<story><title>NSA uses Google cookies to pinpoint targets for hacking</title><url>http://www.washingtonpost.com/blogs/the-switch/wp/2013/12/10/nsa-uses-google-cookies-to-pinpoint-targets-for-hacking/</url></story><parent_chain><item><author>Smerity</author><text>There are two primary issues here: the prevalence of Google Analytics and the unencrypted nature of the majority of websites.&lt;p&gt;Google Analytics is on a substantial proportion of the Internet. 65% of the top 10k sites, 63.9% of the top 100k, and 50.5% of the top million[1]. My own partial results from a research project I&amp;#x27;m doing using Common Crawl estimates approximately 39.7% of the 535 million pages processed so far have GA on them[2].&lt;p&gt;That means that you&amp;#x27;re basically either on a site that has Google Analytics or you&amp;#x27;ve likely just left one that did.&lt;p&gt;If the page you&amp;#x27;re on has Google Analytics and isn&amp;#x27;t encrypted, the Javascript request and response is in the clear. That JS request to GA also has your referrer in it, in the clear.&lt;p&gt;The aim of my research project is to end with understanding what proportion of links either start or end in a page with Google Analytics. If it starts with Google Analytics, your present &amp;quot;location&amp;quot; is known. If the link ends with Google Analytics, but doesn&amp;#x27;t start with it, then when you reach that end page, the referrer sent to GA in the clear will state where you came from.
All of this is then tied to your identity.&lt;p&gt;If people are interested when I get the results of my research, ping me. I&amp;#x27;ll also write it up and submit it to HN as it would seem to be of interest.&lt;p&gt;[1]: &lt;a href=&quot;http://trends.builtwith.com/analytics/Google-Analytics&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;trends.builtwith.com&amp;#x2F;analytics&amp;#x2F;Google-Analytics&lt;/a&gt;&lt;p&gt;[2]: &lt;a href=&quot;http://www.youtube.com/watch?v=pkoIUmP5ma8&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.youtube.com&amp;#x2F;watch?v=pkoIUmP5ma8&lt;/a&gt; (GA specific results at 1:20)</text></item></parent_chain><comment><author>mike-cardwell</author><text>Why do we still have referrers? They don&amp;#x27;t allow us to do anything that we wouldn&amp;#x27;t be able to do without them. If Mozilla and Google made a statement today saying, &amp;quot;We&amp;#x27;ll be removing referrers from cross site requests in 6 months time for Chrome and Firefox.&amp;quot;, the tiny tiny proportion of sites that are using them for real functionality will have plenty of time to update.&lt;p&gt;Of course, as a web developer, it&amp;#x27;s useful to be able to see where people came from. But we don&amp;#x27;t have any right to that information. As an end-user, why the hell is my browser giving you this information for no reason when it doesn&amp;#x27;t have to?&lt;p&gt;I&amp;#x27;ve been using RefControl for Firefox for years now. It fakes the referrer, setting it to the root of the domain being requested. This hasn&amp;#x27;t ever caused me any problems, so there can&amp;#x27;t be that many sites that rely on it.&lt;p&gt;I don&amp;#x27;t give a shit about your analytics or how much money you think you&amp;#x27;ll lose from referrers disappearing. Privacy is more important.</text></comment>
<story><title>NSA uses Google cookies to pinpoint targets for hacking</title><url>http://www.washingtonpost.com/blogs/the-switch/wp/2013/12/10/nsa-uses-google-cookies-to-pinpoint-targets-for-hacking/</url></story><parent_chain><item><author>Smerity</author><text>There are two primary issues here: the prevalence of Google Analytics and the unencrypted nature of the majority of websites.&lt;p&gt;Google Analytics is on a substantial proportion of the Internet. 65% of the top 10k sites, 63.9% of the top 100k, and 50.5% of the top million[1]. My own partial results from a research project I&amp;#x27;m doing using Common Crawl estimates approximately 39.7% of the 535 million pages processed so far have GA on them[2].&lt;p&gt;That means that you&amp;#x27;re basically either on a site that has Google Analytics or you&amp;#x27;ve likely just left one that did.&lt;p&gt;If the page you&amp;#x27;re on has Google Analytics and isn&amp;#x27;t encrypted, the Javascript request and response is in the clear. That JS request to GA also has your referrer in it, in the clear.&lt;p&gt;The aim of my research project is to end with understanding what proportion of links either start or end in a page with Google Analytics. If it starts with Google Analytics, your present &amp;quot;location&amp;quot; is known. If the link ends with Google Analytics, but doesn&amp;#x27;t start with it, then when you reach that end page, the referrer sent to GA in the clear will state where you came from.
All of this is then tied to your identity.&lt;p&gt;If people are interested when I get the results of my research, ping me. I&amp;#x27;ll also write it up and submit it to HN as it would seem to be of interest.&lt;p&gt;[1]: &lt;a href=&quot;http://trends.builtwith.com/analytics/Google-Analytics&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;trends.builtwith.com&amp;#x2F;analytics&amp;#x2F;Google-Analytics&lt;/a&gt;&lt;p&gt;[2]: &lt;a href=&quot;http://www.youtube.com/watch?v=pkoIUmP5ma8&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.youtube.com&amp;#x2F;watch?v=pkoIUmP5ma8&lt;/a&gt; (GA specific results at 1:20)</text></item></parent_chain><comment><author>DannyBee</author><text>&amp;quot;My own partial results from a research project I&amp;#x27;m doing using Common Crawl estimates approximately 39.7% of the 535 million pages processed so far have GA on them&amp;quot;&lt;p&gt;This is interesting. I would have actually expected more.  The last time I remember someone analyzing this, I believe the result was &amp;quot;&amp;lt;script ... ga.js&amp;gt;&amp;quot; was the most popular tag on the web by far.
This was, however, a few years ago.</text></comment>