Marketing services snagging emails to track users

Researchers digging into behavior on the top websites sought to discover how widespread “leaky forms” are on the Internet. They found that thousands of sites collected email addresses without user consent and without the user submitting a form.

In a report published by the 31st Usenix Security Symposium, researchers from KU Leuven, Radboud University, and the University of Lausanne, used software to test 100,000 websites for behavior previously reported by Gizmodo. They investigated what happened when someone from the US or the EU filled out a web form. As it turned out, almost 3000 sites collected a US user’s email while 1844 sites collected an EU user’s email. 

These forms include standard contact forms, subscription forms, and the like. While a user would expect their emails to only be transmitted upon hitting “submit” or “send,” on these sites the forms captured their information as soon as the user entered it, either key by key or line by line.

Even worse, this isn’t just a clever way to capture email addresses. As the researchers discovered, the email addresses would be used to track users across the Internet. 

Radboud University professor Güneş Acar, one of the leaders of the study, told Wired that “the privacy risks for users are that they will be tracked even more efficiently; they can be tracked across different websites, across different sessions, across mobile and desktop.” He pointed out that an email address is persistent and unique to an individual, and can’t be cleared like a cookie. 

Wired reported that some of the sites guilty of this behavior were not collecting the email addresses directly, but instead third-party marketing and analytics services employed on the site. The Martech blog listed some of the third-party companies collecting data, including Adobe (Bizible), Facebook, Neustar, Oracle Netsuite (Bronco Marketing Platform), Salesforce Pardot, and Taboola. And some of the top sites collecting data prior to submission include USA TODAY, Trello, The Independent, Business Insider, and Time.

While the US has not made this type of data collection illegal, it is banned under the GDPR in Europe as an invasion of privacy.

Acar noted that the research team was “super surprised by these results. We thought maybe we were going to find a few hundred websites where your email is collected before you submit, but this exceeded our expectations by far.”

In other news

• Apple to discontinue the iPod. According to the BBC, Apple is to stop selling its iPod Touch, which is the last remaining iPod product. Introduced to the world in 2001 in a presentation by tech godfather, Steve Jobs, the iPod became hugely popular and was championed by celebrities like Oprah Winfrey and U2. But with a limited storage capacity, it became clear that the device would be superseded by the iPhone. Apple has said that the iPod touch will be available for purchases “while stocks last”. 

• El Salvador expected to default as Bitcoin plummets. The decision of President Nayib Bukele to take on bitcoin is not proving to be the best, according to a report by El Pais. In September last year, El Salvador announced that it would be the first country to accept bitcoin as legal tender, in addition to the US dollar, and the government invested $25 million in bitcoin. The price of Bitcoin has plummeted in the last two weeks as a result of the war in Ukraine, inflation, and the raising of interest rates in the US. As a result, Salvadoran government bonds are trading at 40% of their original value, and there are concerns that the country will not be able to pay its foreign debt payment in January 2023.   

• San Francisco Police uses driverless cars in investigations. A leaked San Francisco Police Department training document proves that for the last five years driverless cars have been tested for surveillance in the city, according to Vice. The document explained that “Autonomous vehicles are recording their surroundings continuously and have the potential to help with investigative leads,” and this has already taken place. The cars are equipped with various sensors and cameras for recording streets and neighborhoods. The two autonomous vehicle (AV) companies mentioned in the document are Cruise and Waymo, although there are many more that have been granted permits for testing AV cars in the city. The developments have raised concerns over privacy, with one Harvard research fellow warning of the dangers of intrusive surveillance.    

• Google Translate expands its range of languages. ZDNet reports that Google’s translation platform has added 24 new languages to its bank, making a total of 133. The additional languages and dialects are spoken by 300,000 people around the world, according to the tech giant. They include languages of Africa, India, and the Americas, as well as indigenous languages like Quechua and Guarani. They vary from languages like Linguri, which is spoken by around 45 million people in central Africa, to Sanskrit, which is only spoken by 20,000 in India. The update to Google Translate is accompanied by a new machine learning technology that makes it possible to develop new translation techniques without needing an example, though this is still a work in progress.    

• The first property in Portugal is sold in cryptocurrency. A property in Braga, Portugal, is sold for bitcoin in the first 100% crypto property transaction in Europe, according to MSN. The 3-bedroom apartment in the northern city sold for 3 bitcoin on May 5, which was worth around 110,000 euros, though no conversion was required. The transaction was only possible thanks to a new regulation that came into effect last month and could be the first of many digital exchanges. However, if the price had been in excess of 200,000 euros, it would have been necessary to report the transaction to the authorities.  

• Need sugar? Try the bottom of the ocean. New research published in Nature, Ecology & Evolution has found that there are large reserves of sugar stored in seagrass meadows on ocean floors, according to Science Alert. This is in the form of sucrose, and it is released from the seagrasses into the soil through photosynthesis, and more is produced when there is more light. Seagrasses can absorb twice as much carbon as forests, and much faster, so they impact climate change. There is a lot that is still unknown about the plants, but the discovery of sucrose deposits could be an important breakthrough. 
• Researchers discover the identity of circles in the Sahara. A reporter from Vox set off on a quest to find out what made unidentified markings visible on Google Earth —and why. The research was documented on video and is a fascinating demonstration of how modern technology can help to solve these mysteries.

Tip of the week

It’s too easy to get complacent about all the websites tracking your Internet search activity while browsing online. You might want to read an article quickly in your lunchtime and soon find you tire of scrolling privacy pop-ups requesting you either ‘accept all’ or ‘reject all’ cookies. Worse, many of these tracking requests ask you to toggle off individual advertisers, and the lists can be long.

Namecheap believes privacy is important, and we do not use our customers’ emails to track them across the Internet. You can read more about our privacy standards here on the blog.  

But not all companies value your privacy. That means it’s worth spending a little bit of time setting up your desktop browser to block these trackers, especially if you have accidentally accepted them. There are a few options to choose from. Privacy Badger, created by the Electronic Frontier Foundation, is a free tool which blocks online tracking in your current browser. Malwarebytes does the same, and although it has paid and free extension add-ons, the premier upgrade does come as a free option with some banking apps. Similarly, Norton’s Anti-Track browser extension (free with many utility and broadband packages) will block tracking cookies, as will AdBlock Plus, and both are designed as extensions to multiple browsers. Use the DuckDuckGo browser and enjoy its free privacy extension ad blocker or try out the Brave browser with Brave Shields and its similar free tracker-blocking.  

For added piece of mind, as none of the current trackers cover mobile browsing, consider a VPN to be able to privately browse the Internet.

If you found this week’s news roundup useful, please share it with your social networks!