1

Buried deep within the Privacy Policy of a purely cloud-based financial services business (with no software downloaded to the user's device) is the following statement:

"We use screen capturing software to view and analyse individual customers' usage ....".

Is it technically possible for the business using that software to capture any part of a customer's screen other than the content of the page that is being served? For instance, can the business:

(a) view peripheral information on the customer's browser - e.g. their bookmarks, extensions, tabs open, etc; or

(b) view parts of the customer's screen that are not related to the browser - e.g. a Word document or image to the side of the browser?

Improve this question
4
  • "Cloud-based" doesn't quite mean "no software downloaded" if it uses Java or Flash... However, I suspect they're simply referring to monitoring their own webpage such as arstechnica.com/tech-policy/2017/11/…
    – u1686_grawity
    Jun 13, 2018 at 5:02
  • Thanks grawity, that's a very useful link. Thanks also for the reference to Java or Flash (tho in this case neither is used, I believe, which is why I found it a mystery). Good answer.
    – TechnoCat
    Jun 13, 2018 at 5:11
  • I think this suits better security.stackexchange.com. They are the experts.
    – cdlvcdlv
    Jun 13, 2018 at 5:42
  • Thanks cdlvcdlv; I'll use the other site next time I have a security question.
    – TechnoCat
    Jun 13, 2018 at 7:09

2 Answers 2

Reset to default
1

Most likely the clause refers to analytics scripts recording the webpage itself, such as described in this Ars Technica article.

Ordinarily websites cannot see the rest of your screen, although as of recently they can request this permission via WebRTC.

Improve this answer
-1

In regards to a “breach” of customer privacy or security, that is an opinion based or legal question. But common sense says the company probably has a terms of service to accept or decline that allows them to take certain liberties in regards to security or privacy.

The rest is simple to answer.

If you didn’t download and install software on to your computer, from this company, they can’t do any of the things you asked about.

If you did download and install software from this company on to your computer, then they can potentially do any of the things you asked about or more.

That is the choice everyone makes when they install software. Again, if it is not malware, it is probably stated on a usage agreement that has to be accepted or declined.

With no context on the policy or company, I tend to suspect the terminology is bad, you are misinterpreting the text, or reading more in to it than it says. The company can’t do anything more than track your own interaction with their website.

Note: “Installing” software can be as simple as clicking yes, or accept, to an obscure prompt on a website.

Improve this answer
4
  • Allow me to confirm several issues. First, no I did not download any software. As noted in my question, this is a strictly cloud-based financial services company. Second, I'm asking a strictly technical question, not a legal question. Third, it's clearly not a "simple question to answer", or I would not have asked it.
    – TechnoCat
    Jun 13, 2018 at 4:47
  • The last sentence of your question could be read as a strictly legal question. If you didn’t install software then they can’t do what they say they do or anything that you asked if they could do. What is difficult for one person to answer may not be for another.
    – Appleoddity
    Jun 13, 2018 at 4:56
  • As someone who has spent 25+ years in both tech and law (from coding to CIO and CEO), I know what's normally technically possible and what is unusual. Some of my clients - who are users of this financial trading service business (e.g. similar to an eTrade) - found this clause. The use of screen capturing software on a cloud-based business is obviously unusual, which is why I have asked the question on a technical forum, hoping to obtain an answer from someone with advanced technical knowledge in this area.
    – TechnoCat
    Jun 13, 2018 at 5:07
  • I’m not sure where we have gone wrong here. As a CIO/CEO I’m sure you can appreciate concise answers. There is no reason for this to be complicated. Without screen capture software installed on your client’s computer there is absolutely no way the website can “use screen capturing software to view and analyze individual customers’ usage.” It really is that simple. The terminology is either wrong or it is being taken out of context. Anything they are doing is not “screen capturing.” It can’t possibly be anything more than tracking your own interaction with the website.
    – Appleoddity
    Jun 13, 2018 at 5:22

Not the answer you're looking for? Browse other questions tagged .