5 ms·

Good writeup! It certainly seems absurd for banks, investment firms, government services, etc. to just allow third-party analytics startups to inject whatever c

Good writeup! It certainly seems absurd for banks, investment firms, government services, etc. to just allow third-party analytics startups to inject whatever code they want in between the user and the product. It's like if the bank hired contractors from Google, LivePerson, Tealium, and Yext to listen in on every phone call I make to the bank, for "analytics purposes". Um, is it really necessary for them to hear my account number and everything? Oh, you say they're plugging their ears?

kmlx 2y ago
i read it twice and i still don’t understand the article. is this site complaining about 3rd party analytics? there is also a table further down that shows various banks sharing data with… themselves? citibank will share data with citibank, and first direct (aka hsbc) will obviously share data with hsbc. can someone explain what this article is actually about?
- markarichards 2y ago
  > i read it twice and i still don’t understand the article. Any recommendations to improve are welcome > is this site complaining about 3rd party analytics? If a bank page includes a script tag that loads third party JavaScript from a non-bank server, then what is to stop that script from capturing data, submitting forms, spoofing page content? The bank has effectively given these third parties unaudited remote access, via remote code execution, to consumers bank accounts. A bank can safely use third party analytics if they adopt appropriate security measures, SRI is likely be one, but alone might not be enough. In the cases found here, there is no SRI protection or similar to protect users from the third parties doing what they like on the page, acting as customers. > there is also a table further down that shows various banks sharing data with… themselves? This is oddity due to the test suite spotting JS from a a separate domain for the same bank ( https://gitlab.com/markalanrichards/access-test/-/blob/main/src/urlToOwner.js?ref_type=heads https://gitlab.com/markalanrichards/access-test/-/blob/main/... ): thank you for highlighting this and when I get time I hope to improve this I hope to filter it out.

kmlx 2y ago

i read it twice and i still don’t understand the article. is this site complaining about 3rd party analytics? there is also a table further down that shows various banks sharing data with… themselves? citibank will share data with citibank, and first direct (aka hsbc) will obviously share data with hsbc. can someone explain what this article is actually about?

markarichards 2y ago
> i read it twice and i still don’t understand the article. Any recommendations to improve are welcome > is this site complaining about 3rd party analytics? If a bank page includes a script tag that loads third party JavaScript from a non-bank server, then what is to stop that script from capturing data, submitting forms, spoofing page content? The bank has effectively given these third parties unaudited remote access, via remote code execution, to consumers bank accounts. A bank can safely use third party analytics if they adopt appropriate security measures, SRI is likely be one, but alone might not be enough. In the cases found here, there is no SRI protection or similar to protect users from the third parties doing what they like on the page, acting as customers. > there is also a table further down that shows various banks sharing data with… themselves? This is oddity due to the test suite spotting JS from a a separate domain for the same bank ( https://gitlab.com/markalanrichards/access-test/-/blob/main/src/urlToOwner.js?ref_type=heads https://gitlab.com/markalanrichards/access-test/-/blob/main/... ): thank you for highlighting this and when I get time I hope to improve this I hope to filter it out.