4 ms·
One of the nastiest things I've seen from the "analytics startups" espousing how they're GDPR friendly and compliant and privacy friendly is that they advertise
by dylz 6y ago
One of the nastiest things I've seen from the "analytics startups" espousing how they're GDPR friendly and compliant and privacy friendly is that they advertise stuff like CNAME cloaking, using random URLs or hostnames for data collection, etc.
This is incredibly disgusting behaviour: the end-user has EXPLICITLY signaled intent to opt out, gone out of their way to try and protect themselves while blatantly signaling that intent that they do not want it, and the "privacy respecting and caring new not-like-the-other-guys" data collection service is attempting to repeatedly force itself on the end-user, sometimes trying multiple times pretending to be different hostnames, lying about what it is, etc.
I have seen bullshit "analytics" SaaS bruteforce its way through dozens of generically-named cloudfront or akamai hostnames until they find one that works.
No matter what you are collecting, this type of behaviour is evil and abhorrent. Someone saying no a thousand times until you find a disguise that works on them is not consent, or a yes.
> Are analytics evil, even if their sole purpose is to improve user experience? Let's say that we are building the infrastructure in a city, if we had stats on what streets have daily traffic jams, that would tell us a lot about the behavior of the people, but would also allow us to better direct traffic and reduce those issues.
Server-side analytics can do this fairly well.
But it is always a slippery slope - I have never, ever seen this proven otherwise. You count (raw number only) on average travel time or # of cars at an intersection. Okay. Nothing else - just when a car trips your wire you add one to an integer associated with that day or something. Few people would have an issue with this.
But now you want more. Now you set up licence plate scanners at every intersection. Now you store them in a database so you can tell if the same car is driving the same way and at what time each day. But wait, someone offers you money for this data, possibly even more money if you also run recognition and guess vehicle make/models in real time. And now you have a large database of people correlated to where they are at what time open to retrieval by others.
- zzo38computer 6y ago> One of the nastiest things I've seen from the "analytics startups" espousing how they're GDPR friendly and compliant and privacy friendly is that they advertise stuff like CNAME cloaking, using random URLs or hostnames for data collection, etc. > This is incredibly disgusting behaviour: the end-user has EXPLICITLY signaled intent to opt out, gone out of their way to try and protect themselves while blatantly signaling that intent that they do not want it, and the "privacy respecting and caring new not-like-the-other-guys" data collection service is attempting to repeatedly force itself on the end-user, sometimes trying multiple times pretending to be different hostnames, lying about what it is, etc. > I have seen bullshit "analytics" SaaS bruteforce its way through dozens of generically-named cloudfront or akamai hostnames until they find one that works. I agree with you; this is very bad. I might suggest for the user software to allow setting a list of allowed requests and prohibit others (if random URLs or hostnames are used, then this will block data collection, since if they try it, it will just end up annoying the user keeping asking), and/or to have an option tiat if too many improper accesses are attempted then all access will be denied (if it tries to bruteforce it ways through dozens of stuff, then none of them will work, especially if the browser pretends that the connection is just really slow!!!).