Interesting Findings:

1) "when a user clicks on a link, there is a clear visual cue that information is being
sent over the network – the target of the link will know that the user has clicked.

However, when we list clicking as being tracked covertly, we mean that there is an additional event-handler that tracks the click, and sends information about the click to another server. google is known for doing this: when a user clicks on a link on the search page, the click is recorded by google through an event handler, without any visual cue that this is happening"

2) Of the 115 sites on which the filtered flow were reported, we found that 7 used a behavior tracking software product developed by tynt to track what is copied off the sites.

3) "While investigating several sites that installed event handlers, we also found that the huffingtonpost site exhibits suspicious behavior."

Interesting find. 1% of the 50K most visited sites. Clickileaks, anyone?

An Empirical Study of Privacy-Violating Information Flows in JavaScript Web Applications

[cseweb.ucsd.edu...]

While investigating several sites that installed event handlers, we also found that the huffingtonpost.com site exhibits suspicious behavior. In particular, every article on the site's front page has an onmouse-over event handler. These handlers collect in a global data structure information about what articles the mouse passes over. We consider this case to be suspicious because not only is the infrastructure present, but it in fact collects the information locally.

And Smart Phones?

With a few mouse event handlers and a little AJAX, recording behaviour of users on your page is trivial. Testing a given list of sites against user's history is easy - the CSS/Javascript trick that enables it has been known for a couple of years, at least.

Note that this hack can't return your entire browsing history. What it can do is tell whether a particular URL is in your browser's history.

You can glean quite a lot of insight from just a few "hits" if you query the history creatively. It depends what you want to find out about your visitors.

Once that information is received at the server, your web experience can be tailored to your browsing habits.


Tracking clicks makes sense; why would someone not do that. Tracking mouseovers... not as much. I don't consider tracking mouse events to be privacy violations, though it is a bit creepy.

Some "reputable" companies are doing the same under the guise of doing "wholesome" things with it, but it all adds to someone's bottom line (not the visitor) and so is all the same. Browsers should ban any entity that attempts to retrieve visitor history, it's nobody's business but your own.