3 ms·

i have always been irked by the fact that my bank and most websites behind an https connection (especially after login) have ANY external resources. this is a m

i have always been irked by the fact that my bank and most websites behind an https connection (especially after login) have ANY external resources. this is a major flaw on numerous levels; how such a thing is still allowed by browser vendors is IMO borderline voluntary negligence. all such sites, if they must host external resources, should do so only within an iframe w/sandbox [1]. the fact that the external resource is also "https" [on some foreign property] is completely and utterly meaningless. [1] http://www.w3schools.com/tags/att_iframe_sandbox.asp http://www.w3schools.com/tags/att_iframe_sandbox.asp

jacquesm 11y ago
My bank (ABN/Amro in NL) is even worse, they not only include external resources, they include external resources that are critical for their site to function, in other words, if I disable the various trackers and analytics elements on their page the site simply no longer works. You'd expect the opposite!
- leeoniya 11y ago
  wow! i think there should be a place on the internet for publicly naming and shaming such practices. like a Darwin Award or Razzies [1] of webdev. [1] https://en.wikipedia.org/wiki/Golden_Raspberry_Awards https://en.wikipedia.org/wiki/Golden_Raspberry_Awards
  - jacquesm 11y ago
    That's one of the things I'm considering right now. To re-write the top 1000 or so with annotations and then to sort them by category as well as an example of a site that is 'clean' in the same category. There are a ton of offenders and some of them are very well known. One of the interesting things you find when you look at this data is that the bigger sites really do have their stuff set up better (for instance, by using in-house analytics) but there are lots and lots of exceptions and some of them are quite shocking. For instance, I've found two major car brands that include evercookies on their corporate websites in Eastern Europe, a thing that no respectable company should ever do. I suspect an ad agency is the cause of this so I'm still digging away at that.
    - leeoniya 11y ago
      frankly, i am much less bothered by the cross-domain visit tracking aspects than the js injection. cookies are not going anywhere in a thriving, behavioral analysis driven ad industry. i dont know how logged impressions/clicks can be trusted for accuracy if they had to be proxied by or entrusted to their customer's servers. i will live with cookies, but absolutely will not live with injected js behind https.
    - corford 11y ago
      If you want a never ending list of shocking offenders, be sure to check out most airline sites. They really are abysmal.

jacquesm 11y ago

My bank (ABN/Amro in NL) is even worse, they not only include external resources, they include external resources that are critical for their site to function, in other words, if I disable the various trackers and analytics elements on their page the site simply no longer works. You'd expect the opposite!

leeoniya 11y ago
wow! i think there should be a place on the internet for publicly naming and shaming such practices. like a Darwin Award or Razzies [1] of webdev. [1] https://en.wikipedia.org/wiki/Golden_Raspberry_Awards https://en.wikipedia.org/wiki/Golden_Raspberry_Awards
- jacquesm 11y ago
  That's one of the things I'm considering right now. To re-write the top 1000 or so with annotations and then to sort them by category as well as an example of a site that is 'clean' in the same category. There are a ton of offenders and some of them are very well known. One of the interesting things you find when you look at this data is that the bigger sites really do have their stuff set up better (for instance, by using in-house analytics) but there are lots and lots of exceptions and some of them are quite shocking. For instance, I've found two major car brands that include evercookies on their corporate websites in Eastern Europe, a thing that no respectable company should ever do. I suspect an ad agency is the cause of this so I'm still digging away at that.
  - leeoniya 11y ago
    frankly, i am much less bothered by the cross-domain visit tracking aspects than the js injection. cookies are not going anywhere in a thriving, behavioral analysis driven ad industry. i dont know how logged impressions/clicks can be trusted for accuracy if they had to be proxied by or entrusted to their customer's servers. i will live with cookies, but absolutely will not live with injected js behind https.
  - corford 11y ago
    If you want a never ending list of shocking offenders, be sure to check out most airline sites. They really are abysmal.