4 ms·

I guess trackers will just ask websites to route analytics traffic through their own infrastructure. Would it be enough for example.com to setup a dns alias poi

I guess trackers will just ask websites to route analytics traffic through their own infrastructure. Would it be enough for example.com to setup a dns alias pointing tracking.example.com to tracking.com?

d2wa 8y ago
This is a possible work-around, but it adds a lot of complexity to get HTTPS and stuff worked-around. Either the third-party must handle HTTPS for their partners who setup CNAMEs, or the first-party must handle HTTPS and proxy the requests back to the third-party. It’s doable but it will significantly slow things down to the point where even shitty websites would consider it unacceptable.
- icebraining 8y ago
  The third-party can handle HTTPS just for that particular subdomain, using a separate certificate.
  - d2wa 8y ago
    Yes, but this would significantly increase complexity.
    - jefftk 8y ago
      It it really that bad, with automated certificate issuing via Let's Encrypt?
icebraining 8y ago
That breaks cross-domain tracking, though; before, cookies set on analytics.com (pulled on SiteA) would be sent back to them when pulled from SiteB. If you now use different domains on each site, that doesn't work. (To be clear, I think this is a good thing)
- pests 8y ago
  Except all the analytics company has to do is have another shred of evidence that your identy is linked and it can just give out tokens that represent opauqe blobs you take care of and index by it's token like PHP does session storage.
groestl 8y ago
This would be already a giant leap forward: Usually, there is not a lot of trust between actors, and there doesn't need to be: everyone gets their own tracking pixel and is happy, who cares if user data is leaked along the way. The setup you describe requires more trust beetween parties, and, as a side-effect, reduces the overall number of potential contractual partners which get access to user data. It also reduces the number of websites with the knowledge to implement such a setup.
- Pxtl 8y ago
  Right. It's historically been very assymetric - the content sites are risking their user's safety by working with shady as providers, but not their own. Under a server-side include, the content company is just as at risk from malicious adscript as the client.

d2wa 8y ago

This is a possible work-around, but it adds a lot of complexity to get HTTPS and stuff worked-around. Either the third-party must handle HTTPS for their partners who setup CNAMEs, or the first-party must handle HTTPS and proxy the requests back to the third-party. It’s doable but it will significantly slow things down to the point where even shitty websites would consider it unacceptable.

icebraining 8y ago
The third-party can handle HTTPS just for that particular subdomain, using a separate certificate.
- d2wa 8y ago
  Yes, but this would significantly increase complexity.
  - jefftk 8y ago
    It it really that bad, with automated certificate issuing via Let's Encrypt?

icebraining 8y ago

That breaks cross-domain tracking, though; before, cookies set on analytics.com (pulled on SiteA) would be sent back to them when pulled from SiteB. If you now use different domains on each site, that doesn't work. (To be clear, I think this is a good thing)

pests 8y ago
Except all the analytics company has to do is have another shred of evidence that your identy is linked and it can just give out tokens that represent opauqe blobs you take care of and index by it's token like PHP does session storage.

groestl 8y ago

This would be already a giant leap forward: Usually, there is not a lot of trust between actors, and there doesn't need to be: everyone gets their own tracking pixel and is happy, who cares if user data is leaked along the way. The setup you describe requires more trust beetween parties, and, as a side-effect, reduces the overall number of potential contractual partners which get access to user data. It also reduces the number of websites with the knowledge to implement such a setup.

Pxtl 8y ago
Right. It's historically been very assymetric - the content sites are risking their user's safety by working with shady as providers, but not their own. Under a server-side include, the content company is just as at risk from malicious adscript as the client.