Listen: How I recorded user behaviour on my competitor's websites
A test that hijacked the Chrome back button to send visitors to a fake Google results page, then to mirrored competitor pages where heatmaps, sessions and typing were recorded. Google de-indexed the whole domain.
Transcript
After publicly revealing a security flaw, Google tracked down my test site and completely wiped the entire domain from its search index, without sending any warning.
The flaw involves manipulating the back button in the Chrome browser. When a visitor lands on my page from Google and hits the back button, JavaScript redirects them to a fake, mirrored version of the search engine results page, or SERP. If they click on a competitor's link, they are sent to a copy of that competitor's site that I control.
Through this setup, I was able to track user behavior, record keystrokes, and generate heatmaps of how people interacted with the cloned site. Reassured by the HTTPS padlock symbol in their browser, about half of the users never suspected a thing.
This test sparked heavy criticism. Many argued that running an active exploit on unsuspecting users is unethical. Security professionals pointed out that the correct path is responsible disclosure, which means sharing a simple proof of concept with Google directly, rather than building a fully functional trap.
Ultimately, manipulating the back button in Chrome should not be possible. Google needs to update its algorithms to detect this tactic, penalize offending sites, and warn users of the danger.