8 ms·

Also, unlike many smaller analytics providers, Google Analytics doesn't have glaring CSRF vulnerabilities and doesn't have creepy features that let you spy on i

by nsgi 7y ago

Also, unlike many smaller analytics providers, Google Analytics doesn't have glaring CSRF vulnerabilities and doesn't have creepy features that let you spy on individual users (no idea if this applies to Plausible or not).

clairity 7y ago
> "[GA]...doesn't have creepy features that let you spy on individual users" google reserves that for itself so as not to lose it's dominance of online advertising and targeting. why would they share their bread and butter with the little guys?
- nsgi 7y ago
  No idea if that's true or not regarding Google Analytics, but you can opt out of all data sharing and I imagine Google would be in a lot of trouble if they didn't honour that.
  - hedora 7y ago
    There is no comprehensive opt out to Google tracking. If you disagree, show me the button that opts out of doubleclick (and all Google subsidiaries and data sharing partners) targeting ads at my home IP address, cell phone, car, etc.
    - aiiane 7y ago
      https://adssettings.google.com/ https://adssettings.google.com/
      - ses1984 7y ago
        Opting out of targeted ads is NOT the same as opting out of tracking.
        joshuamorton 7y ago
        But it's what GP asked for. I'm also unclear on whether "opting out of tracking" under the definition you're implying is possible. Any entity tracking you needs to track that you've opted out of tracking, which requires tracking you. Whoops.
        ses1984 7y ago
        I reject the idea that you have to be tracked to not be tracked. Imagine a system where you opt in to tracking, if you are not opted in, no data about you is written into any system used for business analysis. Of course you can't/shouldn't stop all writes to your systems, like server access logs, but you can draw a line between operational and business data. Of course if you have access to both operational and business data sets you can analyze data for people who have not opted in, but I would rather live in a world where we at least try to enforce a separation between the two.
    - nsgi 7y ago
      You can opt out of all data sharing in Google Analytics on the account settings page. There are also ways to opt out of ad targeting but that's irrelevant to this discussion.
    - dheera 7y ago
      Just add 0.0.0.0 google-analytics.com 0.0.0.0 www.google-analytics.com to your /etc/hosts if you want a comprehensive opt-out.
    - cameronbrown 7y ago
      Analytics: https://chrome.google.com/webstore/detail/google-analytics-opt-out/fllaojicojecljbmefodhfapmkghcbnh?hl=en https://chrome.google.com/webstore/detail/google-analytics-o... Ads: https://chrome.google.com/webstore/detail/iba-opt-out-by-google/gbiekjoijknlhijdjbaadobpkdhmoebb?hl=en https://chrome.google.com/webstore/detail/iba-opt-out-by-goo...
  - clairity 7y ago
    i'm sure there are people at google who want to honor those opt-outs in good faith, and there are those who don't. the massive organizational system itself, nevermind the massive computational systems, acts against doing this thoroughly and auditably. it's also hard to believe that they'd get the data out of every last nook and cranny when they don't even swap out dead hard drives in their datacenters because of time and cost to find them (as related to me by a googler a number of years ago). and they have an army of lawyers and lobbyists for anything that falls all the way through the cracks to the public in a way that allows lawsuits (gdpr and the like).
    - Spooky23 7y ago
      I don’t work at Google, but I’ve worked for and with many big corporations and government entities. The army of lawyers look within too. The problem with big companies is usually that they lobby their way to do things that you don’t like. They are usually very good at working within those parameters. That’s why you generally don’t see data breaches in places like Google. When you do, they are usually a combination of acute issues (hacking, etc) and incompetence (Equifax). There are overlapping controls and segmentation that make it harder to rogue stuff without oversight. At a startup or small adtech place, forget it. The controls are not there and the company has nothing to lose.
  - lucideer 7y ago
    > Google would be in a lot of trouble if they didn't honour that. There are plenty of examples where Google have not honoured such expectations of trust. They have not, to date, gotten into "a lot of trouble". The GDPR is probably the piece of regulation most likely to possess teeth big enough to get Google into a little bit of trouble, and the task of enforcing that is down to 1 person in a deliberately underfunded department in the country where Google has chosen to locate it's EU HQ[0] There is no will to prosecute Google for misbehaviour in this area. - [0] https://www.irishexaminer.com/breakingnews/ireland/over-6700-data-breaches-reported-to-data-protection-commissioner-976403.html https://www.irishexaminer.com/breakingnews/ireland/over-6700...
  - ForHackernews 7y ago
    I don't think that's true at all. You can opt out of seeing the results of Google tracking in your own Google profile, but it doesn't stop them tracking you.
- duhi88 7y ago
  They made a statement within the last few years that they don't use GA data for their own purposes. The scarier implication is they don't need GA to understand web trends. They can collect far more data using Chrome, AMP, Android, Ads, and more.
  - ForHackernews 7y ago
    Bull shit they don't. Let's see a sworn statement by a Google executive in court or else I don't believe it.
    - blast 7y ago
      The point people are making is that it's subtler than that. They don't need GA for a surveillance machine. They've already got one. https://www.youtube.com/watch?v=Ea8GyscSFaQ https://www.youtube.com/watch?v=Ea8GyscSFaQ. It's more valuable to them to be able to truthfully say they don't add GA data to it. Meanwhile offering GA for free chokes out that competitive avenue to anyone else.
  - earthboundkid 7y ago
    Is there a link to that? I've always suspected they feed GA data back into SER. But I don't know one way or the other. It does seem like Google is in a textbook case of dumping to prevent new competitors from arising though.
  - Yizahi 7y ago
    As yes, I remember that statement - "Don't be evil" - that one, right?
Ayesh 7y ago
Did you mean XSS?
- nsgi 7y ago
  I'm specifically talking about CSRF as I've found that to be quite widespread and some analytics providers have had flaws that can lead to your account being deleted or stats sent to someone else's email address, etc. I don't know if there's a similar problem with XSS, but I trust Google's security practices more than most other companies.
  - Ayesh 7y ago
    I see. I always have this idea in my head, to start a service and get people to put my script on their web sites, and pull a grand scam one day by changing the script to do something malicious on those poor sites that didn't add SRI.
lmkg 7y ago
Google Analytics consultant here. Actually, GA does have a creepy feature that lets you spy on individual users. It's called the User Explorer report (under Audience in the left-hand nav). It lets you page through each hit from a particular user. This is also the report that lets you process Data Subject Access or Deletion requests under GDPR or CCPA.

by nsgi 7y ago

clairity 7y ago

> "[GA]...doesn't have creepy features that let you spy on individual users" google reserves that for itself so as not to lose it's dominance of online advertising and targeting. why would they share their bread and butter with the little guys?

nsgi 7y ago
No idea if that's true or not regarding Google Analytics, but you can opt out of all data sharing and I imagine Google would be in a lot of trouble if they didn't honour that.
- hedora 7y ago
  There is no comprehensive opt out to Google tracking. If you disagree, show me the button that opts out of doubleclick (and all Google subsidiaries and data sharing partners) targeting ads at my home IP address, cell phone, car, etc.
  - aiiane 7y ago
    https://adssettings.google.com/ https://adssettings.google.com/
    - ses1984 7y ago
      Opting out of targeted ads is NOT the same as opting out of tracking.
      - joshuamorton 7y ago
        But it's what GP asked for. I'm also unclear on whether "opting out of tracking" under the definition you're implying is possible. Any entity tracking you needs to track that you've opted out of tracking, which requires tracking you. Whoops.
        ses1984 7y ago
        I reject the idea that you have to be tracked to not be tracked. Imagine a system where you opt in to tracking, if you are not opted in, no data about you is written into any system used for business analysis. Of course you can't/shouldn't stop all writes to your systems, like server access logs, but you can draw a line between operational and business data. Of course if you have access to both operational and business data sets you can analyze data for people who have not opted in, but I would rather live in a world where we at least try to enforce a separation between the two.
  - nsgi 7y ago
    You can opt out of all data sharing in Google Analytics on the account settings page. There are also ways to opt out of ad targeting but that's irrelevant to this discussion.
  - dheera 7y ago
    Just add 0.0.0.0 google-analytics.com 0.0.0.0 www.google-analytics.com to your /etc/hosts if you want a comprehensive opt-out.
  - cameronbrown 7y ago
    Analytics: https://chrome.google.com/webstore/detail/google-analytics-opt-out/fllaojicojecljbmefodhfapmkghcbnh?hl=en https://chrome.google.com/webstore/detail/google-analytics-o... Ads: https://chrome.google.com/webstore/detail/iba-opt-out-by-google/gbiekjoijknlhijdjbaadobpkdhmoebb?hl=en https://chrome.google.com/webstore/detail/iba-opt-out-by-goo...
- clairity 7y ago
  i'm sure there are people at google who want to honor those opt-outs in good faith, and there are those who don't. the massive organizational system itself, nevermind the massive computational systems, acts against doing this thoroughly and auditably. it's also hard to believe that they'd get the data out of every last nook and cranny when they don't even swap out dead hard drives in their datacenters because of time and cost to find them (as related to me by a googler a number of years ago). and they have an army of lawyers and lobbyists for anything that falls all the way through the cracks to the public in a way that allows lawsuits (gdpr and the like).
  - Spooky23 7y ago
    I don’t work at Google, but I’ve worked for and with many big corporations and government entities. The army of lawyers look within too. The problem with big companies is usually that they lobby their way to do things that you don’t like. They are usually very good at working within those parameters. That’s why you generally don’t see data breaches in places like Google. When you do, they are usually a combination of acute issues (hacking, etc) and incompetence (Equifax). There are overlapping controls and segmentation that make it harder to rogue stuff without oversight. At a startup or small adtech place, forget it. The controls are not there and the company has nothing to lose.
- lucideer 7y ago
  > Google would be in a lot of trouble if they didn't honour that. There are plenty of examples where Google have not honoured such expectations of trust. They have not, to date, gotten into "a lot of trouble". The GDPR is probably the piece of regulation most likely to possess teeth big enough to get Google into a little bit of trouble, and the task of enforcing that is down to 1 person in a deliberately underfunded department in the country where Google has chosen to locate it's EU HQ[0] There is no will to prosecute Google for misbehaviour in this area. - [0] https://www.irishexaminer.com/breakingnews/ireland/over-6700-data-breaches-reported-to-data-protection-commissioner-976403.html https://www.irishexaminer.com/breakingnews/ireland/over-6700...
- ForHackernews 7y ago
  I don't think that's true at all. You can opt out of seeing the results of Google tracking in your own Google profile, but it doesn't stop them tracking you.
duhi88 7y ago
They made a statement within the last few years that they don't use GA data for their own purposes. The scarier implication is they don't need GA to understand web trends. They can collect far more data using Chrome, AMP, Android, Ads, and more.
- ForHackernews 7y ago
  Bull shit they don't. Let's see a sworn statement by a Google executive in court or else I don't believe it.
  - blast 7y ago
    The point people are making is that it's subtler than that. They don't need GA for a surveillance machine. They've already got one. https://www.youtube.com/watch?v=Ea8GyscSFaQ https://www.youtube.com/watch?v=Ea8GyscSFaQ. It's more valuable to them to be able to truthfully say they don't add GA data to it. Meanwhile offering GA for free chokes out that competitive avenue to anyone else.
- earthboundkid 7y ago
  Is there a link to that? I've always suspected they feed GA data back into SER. But I don't know one way or the other. It does seem like Google is in a textbook case of dumping to prevent new competitors from arising though.
- Yizahi 7y ago
  As yes, I remember that statement - "Don't be evil" - that one, right?

Ayesh 7y ago

Did you mean XSS?

nsgi 7y ago
I'm specifically talking about CSRF as I've found that to be quite widespread and some analytics providers have had flaws that can lead to your account being deleted or stats sent to someone else's email address, etc. I don't know if there's a similar problem with XSS, but I trust Google's security practices more than most other companies.
- Ayesh 7y ago
  I see. I always have this idea in my head, to start a service and get people to put my script on their web sites, and pull a grand scam one day by changing the script to do something malicious on those poor sites that didn't add SRI.

lmkg 7y ago

Google Analytics consultant here. Actually, GA does have a creepy feature that lets you spy on individual users. It's called the User Explorer report (under Audience in the left-hand nav). It lets you page through each hit from a particular user. This is also the report that lets you process Data Subject Access or Deletion requests under GDPR or CCPA.