PSA: The Reddit redesigned UI is worse for privacy compared to the old UI.

PSA: The Reddit redesigned UI is worse for privacy compared to the old UI.

Reddit has been trying to redesign their website to feel more “modern”, but I have noticed that the redesigned UI also features more tracking.

For one, the new UI (and the new userpage) features session replay tracking everywhere (recording of your mouse movements, keystrokes, and how you interact with the website), as evident by its use of the mousemove JavaScript event listener for the entire page. I found out using Luminous (this isn’t an endorsement or ad), which is an extension that detects (and can block) JavaScript events. The old UI also listens for the mousemove event but not everywhere (I have only noticed it on the “submit post” page, but there are probably a few other places), though I’m not sure if this is due to session replay tracking. I cannot say for certain that the old UI doesn’t have session replay or something similar, but to me it doesn’t seem like it for most pages. Perhaps someone who has investigated this further can confirm or deny.

Session replay is another form of tracking what you click on (possibly negating attempts to opt out of “regular” tracking of outbound links), can be used to fingerprint a user (how the mouse moves), and will negate attempts to delete posts and comments (for example, ones that accidentally contain personal information or passwords). Even accidentally pasting something like a password in a text box will result in the password being sent to Reddit (and/or a third party) and being stored in plain text. I don’t know how Reddit manages user data internally, but with session recording it’s possible that a Reddit employee playing back a session to assess user reaction to a new UI update may end up seeing your private messages or posts in private subreddits simply because it was there when you interacted with the page.

Also, the Reddit redesign completely breaks without JavaScript enabled, to the point where you can’t click on links or even see the page content.

The old UI is still available to users, either through a setting in your account or (if you’re not logged in) through old.reddit.com. You can also replace the ‘www’ part of the URL with ‘old’ on any Reddit page to get back to the old UI. I really, really hope they don’t remove this.

submitted by /u/LatterEngineer to r/privacy
[link] [comments]

top scoring links : multi

Related posts

Leave a Comment