Hacker News Reader

Comment by strictfp | Hacker News Reader

I guess trackers will just ask websites to route analytics traffic through their own infrastructure. Would it be enough for example.com to setup a dns alias pointing tracking.example.com to tracking.com?

View on HN

That breaks cross-domain tracking, though; before, cookies set on analytics.com (pulled on SiteA) would be sent back to them when pulled from SiteB. If you now use different domains on each site, that doesn't work.

(To be clear, I think this is a good thing)

Except all the analytics company has to do is have another shred of evidence that your identy is linked and it can just give out tokens that represent opauqe blobs you take care of and index by it's token like PHP does session storage.

This would be already a giant leap forward: Usually, there is not a lot of trust between actors, and there doesn't need to be: everyone gets their own tracking pixel and is happy, who cares if user data is leaked along the way. The setup you describe requires more trust beetween parties, and, as a side-effect, reduces the overall number of potential contractual partners which get access to user data. It also reduces the number of websites with the knowledge to implement such a setup.

Right. It's historically been very assymetric - the content sites are risking their user's safety by working with shady as providers, but not their own.

Under a server-side include, the content company is just as at risk from malicious adscript as the client.

This is a possible work-around, but it adds a lot of complexity to get HTTPS and stuff worked-around. Either the third-party must handle HTTPS for their partners who setup CNAMEs, or the first-party must handle HTTPS and proxy the requests back to the third-party. It’s doable but it will significantly slow things down to the point where even shitty websites would consider it unacceptable.

The third-party can handle HTTPS just for that particular subdomain, using a separate certificate.

Yes, but this would significantly increase complexity.

It it really that bad, with automated certificate issuing via Let's Encrypt?

Reply on news.ycombinator.com