Ask HN: How can I trust Google Analytics? • Hacker News Board

Re: Ask HN: How can I trust Google Analytics?

#41

Post by gesman » Thu, Jul 09, 2015, 4:09 PM UTC

gk1 wrote: post #30

gesman wrote: post #29

Taking advantage of GA deficiencies is widely used to inflate traffic figures during website sales negotiations. GA is really not a product you want to trust your business with. Best approach is to consider self-hosted analytics solutions. I built my own for my needs which also include combined features for security analytics to investigate malware attacks. GA is totally useless in this aspect.

> features for security analytics to investigate malware attacks. GA is totally useless in this aspect. Of course it is, it's a marketing analytics tool. It's totally useless for many things that aren't related to marketing.

Concealing IP addresses and ignoring spammy referrers doesn't help in marketing either.

Re: Ask HN: How can I trust Google Analytics?

#42

Post by shampine » Thu, Jul 09, 2015, 4:17 PM UTC

goferito wrote: post #39

gk1 wrote: post #25

I do marketing ops consulting and see this stuff all the time. First, let's get two things out of the way: 1. Yes, Google Analytics can be quite useless if you keep default settings with no configuration. 2. That doesn't mean you should jump straight to a self-hosted solution, or a paid solution, or throw up your hands and say "it'll never be accurate." For most use cases, GA is more than good enough to measure effec…

Hostname can also be easily faked

You also need to add regex filters for Campaign Source like:

To help keep down the spam.

Re: Ask HN: How can I trust Google Analytics?

#43

Post by magicalist » Thu, Jul 09, 2015, 4:23 PM UTC

goferito wrote: post #39

gk1 wrote: post #25

I do marketing ops consulting and see this stuff all the time. First, let's get two things out of the way: 1. Yes, Google Analytics can be quite useless if you keep default settings with no configuration. 2. That doesn't mean you should jump straight to a self-hosted solution, or a paid solution, or throw up your hands and say "it'll never be accurate." For most use cases, GA is more than good enough to measure effec…

Hostname can also be easily faked

That's true, but at that point you're really asking if it's possible to send JavaScript to an attacker to run and have them not be able to arbitrarily alter what that code does. In which case the answer is of course not, regardless of what the code is.

Usually the answer is gk1's above and keeping an eye on server logs to see if they match up with the client analytics data you're getting. You can even have events sent from both in GA or Piwik or whatever so you can compare them in the same UI, looking at e.g. event flow so that everyone who loaded some data first triggered a fetch event on the server for that data. Of course then your attacker can just get a botnet to start mindlessly doing page views of your site...

Re: Ask HN: How can I trust Google Analytics?

#44

Post by nicgutierrez » Thu, Jul 09, 2015, 4:47 PM UTC

gk1 wrote: post #25

I do marketing ops consulting and see this stuff all the time. First, let's get two things out of the way: 1. Yes, Google Analytics can be quite useless if you keep default settings with no configuration. 2. That doesn't mean you should jump straight to a self-hosted solution, or a paid solution, or throw up your hands and say "it'll never be accurate." For most use cases, GA is more than good enough to measure effec…

Good point. What about the PHP SDK though?

Re: Ask HN: How can I trust Google Analytics?

#45

Post by vgt » Thu, Jul 09, 2015, 5:15 PM UTC

If you are a Google Analytics Premium customer, your raw dataset is automatically available in BigQuery, so you can see down to every click and run your own SQL on it.

Re: Ask HN: How can I trust Google Analytics?

#46

Post by rotten » Thu, Jul 09, 2015, 7:27 PM UTC

Another caveat is that you have to wait 72 hours after the event before you can be reasonably sure the counts aren't going to change any more. Sure, you get some results immediately, but for some reason, some take a long time to settle. I'm guessing it is a massive eventually consistent distributed database, and that GA hits are going to nearest or least busy nodes and it just takes a while for them all to sync up.