Thread by @Bendineliot

So let's take a look at the worst/most interesting part of the report @privacyint just published about mental health websites and tracking. How an online depression test share answers with a third party. Say hi to @doctissimo! 👋 1/8

#infosec I guess

@privacyint @doctissimo So let's say you have been feeling quite bad recently and you have suspicion that this might be linked to depression. You're french (lucky you), so you google "test dépression" and find this page 👇 2/8

@privacyint @doctissimo Let's ignore this terrible way of obtaining consent for now and just scroll to start taking the test. I'm using @httptoolkit to look at the request sent when navigating the page...

OH GOD. 3/8

@privacyint @doctissimo @HttpToolkit Lot of things going on, lots of ressources loaded, tracking pixels, request to third parties (we found 40 when analysing the site with @webxray)...

And something like a pre-bid request to a google function including keywords such as "depression", "test", "psychology"... 4/8

@privacyint @doctissimo @HttpToolkit @webxray Just a note here to say that the URL (which contains the words "depression", "test" and "psychology") is shared by default with most of the third parties as part of the referer header. (see previous screenshot).

That's just free data for y'all 5/8

@privacyint @doctissimo @HttpToolkit @webxray Now let's take this test and see how this all become interesting/terrifying. You answer a few questions (all True/False, it's not very elaborate) and...

DAMN, this thing wants to TALK. 5/8

@privacyint @doctissimo @HttpToolkit @webxray Aaaaand it wants to share your answers around apparently! Eveytime you answer, @doctissimo sends the answer to @qualifio as a variable in a POST request. And because Qualifio is polite, it answers with the full current question, the next one, and the answer... in clear text. 7/8

@privacyint @doctissimo @HttpToolkit @webxray @qualifio Why does this matter? Qualifio is not mentioned anywhere in the privacy policy, you don't know your answers are collected, you don't know why, and this is happening on a website which declares having 448 advertising partners.

Also, it's clear text over HTTP... 8/8

@privacyint @doctissimo @HttpToolkit @webxray @qualifio I hope you enjoyed/cried a little. Full report can be found here: staging.privacyinternational.org/campaigns/your… 9/8

@privacyint @doctissimo @HttpToolkit @webxray @qualifio Bonus point: because this test was built (as you could guess from the GET request) from a template with good and bad answers, the last page of the test tells you what you should have answered 🙄