Live data from Hacker News

Companies must stop using Google Analytics

imy.se

441–450 of 672 posts

Re: Companies must stop using Google Analytics

#441
post #254

Earlier quoted context omitted.

Could you be more precise with what envision by "correctly"? If you use a shared salt for all or a significant portion of rows, then it's a realistic matter of bruteforcing to cover your entire table, given that the attacker has been able to recover the salt. Even without any cracking at all, shared salt would mean that rows can be correlated if the attacker can identify a single row and correlate that to the target.…

If it's shared, it's not a salt. The term of art in that case is 'pepper'.

That's backwards.

> In cryptography, a pepper is a secret added to an input such as a password during hashing with a cryptographic hash function. This value differs from a salt in that it is not stored alongside a password hash, but rather the pepper is kept separate in some other medium, such as a Hardware Security Module.

https://en.wikipedia.org/wiki/Pepper_(cryptography)

Re: Companies must stop using Google Analytics

#442

Earlier quoted context omitted.

The question I have isn't why you need analytics but why you'd ever need any PII in the data. I don't care whether Bob clicked the button I only care whether 1% or 50% of users click the button. Or if those who clicked button A are likely to click button B so they should be closer together. Analytics should be anonymous usage statistics not tracking individuals. We are clumping two things together where one is bad an…

That’s the idea but to know that an anonymous user who has clicked button A goes on to click button B requires you to track that user via some kind of random ID that uniquely identifies their browser/device. This new Swedish ruling says that ID is itself PI.

How does the ruling come to that conclusion? How does an ID that uniquely identifies a user but can't be used to trace back to a physical person be PII?

Reading the linked rulings it seems like it's not the IP (even though it's only blanked at the last octet) but rather other cookie values, which may in turn be traceable to the user?

Of course if a cookie value is sent and in some other system that same cookie value is stored next to a user's name, then that cookie value is definitely PII and can't be sent via GA, that much I understand.

The key passage from the longest ruling (DI) seems to be

Dessa identifierare har skapats med syftet att kunna särskilja individuella besökare, såsom klaganden. De unika identifierarna gör därmed besökarna på Webbplatsen identifierbara. Även om sådana unika identifierare (enligt punkt 1 ovan) i sig inte skulle anses göra enskilda identifierbara, måste det dock beaktas att dessa unika identifierare i det aktuella fallet kan kombineras med ytterligare element (enligt punkterna 2–4 ovan) samt att det är möjligt att dra slutsatser i förhållande till information (enligt punkterna 2–4 ovan) som medför att uppgifter utgör personuppgifter, oaktat om IP-adressen inte överförts i sin helhet

Basically: the random ids aren't enough by themselves, nor is the IP, but the IDS together with partial IPs and something else is.

I don't know what the bottom line is though. And that worries me a bit. Any analytics will be at risk of doing this. In my desktop app analytics we blank IPs etc, but just storing some hardware data (ram amount, cpu freq, windows version, screen resolution...) means that we eventually have enough entropy to say with certainty that each user we have has a unique set of parameters in the data we log. It's almost impossible to NOT fingerprint perfectly if you gather even just basic hardware and OS info, for example. But there is of course zero possibility that we could use the data backwards and say "ok which single physical person is it that has a 16 core machine and 16Gb ram" making it "not PII"?

I think the key issue in these cases with GA is that it's more a chain leading to actual PII. E.g. the cookie value that GA has access to, can realistically be stored somewhere where there is also PII such as an email address. And that's enough to violate the GDPR.

Re: Companies must stop using Google Analytics

#443
post #175

Earlier quoted context omitted.

Holy 2008 what a website! I won't comment on any specific design choices here, but accessibility-wise: the text on the team page seems fuzzy? Looks like it's a text-shadow.

What is 2008 about this website? I don't know any websites from 2008 that look like that. What do current websites have which websites from 2008 don't? When I visit YouTube, Facebook or Twitter, they seem extremely "busy", overrun with ads, and rather ugly, but we are used to them. I am not sure it's so bad to have a clean layout. But I am open to constructive criticism.

Since you ask, I'll be honest. I don't think your layout is clean at all:

- There's a confetti effect following my cursor around - There are constant animations playing everywhere, even over video embeds - A lot of the spacing is uncomfortably tight - Shadow effects overlap other content - There are some 30 menu options, buttons everywhere, many video embeds that I'm supposed to listen to?

None of this is enticing me to consume any content on your website. I'm feeling uncomfortable even trying to browse the site to find out what your product is. I've learned that a significant portion of the web runs on PHP and that you have an app and a token of some sort? And you're looking for investors? I'm sure there's very cool ideas in here, but I'm lost in the vast amount of information with inscrutable organisation.

All that aside, there's a big reason that a lot of landing pages look similar: it works. First impressions count for a lot.

Re: Companies must stop using Google Analytics

#444
I think companies should stop using fixed navigation banners but we can't all get what we want now can we?

Like holy crap, I agree with you but your website is unreadable with that may as well be a banner ad of a navigation bar that keeps popping in and out of existence every time I scroll down.

Re: Companies must stop using Google Analytics

#445
post #34

My sister-in-law (girlfriends brothers girlfriend, not that it matters) recently studied for a data analytics certification. Actually several. The entire course (located on here: https://medieinstitutet.se ) is based on Google Analytics. Now her entire value is tied to the use of Google Analytics, she will almost certainly fight very hard to ensure that these skills remain relevant, nobody would want to retrain for 6…

Sounds a lot like the tech programs when I grew up being MS exclusive with active efforts to undermine non-MS products....

Re: Companies must stop using Google Analytics

#446

Earlier quoted context omitted.

While true, it’s very fair to say that many (possibly most) meetings in a corporate environment contain a lot of absolutely pointless time wasting. I say this with the perspective of someone who has slowly had to have many more of these meetings added to his calendar over the years. Some are very important, some are reasonable but often bloated, but so many are a waste of time. At the very least: they’re 5-10 mins of…

I find that a lot of engineers don't understand good communication, and definitely don't understand the value of relationships. When I was really junior, I'd go to meetings and think that the vast majority of the time was wasted. As I became more senior, I realized that a lot of that wasted time is for providing context, relationship building, and alignment. You may not need those things for your current task, but yo…

> I realized that a lot of that wasted time is for providing context, relationship building, and alignment.

A lot of that seems to be about office politics, which historically been something which engineers and office workers in general has disliked. It is a generally unhappy fact that relationship building and office alignments is what dictate who get promoted, who get raises, who get the desired assignments and who don't.

It might be true that those who refuse playing that game is associated with inexperience. In my experience, employees who get tired of it generally leave large companies, which leaves behind only inexperience employees or those who enjoy the game.

Re: Companies must stop using Google Analytics

#448
post #34

My sister-in-law (girlfriends brothers girlfriend, not that it matters) recently studied for a data analytics certification. Actually several. The entire course (located on here: https://medieinstitutet.se ) is based on Google Analytics. Now her entire value is tied to the use of Google Analytics, she will almost certainly fight very hard to ensure that these skills remain relevant, nobody would want to retrain for 6…

This level of dependence on certain tools is neither rare nor unprecedented. Your run-of-the-mill business drone will be trained on Word/Excel/Outlook and be hard to impossible to retrain on anything else (either because of actual stupidity or resistance to change). This already starts at school where "Informatik" is often just learning where to click in Microsoft products. Similarly, tradespeople often specialize in…

> Your run-of-the-mill business drone will be trained on Word/Excel/Outlook and be hard to impossible to retrain on anything else (either because of actual stupidity or resistance to change).

Change purely for the sake of change is bad and people are right to resist it.

The vast majority of businesses have no compelling reason to switch off Microsoft Office. Would the world be a better place if there were more feasible options? Maybe. But that's not the concern of either a random business or its employees.

Re: Companies must stop using Google Analytics

#449

Earlier quoted context omitted.

'actual stupidity'... gotta love the general disdain of the 'run of the mill business drone'... It's funny my wife is a run of the mill business drone. She thinks IT is a bunch of assholes. I would say she is probably right. Way to keep things going.

I someone can't be retrained, and it's not because they're being stubborn, what other reason do you have? Is it better or worse to assume they're being a problem on purpose? I won't say 'average' but I will say 'common enough to make changing software a huge issue'.

https://news.ycombinator.com/item?id=36601986

Re: Companies must stop using Google Analytics

#450
post #34

My sister-in-law (girlfriends brothers girlfriend, not that it matters) recently studied for a data analytics certification. Actually several. The entire course (located on here: https://medieinstitutet.se ) is based on Google Analytics. Now her entire value is tied to the use of Google Analytics, she will almost certainly fight very hard to ensure that these skills remain relevant, nobody would want to retrain for 6…

This level of dependence on certain tools is neither rare nor unprecedented. Your run-of-the-mill business drone will be trained on Word/Excel/Outlook and be hard to impossible to retrain on anything else (either because of actual stupidity or resistance to change). This already starts at school where "Informatik" is often just learning where to click in Microsoft products. Similarly, tradespeople often specialize in…

Home appliance repair is not a specialized job. Maybe you have some sort of memory about the Maytag repair man, but that is just branding, just like DeBeers with their diamond monopoly.

Home appliance repair is knowing the general layout of each major appliance, a bit of specialized knowledge on how to dismantle them without braking them, and which modules are responsible for which function, and finally knowing how to source the replacement parts and knowing which common items are best kept on hand for convenience.

Very few people are doing board level repair for appliances, especially when the replacemeent boards are typically very inexpensive for any modern machine (save for main boards and for induction plates in induction stoves, which are typically so expensive that it is smarter to replace the entire appliance rather than repair the broken module).

Post reply on HN