7 ms·
Google presents method to circumvent automatic blocking of tag manager
- deleted 2y ago[deleted]
- AaronFriel 2y ago> Override the Host header to be equal to GTM-123456.fps.goog. Allow all cookies and query strings to be forwarded. Did a security team review this? This leaks session cookies for your domain to Google in a way GTM did not previously capture.
- mschuster91 2y ago> This leaks session cookies for your domain to Google in a way GTM did not previously capture. Only if you set up your session handler to emit cookies that apply to all subdomains instead of using the __Host- prefix and the SameSite=strict attribute [1]. [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se...
- Sayrus 2y agoI think the load balancer is the one forwarding all cookies to Google with this configuration. The browser has already sent this to your own domain/LB as first-party mode introduces yourdomain.com/page and yourdomain.com/metrics.
- lbarrow 2y agoI don't think this would prevent the session cookie from being sent to tag manager. The tag manager document describes setting up a specific path on the website's normal domain, not using a subdomain.
- charrondev 2y agoYou can issue cookies on a sub path though.
- toast0 2y agoYou can, but it's typical to use / for login cookies. And I don't think you can issue cookies that exclude a sub path.
- AaronFriel 2y agoThis is incorrect, the documentation in the article involves configuring an L7 load balancer to route a path on the same domain as the origin to Google Tag Manager. This means even `SameSite=strict`, `Secure`, `HttpOnly` cookies will be sent to GTM, if the instruction I quoted is followed to pass all cookies and query strings. It's weird that the document specifically says "all cookies" - that gives GTM access to every cookie sent to your application.
- occz 2y agoI guess this would defeat DNS-based blocking approaches, but more sophisticated tools like uBlock can still cope with it, albeit requiring larger blocklists.
- kimsey0 2y agoThat becomes a problem when Google Chrome limits the number of filter rules extensions can add. https://developer.chrome.com/docs/extensions/develop/concepts/content-filtering#bundle_filter_rules_with_your_extension https://developer.chrome.com/docs/extensions/develop/concept...
- Semaphor 2y agoOnly for people using chrome.
- TheCapeGreek 2y agoAKA the vast majority of browsers out there.
- meigwilym 2y agoFrankly, this just gives more reasons to switch.
- n_ary 2y agoSadly, most people don't care or understand these "tech whiz" things. Here in our little corner of EU, I see massive Chrome adverts everywhere about how convenient it is to save your password in chrome password manager, sync bookmarks across devices, how all other browsers are baddies leaking your private details and chrome can save your data and other fear mongering adverts. Basically, these adverts are blasted at you 5-8 times a day depending on how many YouTube videos/shorts you watch, also I recall seeing same advert even on someone's FB timeline being shared by their friends to switch to chrome.
- 2y ago
- gliptic 2y ago> Choose any path you want for setting up first-party mode. Examples of paths you might want to use include: /metrics, /securemetric, /analytics, or preferably a random alphanumeric string that you don't use on your website already. Ah, yes, _preferably_ some random string that is hard to block rather than the descriptive ones.
- krackers 2y agoWow just in time for ManifestV3, which would prevent clever heuristics like looking at the entropy of the path segment.
- iamacyborg 2y agoWell yes, how else will you > The setup in this documentation will help you recover X% more measurement signals on your website.
- dotancohen 2y agoObviously "recover" is not the correct word here. Maybe "swindle" is a better word, considering they are actively circumventing the users' wishes to block tracking.
- rogual 2y agoYou know, like malware.
- soraminazuki 2y ago"Like" is being too generous when we know what, why, and how they do what they do.
- tzs 2y agoIt's more like the opposite of what malware does--malware usually names things so they will look like something you want. Like malware would be naming the directory something like /images or /fonts.
- 2y ago
- SquareWheel 2y agoSeems a bit simpler than setting up a Server Container. Am I correct in understanding that this is meant to run on a CDN or load balancer? I'm curious what kind of effect is has on performance vs making direct requests to endpoints.
- MzHN 2y agoFirst-party tracking has been increasing in the last couple years or so I've been told. When I first heard about it I decided from now on I'll run uBlock Origin in default JavaScript off mode. It's a checkbox in the settings. I only re-enable on a per-site basis if I have no other choice. I prefer this over NoScript, since it's one click and I still get all the uBlock filters even after enabling JS. I've been using web like this for over a year now, and while it's painful, it's also enlightening.
- Jakob 2y agoI do that, too. cmd-J as shortcut to enable JavaScript without needing to reload. In my experience once I hardcode which websites I need JavaScript on, browsing becomes painless. And much faster obviously.
- tempest_ 2y agoAlright but the last time I did this the answer to "which websites I need JavaScript on" was "All of them". Is that still the case.
- mywittyname 2y agoYou don't need all of the javascript for all websites. In my experience, I enable javascript to load from probably 10-20% of domains (using noscript).
- MasterYoda 2y agoHow do you set the shortcut? When I press cmd-j the Library in Firefox opens. I have checked "Disbale javascript" in settings in uBO. I guess that setting will be disable for just the site i visit when i click cmd-j?
- Jakob 2y agoThis shows the keyboard shortcut configuration: https://github.com/gorhill/uBlock/wiki/Keyboard-shortcuts#accessing-shortcut-configuration https://github.com/gorhill/uBlock/wiki/Keyboard-shortcuts#ac... The setting is called "Relax blocking mode" and will enable JavaScript (but keep all ad blockers) if JavaScript is disabled by default. In summary, for Firefox it’s under about:addons > gear icon > Manage Extension Shortcuts and for Chrome you can set it under chrome://extensions/shortcuts
- threeseed 2y agoGoogle has had a similar approach for a while now with server side containers. Works flawlessly to prevent ad-blockers from blocking tracking tags and integrates with platforms like Shopify to allow their user tracking to be hidden and unblockable. And because Chrome allows long-lasting cookies sites can track you for retargeting for over a year compared to a week for Safari. And because they add every API under the sun fingerprinting is 99% effective. Thanks Google !
- manuelmoreale 2y ago> Thanks Google I have to ask because you never know: was this sarcasm?
- aembleton 2y agoYes
- manuelmoreale 2y agoOk thank you. I though it was but I read some wild takes on this site so I had to ask before typing an unnecessary rant.
- deleted 2y ago[deleted]
- batch12 2y agoIs the filename still gtag.js?
- jwr 2y agoAs I read these comments, there is plenty of outrage at how Google keeps invasively tracking us. And rightly so. But I wonder about the other side of it: in my SaaS business I made a point of not using any tracking whatsoever and not letting Google peek into my users' behaviors. So, no analytics, no Google Fonts, no tag manager (obviously). But I don't think any of my users noticed, and I don't think any of them care.
- nemomarx 2y agoIf they installed stuff to block it, that would be a sign they care about it at least in part? It's hard for me to tell the difference between a site with no ads and a site with some ads if I'm always using unlock and all. I just care that it ends up not showing me ads.
- iamacyborg 2y agoIt’s less about the ads for me so much as having some mechanism in place to prevent unauthorised data slurping. Enough orgs have misconfigured cookie consent that this is fairly critical to me.
- _the_inflator 2y agoI think that we wear different hats during the day. As a product manager of a SaaS Enterprise application, I value data to improve the product; as a person outside the work environment, I value privacy. Tough call. On the other hand, I believe that browser tracking is only a small percentage of data being gathered about us, aggregated, and processed. There are so many ways to track us, and being clever ain't really a way to get out of this system. Too late, too sophisticated.
- tpxl 2y ago> As a product manager of a SaaS Enterprise application, I value data to improve the product. You can gather about 100% of useful data for improving SaaS Enterprise applications without selling out every single one of your users to Google, and it's not even hard.
- soraminazuki 2y ago> Setting up first-party mode may help your tag setup perform better, resulting in recovery of lost measurement signals, in a privacy-safe way. Does Google explain what "privacy" means in this context? I'm unfamiliar with Google jargon, but I'm sure it's completely different from the dictionary definition.
- oceanstone 2y agoThey mention full IP obfuscation.
- soraminazuki 2y agoThat's hardly assuring considering they still make detailed profiles of everyone regardless of whether they even have a Google account.
- noashavit 2y agothis ^^
- zokier 2y agoOnly weird thing is why they are so late to the party; first-party proxying is so obvious (and not novel) solution, they could have pushed this out already five or ten years ago. This is also the reason why I have been always dubious on PiHole and other DNS based or network level blocking solutions. Blacklisting DNS entries or IP addresses was never going to be workable approach.
- leipert 2y agoIn the last 24h my PiHole blocked 6500 queries. Maybe I don’t catch some first party analytics, but I am sure catching loads of other things.
- nissarup 2y agoDoes this not change who is responsible for the data shared with Google? With this the owner of the host is sending the scripts collecting data, where before it was Googles servers.
- Sephr 2y agoThis leads to an interesting phenomenon that increases tracking in some poorly designed browsers, despite the wishes of both site owners and visitors. Sites will end up using this, and some site owners will also install privacy compliance solutions to regulate these trackers in accordance with user rights and consent. Misguided browsers such as Brave bluntly block some privacy compliance solutions, resulting in an increase in unconsensual tracking from first-party-fronted trackers.
- noashavit 2y agoI was waiting for something like this since the "death of the third-party cookie"
- Animats 2y ago"The setup in this documentation will help you recover X% more measurement signals on your website." Caught! The conclusion was written before they actually knew if it worked.
- omoikane 2y ago"X%" here likely means "single digit number of percentage points", as opposed to something like "XX%".
- OptionOfT 2y agoIn general I see more and more websites switching to using the actual domain to bring in ads. For example, IMDb hosts ads on the actual domain (no subdomain) making it impossible to block that script with DNS blocking. And on iOS they employ certificate pinning so you can't even inspect the traffic with MITMProxy.