4 ms·
A few years ago I was doing a security audit on a site and found this very problem. The marketing department had access to the Google Tag Manager account and ad
by dominicr 8y ago
A few years ago I was doing a security audit on a site and found this very problem. The marketing department had access to the Google Tag Manager account and added several (!) almost identical user tracking plug-ins. They were capturing all form fields, including credit card numbers, passwords, etc...
The documentation talked about how to block this capture but that involved a developer getting involved and the developers didn't even know about the plug-in.
Basically, don't add a third party service to any app or website without doing a secuity review, especially if marketing, product or UX have suggested it!
- zimbatm 8y agoThat's why it's good to separate the marketing website from the main product to different domains. When you can. * www.mydomain.com - install Google Tag Manager, let the marketing people go crazy * app.mydomain.com - all tracking request has to go through a developer That works well for SaaS type of products. Not so well for online stores where you want everything integrated.
- mschuster91 8y ago> * www.mydomain.com - install Google Tag Manager, let the marketing people go crazy Even there, that's dangerous. Most marketing people are not trained in legal matters and install all kinds of shit with dubious legality. In addition the tons of trackers on websites make the user experience really slow. Approval by legal and tech should be the standard process, not "marketing has free rein to fuck over the company due to messing up GDPR compliance".
- Tsiklon 8y agoI think that you should go one further - and do periodical or continuous security reviews of the third party services you're using on your app or website. You're reliant on them behaving in the same manner consistently, and behaving ethically when they change their service's behaviour.
- antnisp 8y agoAnd legal.