search

uBlockOrigin / uAssets

Resources for uBlock Origin, uMatrix: static filter lists, ready-to-use rulesets, etc.
GNU General Public License v3.0
4.08k stars 764 forks source link

Block Marketo’s Munchkin #5246

Closed u2mejc closed 5 years ago

u2mejc commented 5 years ago

URL(s) where the issue occurs

https://munchkin.marketo.net/munchkin.js

Describe the issue

Marketo Munchkin is a commercial tracking product used to de-anonymize website visitors to create lead generation from anonymous users. Details in their docs here: http://developers.marketo.com/javascript-api/lead-tracking/

Screenshot(s)

n/a

Versions

Settings

Notes

It works like this:

  1. User enters information on site that is a customer of marketo. This is either through a signup for a marketing email or simply a otherwise trusted provider that shares contacts with Marketo. The later means the cookie is successfully recreated each time you login to the trusted provider, even after purging all cookies.
  2. User browses to a second site that also calls the same JS (https://munchkin.marketo.net/munchkin.js) and reads in previously placed cookie from first site that contains UUID of user and send to server.
  3. Marketo API looks up this UUID and sends a lead generation email to the website owner, containing unmasked name, company, and email address, etc. This example can also include a link to Salesforce's (formally Jigsaw) database in the email to retrieve more information that other SF customers have uploaded about the contact. This successfully DOX's an otherwise anonymous visitor who is running the latest version of ublock origin.
mapx- commented 5 years ago

marketo is blocked in easyprivacy list ||marketo.net^$third-party

Example site where you still that unblocked script ?

L.E. easyprivacy has also this exception @@||munchkin.marketo.net/munchkin.js

maybe @ryanbr could explain why that exception (I guess some breakage)

I remember the forms stuff of marketo have broken few sites

u2mejc commented 5 years ago

Yep, seems like there is conflicting consensus in this filter. Here's an example: https://www.perimeterx.com/

I remember the forms stuff of marketo have broken few sites

I can't speak for everyone, but IMHO, I prefer not to be tracked / de-anonymized / DOX'ed when I'm browsing. I'm sure most people who use this tool, have added at least one exception for sites that break (or preferably complain loudly on twitter till the site owner fixes it). 😉

I'm positive supporting this project creates tremendous requests to block, then fix sites, so I appreciate everyone's time here, and I'm happy to help where I can too.

u2mejc commented 5 years ago

So block this in your private filter list / my filters panel?

That would be easy for anyone who has created a filter before, and monumental to anyone who hasn't ever. Some users are not the individual who originally installed Ublock Origin in their browsers, and not everyone is a regex / ublock DSL guru.

Luckily this repo exists to discuss what the default level of protection you would want for your loved ones is, so that they don't have to keep tabs on the latest trends in internet privacy. 👍

mapx- commented 5 years ago

The exception could have this reason ?! https://forums.lanik.us/viewtopic.php?p=144335#p144335

okiehsch commented 5 years ago

That site is still broken and it has nothing to do with munchkin.marketo.net/munchkin.js If I block that script and add

@@||marketo.com/js/*/forms2.min.js$script,domain=here.com
@@||marketo.com/index.php/form/getForm$script,domain=here.com

the contact form appears on my end.

okiehsch commented 5 years ago

The exception was added a long time ago. image https://github.com/easylist/easylist/commit/fbc1164e6622a9c3ffb84871bb5ebe5482120f94

okiehsch commented 5 years ago

Well, I don't see any breakage caused by munchkin.marketo.net/munchkin.js at the linked reference https://www.bettercloud.com/monitor/google-apps-office-365/ of the commit, as a matter of fact the "subscribe" option is still broken.

okiehsch commented 5 years ago

I disabled the exception @@||munchkin.marketo.net/munchkin.js and I made the existing exceptions in uBO-unbreak

@@||marketo.com/js/forms2/js/forms2.min.js$script,domain=gitlab.com|snowflake.com|conjur.org
@@||marketo.com/index.php/form/$script,domain=gitlab.com|snowflake.com|conjur.org

global. As far as I can see all contact forms of sites using marketo.com/js/forms2 are broken and there are a lot of them. https://publicwww.com/websites/%22marketo.com%2Fjs%2Fforms2%2Fjs%2Fforms2.min.js%22

u2mejc commented 5 years ago

@okiehsch Awesome work, that was an amazing fast turn around. I can confirm, my client picked up the changes and it's working as expected. Thank you! 🎉