Google Analytics - 它可以收集表单数据吗？
简单场景： 我有一个注册表单，其中包含用户名、密码、电子邮件地址，可能是信用卡号码。
在页面底部，我实现了 Google Analytics 代码。
当用户点击提交时，它会转到一个没有谷歌分析的页面。
问题是.. 用户输入数据后，GA能否获取第一个表单中的数据（用户名、密码..电子邮件..等）？
他们在服务条款或隐私政策中对此有何说明吗？
Simple scenario:
I have a signup form, with user name, password, email address, may be credit card number.
At the bottom of the page, I implement the Google Analytics code.
when user clicks submit, it goes to a page wihtout google analytics.
question is..
can GA get the data (user naem, password..email..etc) in the first form after user input the data?
Do they say anything about it in their TOS or Privacy policy?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
是的。由于同源策略，您在页面中包含的任何
请勿在任何页面上包含来自您对网站上所有内容的安全性不完全信任的一方的
不过，Analytics 脚本目前不执行任何上述操作，并且表单提交当然不会流向 Google；他们必须故意采取行动来窃取数据。显然，如果被发现这样做对他们来说将是灾难性的，所以他们大概不会这样做。但从技术上讲，他们可以。在银行网站上看到第三方广告和跟踪脚本总是让我感到痛苦。
Yes. Any
<script>you include in the page has complete access to alter the user's interaction with the site due to the Same Origin Policy. Google, if they were feeling Evil today, could certainly rewrite theactionof your<form>to point to themselves, or log every keypress, or create an<iframe>containing another page on your site and simulate the user clicking on any action in that page.Do not include
<script>on any page from a party you don't completely trust with the security of everything on your site. Even a single tracking or advertiser script on any page compromises everything on the same hostname (and maybe other subdomains if you are settingwindow.domainto allow cross-hostname-scripting, or sharing cookies between hostnames).However, the Analytics script doesn't currently do any of these things and the form submission will not flow to Google as a matter of course; they would have to deliberately act to steal the data. Clearly it would be disastrous for them to be discovered doing it, so they presumably won't. But technically, they could. It always pains me to see third-party ad and tracking scripts on bank sites.
更新：自从我在下面写下最初的答案以来，这些年来情况已经发生了很大的变化：脚本现在通常通过 HTTPS 提供（或者至少可以选择获取），因此这些脚本应该能够抵御微不足道的中间人攻击。但是，您仍然相信脚本源不会在您的页面中执行恶意操作，因为它们仍然可以完全控制您的网页上发生的情况。
原答案：
是的。我建议不要将任何第三方脚本放置在受 SSL 保护的敏感页面上。 Google 不太可能劫持您页面上的敏感数据，但您应该考虑恶意 ISP 可能劫持对 Google Analytics 脚本的请求（例如，使用 DNS）并在您的页面上做任何它想做的事情。
UPDATE: The landscape has changed quite a bit over the years since my original answer below was written: the scripts are now generally served (or at least have the option to be fetched) over HTTPS, so those scripts should be secure against the trivial man-in-the-middle attacks. However, you are still trusting the script source not to do malicious stuff in your page, since they still get to fully control what happens on your web page.
Original answer:
Yes. I recommend against putting any third party script on sensitive pages secured by SSL. It's not likely that Google is going to hijack sensitive data on your page but you should take into account the possibility that a malicious ISP can hijack the request (say, using DNS) to Google Analytics script and do whatever it wants on your page.