementary level in English.

In another case, two different users known to me personally, one residing in Kansas and the other in Ohio accessed our site but showed the same IP address in the data collection set.  Upon questioning one of the support staff as to how this could happen, I was told that “The only explanation is that it was the same person and the two different names appeared because you have wrong code settings.”  The company’s help link indicates that if you want to track a particular user, you have to type their email address directly into the tracking code and they give an example case. The SmarLook tracking code is ‘paste-in’ and Webnode provides the widget access so unless you can’t type an address within the two apostrophe markers, you can’t have wrong code settings unless either SmartLook or Webnode made them.  

Individual email identification is no better as I have seen a whole day of data collection of 6 or more people with the same email but different IP addresses. Guess the user has multiple identities so he or she switches every couple of hours throughout the day.  The responses I’ve received from their support staff are disingenuous and you can’t really trust their assessments.

After some dickering back and forth with their support personnel to get things working the way SmartLook advertised,  I indeed found that I could watch a visitor enter our site and view virtually everything he or she clicked on.  This kind of information can and will be abused down the road and It's already happening as "The CBS report suggests in no uncertain terms that the personal information pertaining to millions of Americans collected by one of the World’s largest ad agencies is sold to the CIA." 

Smartlook claimed their software only retained three days worth of data but that’s because I wasn’t paying them to collect it.  Data was collected from approximately Nov 3^rd to Nov 24^th obviously more than 3 days. There was no data collected beyond Nov 24th, 2017 by their system even though I still had their code installed on the site for several more days.  At first, I thought it was yet another glitch but when nothing more was recorded, I removed the code.  On Nov. 27^th, all archived data subsequently disappeared from the SmartLook control panel or at least was interred somewhere where I couldn’t access it.  You can be reasonably certain that it’s still archived there even if I no longer have access to it.

UPDATE  12/12/17 Why Have you Stopped Using SmartLook?

A) Smartlook doesn't record my website properly
B) I don’t have time to watch the recordings / I find no added value in Smartlook
C) I just removed Smartlook temporarily - plan to use it again
D) I am missing feature X (please fill in)
E) Neither of those, let me tell you why...

I will be glad for any feedback, even if it's negative.

Best regards,

Vladimir Sandera
cofounder, optimist
Smartlook

I received this correspondence from one of the SmartLook co-founders in early December after removing their code from our header.  Why was this an issue? Could it be that they wanted me to leave the code installed to keep recording visitor data whether or not I chose to use it?

Update 1/24/2018

 “We're excited to tell you we're migrating all our data to more powerful cloud service (AWS)! Your account included. The process is time-intensive, but we're working hard to complete the migration by the end of next week.

While the long-term benefits will be great, we wanted to let you know you might experience a few bumps and minor interruptions along the way. (Might.)

The good news:

• AWS provides us with more safety, stability, and speed
• Your data will be better serviced and stored securely
• Smartlook features will run faster
• This migration is a lot of work, and we appreciate your patience during the next few days while we finish up”

Your Smartlook Team

Long term benefits for whom? This move simply presents more opportunities for data to be accessed by more persons unknown as it’s unlikely that Smarlook’s new AWS storage is any more secure than Yahoo who experienced a major hack. 

I recommend readers give serious consideration to a good AD blocker:  “If you want to block session replay scripts, popular ad-blocking tool AdBlock Plus will now protect you against all of the ones documented in the Princeton study.”