Skip to main content

Websites may be logging your email and password without you knowing

An extensive study reveals that up to 3% of websites may collect your form inputs even before you ever press “Submit.” That’s right — even if you type something and then delete it, these websites will still record your keystrokes and remember the things you chose not to input.

The data, collected without your knowledge and consent, can contain some of the most personal information, that can later be used for various purposes, such as targeted ads.

List of websites that track email addresses prior to submitting.

The study is titled, “Leaky Forms: A Study of Email and Password Exfiltration Before Form Submission,” and it was conducted by university researchers on a large sample of 100,000 of the world’s highest-ranking websites, adding up to a total of 2.8 million pages.

Using a website crawler (based on DuckDuckGo’s Tracker Radar Collector) the researchers scoured the internet and came back with staggering results. Although most of us assume that websites only record the things we type when we submit them, it seems that for up to 2,950 sites out of the 100,000 that were sampled, that was simply not true. It seems that, up to 3% of the time, trackers collect data from the moment it’s typed into the form.

Websites use trackers for many reasons, but for the most part, they’re used to personalize your browsing experience as well as collect information about visitor activity. In theory, this is supposed to be anonymous, but of course, personal identifiers narrow things down a whole lot.

Trackers can be useful, as they let the websites know what kind of content the users are most interested in. However, third-party trackers are used to help advertisers ensure that the ads you see are targeted, meaning you’d be more likely to click and purchase something.

The crawler used in the research was equipped with a machine learning classifier that was previously trained to detect email and password fields, and then intercept any potential script access to those fields. It seems that many third-party trackers have been caught using scripts that monitor the keystrokes when the visitor types inside a form. If the trackers save the information before it is submitted, some of them would be able to collect email addresses and passwords without the user’s consent.

Trackers that were affected by password leaks.

The fact that some third-party trackers were able to collect keystrokes, and thus data, prior to anything being submitted, is definitely alarming. According to the researchers, this issue affects a small percentage of trackers, but they are quite prevalent on the web. The biggest culprits were LiveRamp (662 websites), Taboola (383), Verizon (255), and Bizible (191). These trackers were present on websites where email addresses were logged. When it comes to snatching passwords, Yandex trackers top the list.

An interesting factor of the research is that European users were subjected to fewer attempts of email/password extraction than the users in the U.S. Only 1,844 websites allowed trackers to do this when visited from Europe, compared to 2,950 for users in the United States.

Users in Europe are protected by the GDPR, a set of legal regulations concerning personal data. According to the study, email exfiltration via trackers breaches at least three GDPR laws. Violating the GDPR can result in enormous fines reaching as high as 20 million euros or up to 4% of the global annual turnover of the entity in question.

The highlights from the study were published by researchers alongside a full, much more technical version for those who want to learn a bit more. This was then first shared by Bleeping Computer. It’s important to note that half of the listed first and third parties responded to the researchers and claimed that the collection was due to a mistake.

If you want to protect yourself from similar trackers, it might be a good idea to disable third-party trackers altogether — you can do this in your browser settings. It’s also considered good practice to change your password every so often. Password managers can prove helpful if you’re juggling a lot of different passwords that change on a regular basis.

Editors' Recommendations

Monica J. White
Monica is a UK-based freelance writer and self-proclaimed geek. A firm believer in the "PC building is just like expensive…
What is Linux? It’s a free operating system you may already use without knowing
What is Linux

MacOS and Windows are the two most popular desktop and laptop operating systems. They’re the two central OS choices dominating the desktop and laptop markets today. But have you heard of the alternative to both of these options? It's called Linux and it's entirely free, and very powerful.

What is Linux? It could be your next OS of choice.
A quick Linux history lesson
In 1991, when Terminator 2: Judgement Day was a massive hit in theaters, and Intel’s first 32-bit processor, the 80386, had become a widely-used chip in PCs, the Windows OS was still an infant. Unix was the most-used operating system at the time, both commercially and in academic institutions.

Read more
Without a firewall, the door to your smart home is left wide open
smart home defense against hackers photo of person typing on computer keyboard 735911

Walk around your average suburban neighborhood at 10 p.m., and most homes will appear downright sleepy: Doors locked, blinds closed, maybe the glow of a TV in the window. But if you were somehow able to wear glasses that could show radio waves, you'd be shocked at the buzz within. Robot vacuums, smart lights, wireless security cameras, and smart speakers are just a few of the many connected gadgets introduced to homes over the last decade, permeating them with their invisible Wi-Fi and other radio signals.

And with every connected gadget you add, the risk of being hacked becomes greater.

Read more
Chrome 69 logs you in without consent, but Google says it’s for your own good
chrome 69 user issues google update

After introducing a major browser redesign with Chrome 69, Google is once again finding itself in the midst of a privacy controversy. Irate users reported that Google had materially altered the way Chrome Sync works without informing its users of the changes. Now, whenever you log into a Google service -- like Gmail -- on Chrome 69, Google will automatically log you into the browser. Google denied that it made the changes to track its users.

Users are concerned that the synchronization of login could be a violation of privacy and trust. When you log into a Google service through your Chrome browser, Google will automatically also log you into the browser. This change occurred after the Chrome 69 update, and users are concerned that your local browser data -- such as passwords, bookmarks, web history, and more -- could be automatically uploaded and synchronized to Google's servers.

Read more