Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I recorded user behaviour on my competitor’s websites

dejanseo.com.au

Post reply on HN
Print view View original

131–140 of 329 posts

Re: How I recorded user behaviour on my competitor’s websites

#131

Post by ddalex »

nmstoker wrote: post #119

What's concerning is that the post author seems not to see the problem with trying to sit on both sides of the fence at once. As others have said, the way this was done is likely to be against numerous laws in most major jurisdictions. If you wish to do this as a PoC then simply put a notice up on the page that initiates it and use dummy "competitor" content, so you've got some semblance of user content/transparency…

The problem I'm seeing is not that the author did something un-ethical (there are plenty black hats out there with no such concerns), but that the content can modify the browser chrome behaviors, and that the users trust the browser chrome a lot more than the content (as it should).

As a workaround, I recommend using separate Firefox containers for big sites, as the big sites are the main attack surface of a lot of people. I.e. Firefox containers for Google, Facebook, Microsoft. This attack would be stopped by using a Google container as the back button will not work once you step out of the container to go to the result page.

Sure, it won't help you on a targeted attack, but will help a lot with this kind of drag-net attack.

Re: How I recorded user behaviour on my competitor’s websites

#132

Post by JdeBP »

King-Aaron wrote: post #103
mrob wrote: post #4

Earlier quoted context omitted.

Yet another reason to browse with JS disabled by default.

That's a reasonable course of action until you need to use the internet for pretty much anything .

Experience teaches that that is a vastly exaggerated statement. There remains quite a lot of the World Wide Web that does not require Javascript.

And of course it is pretty much not required at all for using the Internet outwith the World Wide Web.

Re: How I recorded user behaviour on my competitor’s websites

#133

Post by Syzygies »

The big issue here is: Who does our browser work for?

People worry that self-driving cars will take us to "promoted" coffee, if we're not specific. More generally, software agents as a rule are loyal to their creators, not to us. That we put up with this is absurd.

Browsers should be intelligent agents that are entirely loyal to the person browsing. For example, no site should be able to tell whether we see ads or not. As one site-by-site option, process the ads exactly as if they're reaching our senses, but don't actually render them so they reach our senses.

Not even having a back button loyal to us? That's obscene. Copyright infringement is the MacGuffin in this movie; the real story is that we're wusses for having totally lost this balance of power struggle in our personal software.

Re: How I recorded user behaviour on my competitor’s websites

#135

Post by snaky »

dorgo wrote: post #129
snaky wrote: post #122

Earlier quoted context omitted.

Back button is not the only way to end up at noindex site.

? Sure, you can just call the URL directly in browser. Which other way do you mean? The problem is not to end up at "noindex site" (btw: noindex is not a neccessary part of this scheme). The problem is to end up at "noindex site" thinking that the "noindex site" is a competitor site. And I don't see how such deception is possible without the backbutton-bug.

> The problem is to end up at "noindex site" thinking that the "noindex site" is a competitor site

And there is no solution for that, it seems. The solution for the problem 'hey, that's noindex site!' is obvious and simple.

> And I don't see how such deception is possible without the backbutton-bug

You told it yourself - 'you can just call the URL directly in browser'. And there are many ways and scenarios how that clicking on a link could happen.

Re: How I recorded user behaviour on my competitor’s websites

#136

Post by SmellyGeekBoy »

stef25 wrote: post #83
jeswin wrote: post #31

A couple of years back I was talking to someone who did SEO for a popular education network. The company was spending millions of dollars every month on SEO and advertising. Their module operandi went like this: 1. Offer money to license or buy a smaller competitor's content 2. If that doesn't work, crawl and clone the site 3. Pump a lot of money into Google Ads, so that the cloned site now appears as an ad above the…

Sorry, calling BS on this one. By simply copying a site you get flagged as having duplicate content. Then there's DMCA. I've seen an e-commerce site's homepage get de-indexed, killing the business, due to 1 single image being used for which the site owner didn't have copyright. SEO undoubtedly has many shady practises, but "professional SEO" is actually really difficult and involves much more than cloning competitor…

How much is "duplicate content" penalised in reality? How many times have you searched for an error message or technical issue and got a link to StackOverflow, and also on the front page some ad-laden site that's just a direct scrape of the exact same SO page? It's a common occurrence for me.

Re: How I recorded user behaviour on my competitor’s websites

#137

Post by SmellyGeekBoy »

dorgo wrote: post #130
baddox wrote: post #109

Earlier quoted context omitted.

It doesn’t seem like there is a fix, short of removing the history API.

Maybe restrict the history API to the same-origin-policy? Javascript could/should be allowed to manipulate browser-history only for the same domain. Just an idea.

Why should anything be able to change the behaviour of the back button? If I click back it should take me back to the previous URL. If it breaks your one page 200MB JavaScript masterpiece then tough luck, come up with your own navigation.

Re: How I recorded user behaviour on my competitor’s websites

#138

Post by SmellyGeekBoy »

laumars wrote: post #85
lukestevens wrote: post #2

This is an interesting yet disturbing case of blackhat SEO and phishing, where the site owner hijacks the back button and sends visitors to fake sites where he can observe their behaviour. FTA: Here’s what I did: 1. User lands on my page (referrer: google) 2. When they hit “back” button in Chrome, JS sends them to my copy of SERP 3. Click on any competitor takes them to my mirror of competitor’s site (noindex) 4. Now…

I'm curious how many visitors did this. In my very limited sample set of myself and friends / work colleagues, we all use middle click to open a result in a new tab.

I'm not sure my parents are even aware of the existence of tabs, to be honest.
Post reply on HN