6 ms·

Here's the paper giving details: http://www2.research.att.com/~bala/papers/wosn09.pdf http://www2.research.att.com/~bala/papers/wosn09.pdf There's three ways

Here's the paper giving details: http://www2.research.att.com/~bala/papers/wosn09.pdf http://www2.research.att.com/~bala/papers/wosn09.pdf There's three ways info leaks: 1 - Referer header, eg facebook.com/profile.php?id=1 2 - Request, eg analytics.google.com/script.js?page=facebook.com/profile.php?id=1 3 - Cookies, eg z.digg.com points to an omniture server, and so passes all digg cookies to them! 1 and 2 are easily exploitable by advertisers who wanted to, but 1 especially seems like a very standard way of building urls on most services. Definitely will get them hammered for good reason, but there's not necessarily any bad intent. 3 seems a lot worse. Are there legit reasons I'm missing for hosting ad servers on the same domain, and so puncturing the browser security model?

matasar 16y ago
re: 1 - For user shared links, Facebook redirects to anonymize the referring profile. I suspect they forgot to do the same for ads, and it was an honest if frustrating mistake.
- X-Istence 16y ago
  They didn't use to do this, the only reason they redirect now is so that if a link is deemed a virus of some sort they can easily stop it from spreading, and you can enable a setting so that before visiting every link you get an interstitial that tells you that you are leaving Facebook.
kingsley_20 16y ago
I've sometimes subdomained a few, select third party services on the same domain. For example, if a third party hosts your landing pages and you wish to own the urls to those, subdomaining is the best way to handle that. That said, you should practice decent subdomain level security with cookies. You can and SHOULD restrict cookies to subdomain levels. The only exception is for SSO related cookies (that are stored at the domain root) that still need at least a second, shared secret verification at the very minimum.
derefr 16y ago
> Are there legit reasons I'm missing for hosting ad servers on the same domain, and so puncturing the browser security model? Avoiding generic (not targeted to your site specifically) AdBlock URL filtering.
- amanfredi 16y ago
  Also, many browsers block third-party cookies by default, which may screw up your analytics.
  - wizard_2 16y ago
    Many browsers can, but few do. Firefox, chrome and IE don't by default.
    - amanfredi 16y ago
      True. I misspoke about many, but you will still improve the accuracy of your analytics by doing this.
ojbyrne 16y ago
Omniture isn't an ad server, it's an analytics system. Perhaps they do allow sharing with 3rd parties (i.e. ad servers) but I'd guess that's somewhere in the settings.

matasar 16y ago

re: 1 - For user shared links, Facebook redirects to anonymize the referring profile. I suspect they forgot to do the same for ads, and it was an honest if frustrating mistake.

X-Istence 16y ago
They didn't use to do this, the only reason they redirect now is so that if a link is deemed a virus of some sort they can easily stop it from spreading, and you can enable a setting so that before visiting every link you get an interstitial that tells you that you are leaving Facebook.

kingsley_20 16y ago

I've sometimes subdomained a few, select third party services on the same domain. For example, if a third party hosts your landing pages and you wish to own the urls to those, subdomaining is the best way to handle that. That said, you should practice decent subdomain level security with cookies. You can and SHOULD restrict cookies to subdomain levels. The only exception is for SSO related cookies (that are stored at the domain root) that still need at least a second, shared secret verification at the very minimum.

derefr 16y ago

> Are there legit reasons I'm missing for hosting ad servers on the same domain, and so puncturing the browser security model? Avoiding generic (not targeted to your site specifically) AdBlock URL filtering.

amanfredi 16y ago
Also, many browsers block third-party cookies by default, which may screw up your analytics.
- wizard_2 16y ago
  Many browsers can, but few do. Firefox, chrome and IE don't by default.
  - amanfredi 16y ago
    True. I misspoke about many, but you will still improve the accuracy of your analytics by doing this.

ojbyrne 16y ago

Omniture isn't an ad server, it's an analytics system. Perhaps they do allow sharing with 3rd parties (i.e. ad servers) but I'd guess that's somewhere in the settings.