Masking

DBA Replay supports several tools for preventing the capture of Personally Identifiable Information (PII). Masking occurs in the browser before the recording is transmitted to the server.

Additionally, as page contents change over time, masking is reapplied to these changes before they are sent to the server. This also applies to text fields that the user types into. Before any character is sent, it is checked against the masking exclusion and inclusion rules.

Masking Configuration

Masking Modes

Two modes are available to configure your site for masking: "mask everything" and "unmask everything". With "mask everything" everything on every recorded site is masked while using "unmask everything" the opposite is true. See Masking Examples for an overview of the different modes.

🚧

Full masking with selective demasking is recommended

We recommend using "mask everything" and then selectively unmask information vital to your analysis. This is the safest way to protect Personally Identifiable Information (PII). Otherwise, any change on your website, for example, CSS class names used to mask a specific element, could reveal PII.

Every decision to do unmasked recordings of large portions of websites should be accompanied by a thorough review of all relevant PII on those pages.

If unmasking by default is desired the best approach is to nevertheless limit that in scope to a particular, well-defined and well-reviewed (with regards to PII) set of pages, e.g., a specific user-flow like the checkout process on an e-commerce website.

Selectively Mask or Unmask parts of the Webpage

After choosing your preferred masking mode you are still able to selectively mask or unmask specific portions of a page or even the whole page in the WebSDK Configurator by

  • using CSS selectors (e.g., class names, ids, attributes, element types)
  • URLs or
  • page names.

You can also mask or unmask elements by adding an HTML attribute or class to the element you want masked or unmasked. Use [mpt-anon] to mask and to unmask use [mpt-visible]. To unmask you can alternatively also use the CSS class fsrVisible. Both techniques mask the node where it is used and all child nodes.

Examples on how to unmask/mask using attributes or classes:

<div mpt-visible>This text will be unmasked</div>
<div class="fsrVisible">This text will also be unmasked</div>
<div mpt-anon>This text will be masked</div>
<div>This text will be masked or unmasked depending on your configuration for this site</div>

📘

Notes

  • Password Inputs are always masked, no matter what configuration you choose, and can't be unmasked in any way.
  • Special configuration effort is required if private photos or images have to be masked and replaced by placeholder images, though this is possible.

Data to Mask

The following fields should be masked:

  • Form fields in general (potentially excluding search fields)

  • Information related to payment, including but not limited to:

    • Names
    • Credit card type, numbers, other credit card related information
    • Bank account information (including bank names, account numbers)
    • Voucher or similar codes, also if they appear in related error messages (especially if they could be personalized)
  • Information related to invoice and delivery, including but not limited to:

    • Names
    • Addresses
    • Contact information (e.g., e-mail addresses, telephone numbers)
    • Order numbers, tracking numbers (exceptions should be carefully considered)
  • Any appearances of names, usernames, e-mail addresses, passwords, other PII

  • Any communication, e.g., contact form contents, especially if it is sent to specific recipients (any exceptions, e.g., recording chat messages, should be carefully considered)

  • Other PII whenever it is entered or displayed, including but not limited to:

    • Private photos and images
    • Income, financial, or employment information
    • Health-related information
    • Government-issued identification numbers (Social Security, Driver’s License, etc.)
    • Data obtained from a U.S. consumer reporting agency, such as employee background investigation reports, credit reports, and credit scores.
    • Data information revealing race, ethnicity, national origin, religion, sexual orientation, criminal history, or trade union membership. Also, criminal records or allegations of crimes of EU residents.

Data to Unmask

Typical elements where unmasking is most valuable are:

  • Search fields (though best to avoid if it is plausible that users might enter PII, e.g., in an account help area)
  • Error messages
  • Dynamic information, especially if relevant for conversion, e.g., delivery times, availability, submission states
  • Selected options during user flows, including but not limited to:
    • Payment method
    • Delivery method

Verify that Masking is working

  1. Navigate to the site (with staging configuration).
  2. Open your browsers DevTools by pressing F12 and navigate to the "Console" tab.
  3. Execute the following command: Mpathy.showConsole().
  4. After the page has automatically reloaded you should see the WebSDK Console injected into the page.
  5. Click on "Show Masked Page".
  6. A new browser tab will show the masking result.

A fully masked page will look something like this:

Masking Mechanism

Text replacement during masking follows these rules:

Character

Masking

upper case letters

random upper case letters “A”-“Z” (using the English language letter frequency distribution)

lower case letters

random lower case letters “a”-“z” (using the English language letter frequency distribution)

numbers

the number “0”

special character (“@”, “&”, “.”, etc.)

not replaced during masking

Masking and Form Elements

If you are using the global unmasking mode but you want to mask all form fields use the checkbox in the global masking settings:

If you only want to unmask specific pages, use global masking mode and then specify the page you want to unmask with the unmasking rules. This would also unmask inputs and textareas. If you want to keep those masked, add a specific masking rule for those elements on the site you unmasked:

Advanced Masking Questions

Can the input field be demasked if it was loaded in a modal post-page load?

Yes, this is possible with DBA custom code.

Is it possible to mask photos and images?

Additional configuration is required if private photos or images must be masked and replaced by placeholder images. Contact Verint support or launch team for further details.

Can changes on the website impact masking?

Changes to webpage structure, such as renaming ids, classes or changing the DOM hierarchy, can result in unmasking or masking which no longer functions correctly. Masking by default is the recommended option. If unmasking rules no longer work because of structural webpage changes, no additional PII is recorded.