Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Incapacitating Google Tag Manager (2022)

backlit.neocities.org

Post reply on HN
Print view View original

21–30 of 160 posts

Re: Incapacitating Google Tag Manager (2022)

#21

Post by future10se »

rurban wrote: post #3

Just add the domain to your /etc/hosts as 0.0.0.0 Doing that for years

As mentioned on the blog post:

> Used as supplied, Google Tag Manager can be blocked by third-party content-blocker extensions. uBlock Origin blocks GTM by default, and some browsers with native content-blocking based on uBO - such as Brave - will block it too.

> Some preds, however, full-on will not take no for an answer, and they use a workaround to circumvent these blocking mechanisms. What they do is transfer Google Tag Manager and its connected analytics to the server side of the Web connection. This trick turns a third-party resource into a first-party resource. Tag Manager itself becomes unblockable. But running GTM on the server does not lay the site admin a golden egg...

By serving the Google Analytics JS from the site's own domain, this makes it harder to block using only DNS. (e.g. Pi-Hole, hosts file, etc.)

One might think "yeah but the google js still has to talk to google domains", but apparently, Google lets you do "server-side" tagging now (e.g. running a google tag manager docker container). This means more (sub)domains to track and block. That said, how many site operators choose to go this far, I don't know.

https://developers.google.com/tag-platform/tag-manager/serve...

Re: Incapacitating Google Tag Manager (2022)

#22

Post by BurnerBotje »

I have an idea that another way of preventing being tracked is just massively spamming trash in the data layer object, pushing thousands of dollars worth of purchase events and such, pushing randomly generated user details and other such events. Perhaps by doing this your real data will be hard to filter out. A side effect is also that data becomes unreliable overall, helping less privacy aware people in the process.

Re: Incapacitating Google Tag Manager (2022)

#23

Post by fguerraz »

aerzen wrote: post #20

Am I dumb or does this article fail to explain what does the tag manager actually do? And not just with a loaded word, such as surveillance or spying, but actually technically explain what they are selling for and why it is bad.

Maybe you’re being misled by the cryptic name. It’s got nothing to do with managing tags, it’s a behaviour tracker and fingerprint machine.

Re: Incapacitating Google Tag Manager (2022)

#24

Post by chamomeal »

BurnerBotje wrote: post #22

I have an idea that another way of preventing being tracked is just massively spamming trash in the data layer object, pushing thousands of dollars worth of purchase events and such, pushing randomly generated user details and other such events. Perhaps by doing this your real data will be hard to filter out. A side effect is also that data becomes unreliable overall, helping less privacy aware people in the process.

Now there’s a fun idea!! I wonder how difficult it would be to spoof events.

Edit: looks like this might exist already: https://addons.mozilla.org/en-US/firefox/addon/adnauseam/

Re: Incapacitating Google Tag Manager (2022)

#25

Post by pluc »

baobun wrote: post #16
roywiggins wrote: post #13

Earlier quoted context omitted.

It's certainly not that bad if you have uMatrix to do it with, but I haven't found a reasonable way to do it on mobile. uMatrix does work on Firefox Mobile but the UI is only semi functional.

NoScript + uBO is all right.

Yup that's what I use as well. With whatever the name of the extension that makes allowing cookies a whitelist thing too, and PrivacyBadger/Decentraleyes.

Also, deleting everything when Firefox closes. It's a little annoying to re-login to everything every day, but again, they are banking on this inconvenience to fuck you over and I refuse to let them win. It becomes part of the routine easily enough.

Re: Incapacitating Google Tag Manager (2022)

#26

Post by a2800276 »

aerzen wrote: post #20

Am I dumb or does this article fail to explain what does the tag manager actually do? And not just with a loaded word, such as surveillance or spying, but actually technically explain what they are selling for and why it is bad.

I was tasked with auditing third party scripts at a client a couple of years ago, the marketing people where unable to explain wtf tag manager does concretely without resorting to ‚it tracks campaign engagement´ mumbo jumbo, but were adamant they they can’t live without it.

Re: Incapacitating Google Tag Manager (2022)

#27

Post by xiande04 »

aerzen wrote: post #20

Am I dumb or does this article fail to explain what does the tag manager actually do? And not just with a loaded word, such as surveillance or spying, but actually technically explain what they are selling for and why it is bad.

There's a section in the article titled, "WHAT DOES GOOGLE TAG MANAGER DO?":

> Whilst Google would love the general public to believe that Tag Manager covers a wide range of general purpose duties, it's almost exclusively used for one thing: surveillance.

Re: Incapacitating Google Tag Manager (2022)

#28

Post by adamiscool8 »

I don't think this article makes a good case for why you should.

>The more of us who incapacitate Google's analytics products and their support mechanism, the better. Not just for the good of each individual person implementing the blocks - but in a wider sense, because if enough people block Google Analytics 4, it will go the same way as Universal Google Analytics. These products rely on gaining access to the majority of Web users. If too many people block them, they become useless and have to be withdrawn.

OK - but then also in the wider sense, if site owners can't easily assess the performance of their site relative to user behavior to make improvements, now the overall UX of the web declines. Should we go back to static pages and mining Urchin extracts, and guessing what people care about?

Re: Incapacitating Google Tag Manager (2022)

#29

Post by bornfreddy »

roywiggins wrote: post #13
pluc wrote: post #4

Earlier quoted context omitted.

It really isn't. I've been blocking all JavaScript for years now, selectively allowing what is essential for sites to run or using a private session to allow more/investigate/discover. Most sites work fine without their 30 JS sources, just allowing what is hosted on their own domain. It takes a little effort, but it's a fair price to pay to have a sane Internet. The thing is - with everything - it's never easy to hav…

It's certainly not that bad if you have uMatrix to do it with, but I haven't found a reasonable way to do it on mobile. uMatrix does work on Firefox Mobile but the UI is only semi functional.

Not quite the same (I love uMatrix UI), but advanced mode in uBO is similar. It lacks filtering by data type (css, js, images, fonts,...) per domain, but it does resolve domains to their primary domain, revealing where they are hosted. A huge kudos to gorhill for both of these!

Re: Incapacitating Google Tag Manager (2022)

#30

Post by munchler »

xiande04 wrote: post #27
aerzen wrote: post #20

Am I dumb or does this article fail to explain what does the tag manager actually do? And not just with a loaded word, such as surveillance or spying, but actually technically explain what they are selling for and why it is bad.

There's a section in the article titled, "WHAT DOES GOOGLE TAG MANAGER DO?": > Whilst Google would love the general public to believe that Tag Manager covers a wide range of general purpose duties, it's almost exclusively used for one thing: surveillance.

That’s a single word, not much of an actual explanation.
Post reply on HN