4 ms·
Would you care to comment on why gov.uk is using 3rd party analytics scripts run by a company based in a foreign country on the online tax assessment form for U
by anon1385 11y ago
Would you care to comment on why gov.uk is using 3rd party analytics scripts run by a company based in a foreign country on the online tax assessment form for UK citizens?
Getting rid of that massive privacy and security hole would be a much better use of your time and resources than farting around with the blockchain.
- grey-area 11y agoOuch. That is a pretty serious security hole on a tax website, they're using Google Analytics - google or someone who breached their security could entirely take over the tax website and record all the data. Wouldn't it be a lot safer to handle their own analytics with a self-hosted solution rather than paying google for it? At the very least they could self-host the js so that they control what is being run on their own domain.
- robin_reala 11y agoI don’t know about HMRC’s solutions and I haven’t looked at the tax self assessment form so I wouldn’t like to comment on that. On the main GOV.UK we use Google Analytics Premium; Google certify that information in a premium account will not be inspected by themselves. They also self-certify as a Safe Harbour supplier[1], although obviously with the framework having been dissolved late last year that’s up in the air. I’m also informed that we truncate the IP before sending it to try and mitigate potential geolocation. Obviously I’m just an employee of GDS: none of this is an official statement. [1] https://www.google.com/policies/privacy/frameworks/ https://www.google.com/policies/privacy/frameworks/