In order to register a "hit" on Google Analytics, the list of things required are:
- Unique API key(s) for Google Analytics
- Public: can be gotten from the embedded JavaScript files on the pages for tracking.
- HTTP requests that seem to originate from the page in question.
- Can be spoofed in a multitude of ways: which means detecting and putting a stop to it is hard enough to be not worth it.
- JSON data representing traffic, in a schema that Google expects.
Stop me right here if I’m wrong with the list.
If I’m not, then it’s really easy to spoof traffic on a site and make someone’s Google Analytics look really good even if they’re not getting any traffic!
How, then, does Google prevent these attacks? Doesn’t it hurt the credibility of Analytics stats?
I’m interested in this because of another question I’m still struggling to formulate involving Alice, Bob, Mary and some private keys that somehow need to be safely public. I’m hoping that Google may have solved that problem by trying to address this issue. I’ll post a link here once I have that question up.