3 ms·
If someone can execute arbitrary JS they can already exfiltrate any information they want with userid attached, in addition to impersonating users etc. This is
by jefftk 6y ago
If someone can execute arbitrary JS they can already exfiltrate any information they want with userid attached, in addition to impersonating users etc. This is a far bigger risk than that they might add a call to document.interestCohort() and opt that page into FLoC?
- vineyardmike 6y agoDoes Google Analytics do this?
- jefftk 6y agoSorry, what are you asking?
- vineyardmike 6y agoGoogle Analytics is arbitrary JS and JS can turn on floc... so using GA is a potential point to add you to floc. Obviously its probably a small overlap of "doesn't trust floc" and "still trusts GA" but still a Trojan horse. PS. Wow kudos for being so responsive, especially/despite less than stellar comments regarding your openness about working for G-Ads.
- jefftk 6y agoIt doesn't look like Google Analytics does this today: $ curl -sS https://www.google-analytics.com/analytics.js \ | grep interestCohort [no results] On the other hand, I could imagine them or other analytics services adding it since sites installing analytics services generally want to be able to slice their traffic by as many dimensions as possible. I would hope that any service considering reading FLoC implements it as opt-in, however, since sites probably didn't consider whether their pages are sensitive in choosing whether to add analytics (though perhaps they should have!) (Still speaking only for myself)