5 ms·

I don't care about server-side analytics. They can keep my IP, user agent, what pages I visit, etc - I give them those details willingly. What I do care about

I don't care about server-side analytics. They can keep my IP, user agent, what pages I visit, etc - I give them those details willingly. What I do care about and actively block is JavaScript trying to enumerate fonts or fingerprint my canvas or whatever is the latest and greatest web API abuse for fingerprinting.

Volker_W 5y ago
If you have a static IP (afaik, I do) it can be used for fingerprinting.
tgsovlerkhgsel 5y ago
I don't care about one web site doing their analytics. It becomes a problem when one analytics company is building a profile across many sites. Unfortunately, Cloudflare is in a position to do just that, just like major analytics providers.
- cmeacham98 5y ago
  Cloudflare doesn't make their money by selling user data to advertisers - I'll start worrying when they do, or Google starts doing this.
  - aaomidi 5y ago
    I mean, it's pretty clear they're gonna be able to do this very easily once cf analytics becomes widely adopted.
  - zelphirkalt 5y ago
    Maybe not yet, but the simple fact, that there even is a Cloudflare "analytics", hints at a direction, in which this will probably develop. Some people inside Cloudflare will think "If only we could sell our analytics data, we could profit more!" and then they might just do that. The temptation is huge for them. Lets be realistic. They are not all idealistic developers at Cloudflare. It is a huge business with lots of unethical people working at it, like in many big businesses. At some point some internal pressure might overwhelm a minority fighting against it and the change will happen. Perhaps it will happen step by step, slowly boiling the frog.
  - egberts1 5y ago
    FULL STOP: Cloudflare Analytics sells their data to Teradata. https://www.teradata.com/Resources/White-Papers/Price-Performance-In-Modern-Cloud-Database-Management-Systems?utm_campaign=coremedia-AMS&utm_source=google&utm_medium=paidsearch&utm_content=TERA1_GS_CoreMedia_NA-US_CV_NBKW_ALL_28334&utm_creative=MythBusters-Nonbrand&utm_term=analytics%20cost&gclid=Cj0KCQiAzfuNBhCGARIsAD1nu-_YN3y1dwpN_8IPb-vI8PImYf4O_DdsTdrRjy1et553yNujlXHtD-4aAoFQEALw_wcB https://www.teradata.com/Resources/White-Papers/Price-Perfor...
    - jgrahamc 5y ago
      Uh, no.
      - egberts1 5y ago
        [Counter-]Citation, please.
        jgrahamc 5y ago
        I am Cloudflare's CTO.
        egberts1 5y ago
        then you probably may want to talk to your marketing branch, you know, before you may get caught with your pants down … at something like a congressional hearing … or something.
        jgrahamc 5y ago
        What has that Teradata whitepaper got to do with Cloudflare?
- XCSme 5y ago
  I agree, the problem is not each site storing stats about their visitors, it's one site storing stats about all the visitors across many websites.
phgn 5y ago
If any network gets significant market share (like Google or Cloudflare), they can probably still follow you around by correlation of IP, user agent, routing location etc.
legitster 5y ago
I think there's some confusion about what Google Analytics does. It doesn't really engage in browser fingerprinting. It only tracks down to the individual session.
- tata71 5y ago
  Is that what they're slurping? Or just what they're showing you?
  - legitster 5y ago
    I work in marketing systems administration. I've had access to over a dozen GA implementations, some for Fortune 500 companies. It doesn't remotely do what people in this thread seems to think it does. Which is bizarre given you can go set up an account for free and see for yourself. They seem to be confusing it with some of the third party ad tracking software. But GA is really dumb as a brick (and that's a feature, not a bug).
    - Nextgrid 5y ago
      > I've had access to over a dozen GA implementations, some for Fortune 500 companies. The concern isn't about what GA gives to its implementers, it's about what it collects internally. Google is an advertising company and has a financial incentive to stalk everyone. Their bad faith implementation of the GDPR consent flow (which IMO does not actually comply, but the regulators are incompetent or unwilling to enforce the law) proves it. The current regulatory environment doesn't do enough to discourage non-consensual data collection, so given this fact and the company's past history we need to assume the worst until proven otherwise.
    - kevin_thibedeau 5y ago
      They can keep GA dumb as cover and do their dirty work with tag manager or fonts.

Volker_W 5y ago

If you have a static IP (afaik, I do) it can be used for fingerprinting.

tgsovlerkhgsel 5y ago

I don't care about one web site doing their analytics. It becomes a problem when one analytics company is building a profile across many sites. Unfortunately, Cloudflare is in a position to do just that, just like major analytics providers.

cmeacham98 5y ago
Cloudflare doesn't make their money by selling user data to advertisers - I'll start worrying when they do, or Google starts doing this.
- aaomidi 5y ago
  I mean, it's pretty clear they're gonna be able to do this very easily once cf analytics becomes widely adopted.
- zelphirkalt 5y ago
  Maybe not yet, but the simple fact, that there even is a Cloudflare "analytics", hints at a direction, in which this will probably develop. Some people inside Cloudflare will think "If only we could sell our analytics data, we could profit more!" and then they might just do that. The temptation is huge for them. Lets be realistic. They are not all idealistic developers at Cloudflare. It is a huge business with lots of unethical people working at it, like in many big businesses. At some point some internal pressure might overwhelm a minority fighting against it and the change will happen. Perhaps it will happen step by step, slowly boiling the frog.
- egberts1 5y ago
  FULL STOP: Cloudflare Analytics sells their data to Teradata. https://www.teradata.com/Resources/White-Papers/Price-Performance-In-Modern-Cloud-Database-Management-Systems?utm_campaign=coremedia-AMS&utm_source=google&utm_medium=paidsearch&utm_content=TERA1_GS_CoreMedia_NA-US_CV_NBKW_ALL_28334&utm_creative=MythBusters-Nonbrand&utm_term=analytics%20cost&gclid=Cj0KCQiAzfuNBhCGARIsAD1nu-_YN3y1dwpN_8IPb-vI8PImYf4O_DdsTdrRjy1et553yNujlXHtD-4aAoFQEALw_wcB https://www.teradata.com/Resources/White-Papers/Price-Perfor...
  - jgrahamc 5y ago
    Uh, no.
    - egberts1 5y ago
      [Counter-]Citation, please.
      - jgrahamc 5y ago
        I am Cloudflare's CTO.
        egberts1 5y ago
        then you probably may want to talk to your marketing branch, you know, before you may get caught with your pants down … at something like a congressional hearing … or something.
        jgrahamc 5y ago
        What has that Teradata whitepaper got to do with Cloudflare?
XCSme 5y ago
I agree, the problem is not each site storing stats about their visitors, it's one site storing stats about all the visitors across many websites.

phgn 5y ago

If any network gets significant market share (like Google or Cloudflare), they can probably still follow you around by correlation of IP, user agent, routing location etc.

legitster 5y ago

I think there's some confusion about what Google Analytics does. It doesn't really engage in browser fingerprinting. It only tracks down to the individual session.

tata71 5y ago
Is that what they're slurping? Or just what they're showing you?
- legitster 5y ago
  I work in marketing systems administration. I've had access to over a dozen GA implementations, some for Fortune 500 companies. It doesn't remotely do what people in this thread seems to think it does. Which is bizarre given you can go set up an account for free and see for yourself. They seem to be confusing it with some of the third party ad tracking software. But GA is really dumb as a brick (and that's a feature, not a bug).
  - Nextgrid 5y ago
    > I've had access to over a dozen GA implementations, some for Fortune 500 companies. The concern isn't about what GA gives to its implementers, it's about what it collects internally. Google is an advertising company and has a financial incentive to stalk everyone. Their bad faith implementation of the GDPR consent flow (which IMO does not actually comply, but the regulators are incompetent or unwilling to enforce the law) proves it. The current regulatory environment doesn't do enough to discourage non-consensual data collection, so given this fact and the company's past history we need to assume the worst until proven otherwise.
  - kevin_thibedeau 5y ago
    They can keep GA dumb as cover and do their dirty work with tag manager or fonts.