Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I recorded user behaviour on my competitor’s websites

dejanseo.com.au

Post reply on HN
Print view View original

101–110 of 329 posts

Re: How I recorded user behaviour on my competitor’s websites

#101

Post by stef25 »

dorgo wrote: post #97
stef25 wrote: post #83

Earlier quoted context omitted.

Sorry, calling BS on this one. By simply copying a site you get flagged as having duplicate content. Then there's DMCA. I've seen an e-commerce site's homepage get de-indexed, killing the business, due to 1 single image being used for which the site owner didn't have copyright. SEO undoubtedly has many shady practises, but "professional SEO" is actually really difficult and involves much more than cloning competitor…

"duplicate content" is a problem for both, the original site and the copycat. But the copycat doesn't rely on SEO in this example. It just buys traffic in AdWords. So the duplicate content penalty would harm only the original site.

Google must surely be able to tell the difference between the original site and copying site because of timestamps. How would an Adwords campaign change that?

Re: How I recorded user behaviour on my competitor’s websites

#102

Post by jimbauwens »

dejanseo wrote: post #59
cyrusshepard wrote: post #20

Earlier quoted context omitted.

FWIW, Dan (the author) has an outstanding reputation for professionalism and integrity in the marketing world. If he says he did something for ethical reasons, to those who know him, he's earned the benefit to be believed. (If you don't know him, you'd be forgiven for being suspicious) And credit should be given to him for educating everyone on this exploit.

Thank you Cyrus. I thought it would be obvious that this isn't a practical tactic a reputable brand could risk doing.

While it is clear that you did not have any bad intentions, you should never have published it on the web. Based on your earlier comment "It worked a little too well" it becomes clear that multiple users were tricked by your site and that you possibly even intercepted submitted forms ("I gasped when I realised I can actually capture all form submissions and send them to my own email.").

You misled people and breached their privacy. This is as simple as it gets, even if it was for an experiment (though leaving the site online in some other form still raises a lot of question marks..).

My advice for you is to perform future experiments locally, not on the web and make sure people participating in your experiment are aware.

Re: How I recorded user behaviour on my competitor’s websites

#103

Post by King-Aaron »

mrob wrote: post #4
lukestevens wrote: post #2

This is an interesting yet disturbing case of blackhat SEO and phishing, where the site owner hijacks the back button and sends visitors to fake sites where he can observe their behaviour. FTA: Here’s what I did: 1. User lands on my page (referrer: google) 2. When they hit “back” button in Chrome, JS sends them to my copy of SERP 3. Click on any competitor takes them to my mirror of competitor’s site (noindex) 4. Now…

Yet another reason to browse with JS disabled by default.

That's a reasonable course of action until you need to use the internet for pretty much anything.

Re: How I recorded user behaviour on my competitor’s websites

#104

Post by markdown »

While we're on this topic, I have a related situation and wonder if my case is common:

I built a brochure site for a mom-and-pop business a decade ago. The domain expired some time ago, and it was snapped up by someone who repopulated it with the original content scraped from the Internet Archive. It looks and behaves exactly like it did when I controlled it, except that a phrase in the frontpage content now links to some supplement sale site.

Is there a name for this SEO bullshitery? What can someone do who isn't American and who therefore can't file a DMCA.

Re: How I recorded user behaviour on my competitor’s websites

#105

Post by dorgo »

A2017U1 wrote: post #56
Nadya wrote: post #37

Earlier quoted context omitted.

>Most of the modern web is unusable with javascript disabled This isn't wrong - but it assumes most of the modern web is worth using . Most of the modern web isn't worth browsing, and every site I've ever come across that is worth reading works just fine without Javascript. I'll continue to browse the internet with Javascript disabled-by-default. It's a surprisingly good filter. With that being said - while this is "…

> assumes most of the modern web is worth using But it is, are you really going to ignore reading some huge breakthrough in physics because the site uses react? Also in many situations there's absolutely no other choice. Government sites, e-stores, banking. And then there's the buildup of recorded urls. Private browsing is somewhat less useful when your scipt blocker whitelist is full of porn sites. I use it for secu…

>dding another 3 clicks, then another 2 for the inline JavaScript contained within after reload makes the internet incredibly annoying to use.

Yes, it is annoying. It reminds me each time how annoying websites are which use Javascript for things which could be done without. And it lets me search for alternatives or just abandon such websites.

Re: How I recorded user behaviour on my competitor’s websites

#106

Post by dvfjsdhgfv »

tralarpa wrote: post #98

This is really a good example why it is so difficult for security experts to do research and experiments where real users are involved. What Mr. Petrovic did is illegal in most developed countries: copyright violation (copying web pages) and monitoring and storing user behavior without their consent (and, even worse, by phishing). It doesn't matter that he did it for a "very brief period of time (for ethical reasons)…

When you do security work, that's an important part of your job. Sure, in many scenarios like traditional pentesting you can probably do fine within the legal boundaries in most jurisdictions, but as soon as you do serious security research when you actually test your ideas in practice, you're likely to cross the line sooner or later. It's a difference between "it should probably work" and "yes, it worked, I tried it." If you're afraid of the latter, don't get involved in security as you'll get burned sooner than later.

Re: How I recorded user behaviour on my competitor’s websites

#107

Post by rkangel »

stef25 wrote: post #81
TekMol wrote: post #58

Earlier quoted context omitted.

Copying someone elses site and tricking their users to use your copy is a copyright violation and fraud. Nothing cool about it.

It's a POC with no intention other than seeing if it would be possible, isn't it?

While that might mean that it's OK ethically (I'm not sure either way), that doesn't make a difference legally.

If you go and pick the lock of a random house in your city and get caught by the police, I very much doubt that the defence "I was just doing it to see if I could" is going to help you.

Re: How I recorded user behaviour on my competitor’s websites

#108

Post by baddox »

graeme wrote: post #33
jeswin wrote: post #31

A couple of years back I was talking to someone who did SEO for a popular education network. The company was spending millions of dollars every month on SEO and advertising. Their module operandi went like this: 1. Offer money to license or buy a smaller competitor's content 2. If that doesn't work, crawl and clone the site 3. Pump a lot of money into Google Ads, so that the cloned site now appears as an ad above the…

This is somewhat risky, no? It's a clear case of copyright theft, and would be trivial to sue unless they hit everything behind cutouts to the extent they weren't traceable. One would think the owner of the cloned site would notice lower traffic, search, and notice the ad scam. This strategy sounds like it would take months to execute before the competing site died, if not longer. Am I missing something? I've read lo…

It’s never trivial to sue.

Re: How I recorded user behaviour on my competitor’s websites

#109

Post by baddox »

dorgo wrote: post #100
snaky wrote: post #82

Earlier quoted context omitted.

> noindex So, the browser extension indicating (with big red fonts) that this site is noindex could be a simplest solution? For not power users who don't know about any extensions that would be not so easy though. If that function will appear in Chrome enabled by default, that would raise questions about Google motives, obviously.

I think noindex is nice to have but not neccessary for this trick. The only solution is to fix the back-button bug/vulnerability in Chrome.

It doesn’t seem like there is a fix, short of removing the history API.

Re: How I recorded user behaviour on my competitor’s websites

#110

Post by Quarrelsome »

tralarpa wrote: post #98

This is really a good example why it is so difficult for security experts to do research and experiments where real users are involved. What Mr. Petrovic did is illegal in most developed countries: copyright violation (copying web pages) and monitoring and storing user behavior without their consent (and, even worse, by phishing). It doesn't matter that he did it for a "very brief period of time (for ethical reasons)…

he hasn't done it for a brief period of time, the article says he's run for five years on one of his disposable domains?
Post reply on HN