Hacker News Reader

Comment by ig1 | Hacker News Reader

You need to be careful about user privacy with things like this. You're leaking user information to third party services, and you need to make this clear to your users, especially if you're dealing with anything that could be considered at all sensitive.

View on HN

I particularly annoyed by banks doing this. I assume can trust the bank itself, but why would I want to also pull down content and scripts from cdn.whoknowswhere.com or tangentialservice.com?

If I'm signed in, doing monetary transactions, I don't want to deal with any other domain but the primary.

I installed a firewall at a doctor's office last week. I set the defaults to block pretty much everything so I could whitelist sites the office staff truly needed. The following Monday, I sat around and whitelisted things as the staff stumbled on what they needed. I was amazed at how many third party sites were being hit from health insurance and government sites. This stuff is supposed to be secure, but everything from login to home page to submitting claims had requests to third party domains. I'd say less than half of these third party requests appeared to CNDs.

I’d sort of assumed the traffic information was one of Google’s primary motivations for hosting all these libraries.

True, although its not any different than running Analytics or Adwords.

Yep, but those are more concious business decisions. This is the kind of thing someone might decide to do on a whim without thinking of the repercussions and make suitable adjustments to privacy polices, etc.

Care to explain yourself?

All using a CDN for JS libraries does is have the same exact code get to the user faster and not eat your bandwith. Unless the CDN threw some extra code in, which someone would eventually notice (seriously marring the company's reputation), it doesn't send any info to the company hosting the code.

But it is a good point. You should make sure you really trust the company hosting the code for you.

Edit: Oh, right. When I read the comment I was thinking more of it letting them steal all of the info on the page, or something, which would be doable if they inserted extra code.

You've never heard of access logs?

I think the OP's point was that you're giving all of the traffic information to the CDN, i.e. they can monitor the people that you're sending to them.

> Edit: Oh, right. When I read the comment I was thinking more of it letting them steal all of the info on the page, or something, which would be doable if they inserted extra code.

Stealing info from the page is still possible. It would be hard to crowd-source the detection of such things if they were either: 1) randomly inserted into <1% of all requests; 2) they were targeted at specific IPs/IP ranges; or 3) they were targeted at requests coming from specific sites.

Reply on news.ycombinator.com