11 ms·

There are two primary issues here: the prevalence of Google Analytics and the unencrypted nature of the majority of websites. Google Analytics is on a substant

by Smerity 13y ago

There are two primary issues here: the prevalence of Google Analytics and the unencrypted nature of the majority of websites. Google Analytics is on a substantial proportion of the Internet. 65% of the top 10k sites, 63.9% of the top 100k, and 50.5% of the top million[1]. My own partial results from a research project I'm doing using Common Crawl estimates approximately 39.7% of the 535 million pages processed so far have GA on them[2]. That means that you're basically either on a site that has Google Analytics or you've likely just left one that did. If the page you're on has Google Analytics and isn't encrypted, the Javascript request and response is in the clear. That JS request to GA also has your referrer in it, in the clear. The aim of my research project is to end with understanding what proportion of links either start or end in a page with Google Analytics. If it starts with Google Analytics, your present "location" is known. If the link ends with Google Analytics, but doesn't start with it, then when you reach that end page, the referrer sent to GA in the clear will state where you came from. All of this is then tied to your identity. If people are interested when I get the results of my research, ping me. I'll also write it up and submit it to HN as it would seem to be of interest. [1]: http://trends.builtwith.com/analytics/Google-Analytics http://trends.builtwith.com/analytics/Google-Analytics [2]: http://www.youtube.com/watch?v=pkoIUmP5ma8 http://www.youtube.com/watch?v=pkoIUmP5ma8 (GA specific results at 1:20)

quesera 13y ago
Please do post your research when it's cooked. It sounds like useful stuff. Firefox, ABE, NoScript, Request Policy, Ghostery, HTTPS-everywhere, hygiene. The irony of my militant approach toward privacy is that I probably make myself more interesting to would-be eavesdroppers by my carefulness than I would if they could see it all -- I'm just not that interesting. On the plus side, the LCD of legitimate-threat hostiles is greatly increased. I'm fairly boring even to neighbors and law enforcement and copyright holders and scam artists and advertisers. I imagine I'm pretty stultifying to nation-state actors. :) Still, I'd like everyone else to join me so that I can get lost in the crowd. The untracked, encrypted, well-rested crowd. Come on in, the water's fine.
- dunham 13y ago
  I use Ghostery/Adblock, but I have found that it breaks some web sites (whose javascript expects the tracking code to be loaded). BTW, if you're using Chrome, you might also want to look into the "Users" section of preferences. You can create multiple user profiles with separate history, cookies, cache, etc. You can have a different user profile per window at the same time. (After you create a second user, there will be an icon in the top right corner of the window to open a window as another user.) I like to use this to protect against CSRF. (I do financial stuff as another profile and facebook as another profile.) It's also useful for QA if you need to be logged in as multiple people at the same time.
  - deleted 13y ago
    [deleted]
- rosser 13y ago
  My approach is similar to yours. I also take the step of using services I'm persistently logged into in different browsers than the one I do my general browsing in. I also share your concern that my (lack of a) footprint makes me an outlier, and thus inherently more interesting to an adversary with the power and reach of No Such Agency. There's precisely zero I can do about that, without compromising my local objective of not being followed by every damned website, though, so I just carry on.
- bigiain 13y ago
  Idea: A service to allow people to anonymously "share" Google tracking cookies. Perhaps a local transparent proxy that MITMs all your cleartext Google requests, and re-writes the tracking codes on the fly, submitting the ones you've been given and retrieving other "real" ones from a service (probably a TOR hidden service?)
- sdoering 13y ago
  Greetings. I nearly have the same policy, regarding surfing and my addons. I would only advise against Ghostery, as they whitelist some trackers, if being paid. With every update I had to reselect these trackers. And Evidon (Ghostery's mothership) selling usageinformation really bugs me: http://venturebeat.com/2012/07/31/ghostery-a-web-tracking-blocker-that-actually-helps-the-ad-industry/ http://venturebeat.com/2012/07/31/ghostery-a-web-tracking-bl... I would recommend the FF-addon Diconnect: https://addons.mozilla.org/en-US/firefox/addon/disconnect/ https://addons.mozilla.org/en-US/firefox/addon/disconnect/ Does anybody have an idea, how I could make my own sites secure in a relatively cheap way? Just a personal site with not that much traffic, so spending much money seems a bit off to me. Ideas?
malandrew 13y ago
Can't we simply block all requests to Google Analytics so that the GA javascript is never loaded?
- joshfraser 13y ago
  Sure, just black hole www.google-analytics.com and ssl.google-analytics.com in your hosts file.
  - fjarlq 13y ago
    I've done this for a year or so now.. it works fine. Add this line to your hosts file: 0.0.0.0 google-analytics.com ssl.google-analytics.com www.google-analytics.com
- Hellenion 13y ago
  if you have iptables you can try amici: http://github.com/upwhere/amici http://github.com/upwhere/amici
g8oz 13y ago
Does blocking third party cookies stop Google Analytics from being used by the NSA in the way the article described?
- dangrossman 13y ago
  Google Analytics uses first-party cookies. They're set and read on each website's own domain by JavaScript. Blocking third-party cookies wouldn't have any effect.
droopybuns 13y ago
+1'ing more encouragement. I've been in the internet industry for a while now. For what it's worth, I think your thesis has significant value.
DannyBee 13y ago
"My own partial results from a research project I'm doing using Common Crawl estimates approximately 39.7% of the 535 million pages processed so far have GA on them" This is interesting. I would have actually expected more. The last time I remember someone analyzing this, I believe the result was "<script ... ga.js>" was the most popular tag on the web by far. This was, however, a few years ago.
mike-cardwell 13y ago
Why do we still have referrers? They don't allow us to do anything that we wouldn't be able to do without them. If Mozilla and Google made a statement today saying, "We'll be removing referrers from cross site requests in 6 months time for Chrome and Firefox.", the tiny tiny proportion of sites that are using them for real functionality will have plenty of time to update. Of course, as a web developer, it's useful to be able to see where people came from. But we don't have any right to that information. As an end-user, why the hell is my browser giving you this information for no reason when it doesn't have to? I've been using RefControl for Firefox for years now. It fakes the referrer, setting it to the root of the domain being requested. This hasn't ever caused me any problems, so there can't be that many sites that rely on it. I don't give a shit about your analytics or how much money you think you'll lose from referrers disappearing. Privacy is more important.
- leephillips 13y ago
  You ask, "Why do we still have referrers?", but then you answer your question: "as a web developer, it's useful to be able to see where people came from." You are of course correct that we don't have a "right" to this information. But I've discovered, many times, through the referrers in my logs, links to my pages from some very interesting places that I might not have discovered otherwise (because the link information that Google discloses is woefully incomplete). Any user who wants to hide referrer information can easily to do in a variety of ways. For example, I wrote a bookmarklet that does this for you: http://lee-phillips.org/norefBookmarklet/ http://lee-phillips.org/norefBookmarklet/
  - mike-cardwell 13y ago
    Defaults are important. Most users of the web don't know referrers exist. It's irrelevant how useful you find the information. You'd probably find it useful to know the name and email address of everyone that visits your site too... So?
- JohnTHaller 13y ago
  For lots of us using basic CDN services, we enable referrer checks to ensure that folks aren't hotlinking images or direct linking downloads from other sites. These CDNs allow basic blocking based on referrers. You usually set it to only permit when there is a referrer from your own domain as well as blank referrers (if the CDN supports it) since most privacy conscious folks will disable referrer rather than fake it. We don't actually care that you don't provide a referrer, we just don't want other sites using our images in their own pages (leeching our bandwidth we pay for) or direct linking to binary downloads (bypassing our site with our advertising or revenue possibilities or branding but using our bandwidth).
cataflam 13y ago
> That JS request to GA also has your referrer in it, in the clear. (...) If the link ends with Google Analytics, but doesn't start with it, then when you reach that end page, the referrer sent to GA in the clear will state where you came from. I'm curious. In that case, the GA JS is requested from what you call the "end page", so the referrer it has should be the "end page", not the one before it.
bdt101 13y ago
Google Analytics uses only a first party cookie to identify visitors. That means your id is different on each site you visit. You therefore cannot track a unique visitor across the web using GA cookies. Google Analytics requests are also only unencrypted if the site itself is unencrypted, so the fact that the GA request includes the referrer doesn't seem relevant (since the referrer would have already been transferred in the clear in the Referer header on the initial HTTP request.)
declan 13y ago
I wish you luck with your research, but I'm not sure your look at Google Analytics is relevant to this discussion or the Washington Post article that started this thread. First, as <bdt101> pointed out, you "cannot track a unique visitor across the web using GA cookies" because of the way they're designed: https://news.ycombinator.com/reply?id=6889120&whence=item%3fid%3d6885448 https://news.ycombinator.com/reply?id=6889120&whence=item%3f... Second, the NSA doc as excerpted in the WashPost article talks only about Google's PREF cookie, which is set only when you go to say Google.com, not when you go to a non-Google property. It's a first-party cookie used for things like saving language preferences when you're not logged in, not for advertising across other properites. (That's what the Doubleclick cookie is for.)
aethertap 13y ago
Regarding the prevalence of GA, I've been experimenting with self-hosting analytics on my own domains using piwik [1]. So far, I'm pretty pleased with it and I feel somewhat better knowing that my users' data doesn't go to any third parties. It does everything I want it to do (so far), but I'm not an analytics power user by any means. [1] - http://piwik.org/ http://piwik.org/

by Smerity 13y ago

quesera 13y ago

Please do post your research when it's cooked. It sounds like useful stuff. Firefox, ABE, NoScript, Request Policy, Ghostery, HTTPS-everywhere, hygiene. The irony of my militant approach toward privacy is that I probably make myself more interesting to would-be eavesdroppers by my carefulness than I would if they could see it all -- I'm just not that interesting. On the plus side, the LCD of legitimate-threat hostiles is greatly increased. I'm fairly boring even to neighbors and law enforcement and copyright holders and scam artists and advertisers. I imagine I'm pretty stultifying to nation-state actors. :) Still, I'd like everyone else to join me so that I can get lost in the crowd. The untracked, encrypted, well-rested crowd. Come on in, the water's fine.

dunham 13y ago
I use Ghostery/Adblock, but I have found that it breaks some web sites (whose javascript expects the tracking code to be loaded). BTW, if you're using Chrome, you might also want to look into the "Users" section of preferences. You can create multiple user profiles with separate history, cookies, cache, etc. You can have a different user profile per window at the same time. (After you create a second user, there will be an icon in the top right corner of the window to open a window as another user.) I like to use this to protect against CSRF. (I do financial stuff as another profile and facebook as another profile.) It's also useful for QA if you need to be logged in as multiple people at the same time.
- deleted 13y ago
  [deleted]
rosser 13y ago
My approach is similar to yours. I also take the step of using services I'm persistently logged into in different browsers than the one I do my general browsing in. I also share your concern that my (lack of a) footprint makes me an outlier, and thus inherently more interesting to an adversary with the power and reach of No Such Agency. There's precisely zero I can do about that, without compromising my local objective of not being followed by every damned website, though, so I just carry on.
bigiain 13y ago
Idea: A service to allow people to anonymously "share" Google tracking cookies. Perhaps a local transparent proxy that MITMs all your cleartext Google requests, and re-writes the tracking codes on the fly, submitting the ones you've been given and retrieving other "real" ones from a service (probably a TOR hidden service?)
sdoering 13y ago
Greetings. I nearly have the same policy, regarding surfing and my addons. I would only advise against Ghostery, as they whitelist some trackers, if being paid. With every update I had to reselect these trackers. And Evidon (Ghostery's mothership) selling usageinformation really bugs me: http://venturebeat.com/2012/07/31/ghostery-a-web-tracking-blocker-that-actually-helps-the-ad-industry/ http://venturebeat.com/2012/07/31/ghostery-a-web-tracking-bl... I would recommend the FF-addon Diconnect: https://addons.mozilla.org/en-US/firefox/addon/disconnect/ https://addons.mozilla.org/en-US/firefox/addon/disconnect/ Does anybody have an idea, how I could make my own sites secure in a relatively cheap way? Just a personal site with not that much traffic, so spending much money seems a bit off to me. Ideas?

malandrew 13y ago

Can't we simply block all requests to Google Analytics so that the GA javascript is never loaded?

joshfraser 13y ago
Sure, just black hole www.google-analytics.com and ssl.google-analytics.com in your hosts file.
- fjarlq 13y ago
  I've done this for a year or so now.. it works fine. Add this line to your hosts file: 0.0.0.0 google-analytics.com ssl.google-analytics.com www.google-analytics.com
Hellenion 13y ago
if you have iptables you can try amici: http://github.com/upwhere/amici http://github.com/upwhere/amici

g8oz 13y ago

Does blocking third party cookies stop Google Analytics from being used by the NSA in the way the article described?

dangrossman 13y ago
Google Analytics uses first-party cookies. They're set and read on each website's own domain by JavaScript. Blocking third-party cookies wouldn't have any effect.

droopybuns 13y ago

+1'ing more encouragement. I've been in the internet industry for a while now. For what it's worth, I think your thesis has significant value.

DannyBee 13y ago

"My own partial results from a research project I'm doing using Common Crawl estimates approximately 39.7% of the 535 million pages processed so far have GA on them" This is interesting. I would have actually expected more. The last time I remember someone analyzing this, I believe the result was "<script ... ga.js>" was the most popular tag on the web by far. This was, however, a few years ago.

mike-cardwell 13y ago

Why do we still have referrers? They don't allow us to do anything that we wouldn't be able to do without them. If Mozilla and Google made a statement today saying, "We'll be removing referrers from cross site requests in 6 months time for Chrome and Firefox.", the tiny tiny proportion of sites that are using them for real functionality will have plenty of time to update. Of course, as a web developer, it's useful to be able to see where people came from. But we don't have any right to that information. As an end-user, why the hell is my browser giving you this information for no reason when it doesn't have to? I've been using RefControl for Firefox for years now. It fakes the referrer, setting it to the root of the domain being requested. This hasn't ever caused me any problems, so there can't be that many sites that rely on it. I don't give a shit about your analytics or how much money you think you'll lose from referrers disappearing. Privacy is more important.

leephillips 13y ago
You ask, "Why do we still have referrers?", but then you answer your question: "as a web developer, it's useful to be able to see where people came from." You are of course correct that we don't have a "right" to this information. But I've discovered, many times, through the referrers in my logs, links to my pages from some very interesting places that I might not have discovered otherwise (because the link information that Google discloses is woefully incomplete). Any user who wants to hide referrer information can easily to do in a variety of ways. For example, I wrote a bookmarklet that does this for you: http://lee-phillips.org/norefBookmarklet/ http://lee-phillips.org/norefBookmarklet/
- mike-cardwell 13y ago
  Defaults are important. Most users of the web don't know referrers exist. It's irrelevant how useful you find the information. You'd probably find it useful to know the name and email address of everyone that visits your site too... So?
JohnTHaller 13y ago
For lots of us using basic CDN services, we enable referrer checks to ensure that folks aren't hotlinking images or direct linking downloads from other sites. These CDNs allow basic blocking based on referrers. You usually set it to only permit when there is a referrer from your own domain as well as blank referrers (if the CDN supports it) since most privacy conscious folks will disable referrer rather than fake it. We don't actually care that you don't provide a referrer, we just don't want other sites using our images in their own pages (leeching our bandwidth we pay for) or direct linking to binary downloads (bypassing our site with our advertising or revenue possibilities or branding but using our bandwidth).

cataflam 13y ago

> That JS request to GA also has your referrer in it, in the clear. (...) If the link ends with Google Analytics, but doesn't start with it, then when you reach that end page, the referrer sent to GA in the clear will state where you came from. I'm curious. In that case, the GA JS is requested from what you call the "end page", so the referrer it has should be the "end page", not the one before it.

bdt101 13y ago

Google Analytics uses only a first party cookie to identify visitors. That means your id is different on each site you visit. You therefore cannot track a unique visitor across the web using GA cookies. Google Analytics requests are also only unencrypted if the site itself is unencrypted, so the fact that the GA request includes the referrer doesn't seem relevant (since the referrer would have already been transferred in the clear in the Referer header on the initial HTTP request.)

declan 13y ago

I wish you luck with your research, but I'm not sure your look at Google Analytics is relevant to this discussion or the Washington Post article that started this thread. First, as <bdt101> pointed out, you "cannot track a unique visitor across the web using GA cookies" because of the way they're designed: https://news.ycombinator.com/reply?id=6889120&whence=item%3fid%3d6885448 https://news.ycombinator.com/reply?id=6889120&whence=item%3f... Second, the NSA doc as excerpted in the WashPost article talks only about Google's PREF cookie, which is set only when you go to say Google.com, not when you go to a non-Google property. It's a first-party cookie used for things like saving language preferences when you're not logged in, not for advertising across other properites. (That's what the Doubleclick cookie is for.)

aethertap 13y ago

Regarding the prevalence of GA, I've been experimenting with self-hosting analytics on my own domains using piwik [1]. So far, I'm pretty pleased with it and I feel somewhat better knowing that my users' data doesn't go to any third parties. It does everything I want it to do (so far), but I'm not an analytics power user by any means. [1] - http://piwik.org/ http://piwik.org/