Let's say we're running Google Analytics, and we're tracking user specific data (or displaying contents based on that data, such as most recently viewed pages) -- we add a pixel, and then we pass the user data to the Analytics platform. What's to prevent a malicious user from passing a bunch of garbage data based on random user ids?
Same thing with mobile; let's say we integrate a customer service SDK such as Zendesk. There's usually either a key or a cert that we have to include in our apps. What's to stop a malicious user from decompiling our app and then using the provided cert in the app, read all user tickets from whatever user id he passes?
And what are things we can do, both as app/web developers and SDK developers to block these types of attacks?