Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Companies must stop using Google Analytics

imy.se

Post reply on HN
Print view View original

351–360 of 672 posts

Re: Companies must stop using Google Analytics

#351

Post by 3np »

jameshart wrote: post #296
3np wrote: post #254

Earlier quoted context omitted.

Could you be more precise with what envision by "correctly"? If you use a shared salt for all or a significant portion of rows, then it's a realistic matter of bruteforcing to cover your entire table, given that the attacker has been able to recover the salt. Even without any cracking at all, shared salt would mean that rows can be correlated if the attacker can identify a single row and correlate that to the target.…

If it's shared, it's not a salt. The term of art in that case is 'pepper'.

First time I hear this interpretation. A shared salt is still a (very poor) salt. A pepper would not be stored alongside the ciphertexts, if at all.

Re: Companies must stop using Google Analytics

#352

Post by 3np »

worksonmine wrote: post #314
sweetjuly wrote: post #283

Earlier quoted context omitted.

The salt is stored in plaintext alongside the hash and simply concatenated. If your scheme, for example, is h := H(ip, salt) := sha256(ip :: salt), bruteforcing is simply a matter of trying all values of ip: for i in 0..

The salt doesn't have to be plain-text, that's an implementation detail in the common password hashing algorithms for obvious reasons. The requirement was that the hash should be non-reversible. Store the salt in a (http-only) session cookie and concatenate it to the IP before the hashing rounds. Put your entropy in the salt and any brute-force attempt is theoretical. For every session you need to compute the exact c…

At that point, what value does the salted+hashed IP address give you over a randomly generated number (say, a UUID) per session?

Re: Companies must stop using Google Analytics

#353

Post by jacooper »

jacooper wrote: post #253
jgrahamc wrote: post #31

Earlier quoted context omitted.

See: https://blog.cloudflare.com/privacy-first-web-analytics/

I generally found much less accurate as something like Plausible, it seems Cloudflare default analytics are more like where requesting are coming from.

Found it*

Re: Companies must stop using Google Analytics

#354

Post by dijit »

totallywrong wrote: post #327
dijit wrote: post #276

Earlier quoted context omitted.

Sysadmin background is akin to first principles when it comes to Cloud. I also have a sysadmin background and my journey to the cloud has been "I can learn new things that make things easier or just use some pretty standard Linux VMs at any time". Most new entrants to cloud learn the following: * an object storage system (GCS, S3) * A functions as a Service system (Cloud functions, Lambda) -- if you are lucky, Cloud…

What you are describing is a "developer doing devops" arrangement, or maybe some junior guy with an associate-level certification. A well paid Cloud Engineer is 100% expected to know architecture, Linux, networking and all the things you mention.

there are engineers who specialise on systems that have been in industry long enough to be called senior that have never touched anything non-cloud.

Most people who are “devops” with There are so many bootcamps for this too, and they mainly focus on AWS skills.

Here's a few bootcamps that people might decide to take to break into "DevOps" of which none are assuming prior knowledge, though techworld with Nana does teach a little Linux.

https://www.techworld-with-nana.com/devops-bootcamp

https://clarusway.com/aws-devops/

https://www.udemy.com/course/aws-devops-bootcamp/

https://techproeducation.com/courses/aws-devops-engineering/

https://aws.amazon.com/training/classroom/devops-engineering...

Re: Companies must stop using Google Analytics

#355

Post by marcosdumay »

dijit wrote: post #34

My sister-in-law (girlfriends brothers girlfriend, not that it matters) recently studied for a data analytics certification. Actually several. The entire course (located on here: https://medieinstitutet.se ) is based on Google Analytics. Now her entire value is tied to the use of Google Analytics, she will almost certainly fight very hard to ensure that these skills remain relevant, nobody would want to retrain for 6…

IT is full of those tools that have so many undiscoverable but (arcanelly) documented problems that there's an entire market for people that spent years studying them.

The side effect is that for each of those tools, there's an army of people that spent years studying them, and will push them at every opportunity they can.

And interestingly, those tools keep being pushed at places even when perfectly fine alternatives exist that won't give you almost any of those problems and don't require any specialization.

Re: Companies must stop using Google Analytics

#356

Post by marcosdumay »

pixl97 wrote: post #305
jeltz wrote: post #209

Earlier quoted context omitted.

I have not researched it but I wonder if you can even hash IPv6 addresses. The issue I see is that allocations could be too regular so even if the full space is huge most addresses may occupy a small and predictable part of it.

Depends how you define IP in this sense. Each full individual IPv6, unlikely as most consumer devices are getting a somewhat random internal address on their network. Now, with IPv6 for most consumers the first 64 bits is generally enough to define the edge network device that would be covered by a single IPv4 these days.

> the first 64 bits is generally enough to define the edge network

One complication is that hashing removes this structure. If you use any good algorithm, you will need to test the entire address to recover any part of it.

I am very wary of IPv6 addresses being so heavily biased into 00 or ff segments that the address space doesn't actually add much entropy. So, I'd go with no, it's not safe to hash them. But if you get some random ones, I am really not sure.

Re: Companies must stop using Google Analytics

#358

Post by darkerside »

Shorel wrote: post #349
di456 wrote: post #319

Earlier quoted context omitted.

Sadly, citing off topic ChatGTP woes and reducing Americans to a broad generalization is not a sign of intelligence either.

Statistically speaking, assuming a normal distribution of intelligence, there is a specific percent where this generalization will start to apply. Now, I don't know what is this percent, but let's give it a name: the ChatGPT percentile cut line. My intuition says this line sits to the left of the median, so in a sense you are right, meaning that fewer than 50% of people have a measurable intelligence lower than this…

Those people probably aren't office workers

Re: Companies must stop using Google Analytics

#359

Post by henham »

acatton wrote: post #45

Who needs analytics? I'm confused. When I worked at companies using google analytics, 99.9% of the time they could have gotten this data from server logs with something like awstats or goaccess. To this day, I still don't get what's the point of embedding some javascript to do extra-requests or a tracking pixel, when the data was already given once.

The questions is not just if the raw data is available ( Google Analytics also has the data accessible in Google BigQuery) but if business stakeholders have the ability to easily access the data and drive decision making.

You need an interface that visualizes the data and decentralizes access and analytics as much as possible.

Since Google Analytics is free and more or less part of one of the biggest marketing stacks (Google Ads) you will find a lot of marketing stakeholders with at least some knowledge of the tool. But perhaps the landscape will change with the very rocky start of Google Analytics 4

Re: Companies must stop using Google Analytics

#360

Post by henham »

nologic01 wrote: post #167

When I visit a company site and it uses google analytics I know they are either: lazy, ignorant or hostile towards their (potential) clients. This set of possibilities spans all cases and none is actually a positive signal. Companies (and any entity that has an online presence for that matter) are entitled to know what people are doing in their platform and use any appropriate tool for that purpose. They are not enti…

"They are not entitled to share that with anyone without the explicit warning and approval of their users."

So using the by law (GDPR) required consent management (cookie banner) where the user has the chance to opt out of any tracking would make them not "lazy, ignorant or hostile" anymore?

I think users should have tight control over their own data and what they share but being against all 3rd party ad or analytics vendors would be against digital user acquisition for 99% of websites out there.

Post reply on HN