Hosts: Target.com domains blocked

[nickjacques]

This is related to #18

Hello,

I work for Target and we've received reports of Pi-hole users being unable to access target.com pages. It appears that Pi-hole uses this blacklist as one of their datasources, and this blacklist contains the following domains:

0.0.0.0 api.target.com
0.0.0.0 stage.api.target.com
0.0.0.0 profile.target.com
0.0.0.0 redsky.target.com
0.0.0.0 taglocker.target.com

https://github.com/lightswitch05/hosts/blob/master/ads-and-tracking-extended.txt#L7235-L7239
https://github.com/lightswitch05/hosts/blob/master/ads-and-tracking.txt#L931-L934
via this commit: https://github.com/lightswitch05/hosts/commit/e61a4c84dff6629d8a7b931a82214985f1f0adff

Since this blacklist is consumed not only by Pi-hole, but potentially other meta-blacklists (e.g., https://github.com/StevenBlack/hosts [which is ultimately what Pi-hole consumes]), this may block genuine attempts to view and use target.com or mobile apps across a variety of security services.

These domains are critical for functionality:

• api.target.com serves all of Target's APIs. There are several AJAX/XHR loads on target.com that make use of APIs that are hosted there. Blocking this will impact functionality on the website and mobile apps.
• profile.target.com is related to logged-in user profiles and the data stored in those user profiles. Blocking this will impact functionality related to accessing profile data (saved addresses, saved payment types, etc).
• redsky.target.com provides content across target.com and mobile apps. Item information and related information, like shipping times, are provided by this endpoint

Blocking these domains will prevent much of the useful functionality on target.com or mobile apps from working (adding items to your cart, viewing item details, checking out, etc).

Domains that are not critical for functionality:

• stage.api.target.com is similar to api.target.com above, but this is a non-production endpoint and is not intended for use on the production site/apps.
• taglocker.target.com is related to marketing services (and yes, does include some user research components)

I would request that you consider reverting the changes for the critical domains listed above, and reconsider the non-critical domains as well. While stage.api.target.com isn't intended for production use, I would suggest that it be reverted along with its production sibling, api.target.com.

[lightswitch05]

@nickjacques hey Nick, thank you for this information.

• api.target.com, as far as I could tell, this domain had targeting API calls and blocking it didn't break anything that I could find one the website. But I did hesitate to block this, and it looks like its causing issues with the mobile app, so I will remove it. Removing this one should also remove stage.api.target.com since that one was just added through domain expansion
• redsky.target.com I haven't seen anything going to this domain that isn't related to targeted advertising and tracking:
  
  
  
  • https://redsky.target.com/v1/recommendations?visitor_id=redacted&channel=web&pageId=redacted&context=placementId,plp;categoryId,redacted&storeIds=redacted
  
  
  • https://redsky.target.com/v2/stores/nearbyredacted?key=redacted&locale=en-US&limit=20&range=100
  
  
• profile.target.com yeah, I will remove this one too. I don't remember the URL I saw that made me think this was also tracking, looking again I wasn't able to reproduce any strange API calls.
• taglocker.target.com as you point out, this is purely advertisements and tracking - which is the point of this list, so I'll leave it in

[lightswitch05]

I've removed api.target.com, profile.target.com, and stage.api.target.com. I hope that is enough to resolve this issue

[lightswitch05]

I found the calls the api domain that caught my attention before

• https://stage-api.target.com/web_analytics/v1
• https://api.target.com/rum_analytics/v1
• https://api.target.com/custom_interaction_analytics/v1

As a logged in user, its really unfortunate I can't turn this shit off. I like target, I shop at target, I obviously use the website since I found these domain going across my network. I don't want to be tracked and targeted, why is that too much to ask?

[gcase]

I also work for Target, and am responsible for services on redsky.target.com. Redsky provides several services critical for target.com - If you were to do a search for speakers on target.com - that request is handled at redsky - https://redsky.target.com/v1/plp/search?keyword=speakers would be an example request. Redsky is also used to return item, price, and fulfillment information on the product detail page, for example, https://redsky.target.com/v2/pdp/tcin/12959727 contains the information needed to paint the details on https://www.target.com/p/oreo-original-chocolate-sandwich-cookies-14-3oz/-/A-12959727.

As you've also seen, we provide the information for the "more to consider" carousal on the "recommendations" carousal on the bottom of the PDP page. This are links directly to other products on target.com, based purchase behavior of other guests.

If you have further questions, I am happy to answer. But please reconsider removing redsky.target.com from the blacklist.

[nickjacques]

@lightswitch05 Hey Daniel,

Thanks for your response, I appreciate the review and removal of the domains.

To expand a bit on redsky.target.com, it is in essence somewhat of a data aggregation service. This service will provide recommendations (as you mentioned above), and will also provide information about nearby stores (as you mentioned) and in-stock information.

It also provides services that are critical to the user experience - for example: searching and "product listing pages" (which can represent categories of products). I would encourage you to interact a bit with target.com (try searching, browsing, and looking at individual products) and take a look at some of the calls to redsky.target.com... here are a few examples of critical functionality:

• https://redsky.target.com/v1/plp/search/?count=24&offset=0&keyword=coffee+table&default_purchasability_filter=true&store_ids=redacted&visitorId=redacted&pageId=%2Fs%2Fcoffee+table&channel=web or https://redsky.target.com/v1/plp/collection/52044994
  
  
  
  • This is a product listing page: https://www.target.com/s?searchTerm=coffee+table&category=0%7CAll%7Cmatchallpartial%7Call+categories&tref=typeahead%7Cterm%7C1%7Ccoffee+table%7C%7C%7Cdefault
  
  
• https://redsky.target.com/v1/ship_methods/aggregator/51268413,53908655,53908596,53908342,53908118,53907772,53842325,53836259,53836108,53832972,53832838,53832808,53832782,53829712,53825435,53805624,53805557,53791112,53788864,53788844,53788775,53788762,53788696,53788639?latitude=redacted&longitude=redacted&storeId=redacted&zip=redacted&state=redacted&channel=web&visitorId=redacted&pageId=%2Fs%2Fcoffee%2Btable
  
  
  
  • This provides shipping information on listing pages (for example:" this product ships to you in X days")
  
  
• https://redsky.target.com/v2/pdp/tcin/51268413?excludes=taxonomy&storeId=1095
  
  
  
  • This provides item detail information (price, description, promotion info, etc) and is required to view individual products
  
  

Yes, there is some amount of user recommendations that occur (which may actually be beneficial for logged-in guests), but by and large, this service actually supplies critical data for guests that are browsing through products, viewing product information, and checking shipping times. As such, I'd request you reconsider redsky.target.com's inclusion in the blacklist.

Edit: looks like @gcase beat me to the response, but I hope this info is still useful for explaining some of the services Redsky provides

[nickjacques]

Regarding rum_analytics - I totally understand the desire not to be tracked, and how highly privacy is valued these days.

I've reached out to someone internally to understand what this endpoint is/does, and it is my understanding that it is solely for page load/render/performance information. For example, how long it takes to load components and render a particular product or category page. As far as I am aware, rum_analytics does not perform any sort of user-tracking - it's solely performance metrics that help us understand if parts of the site are not loading properly.

To be transparent, there are indeed a few analytics endpoints hosted at api.target.com, however, these are a small portion of the APIs that are available and are used across our web and mobile apps (approximately 1% of our API catalog). Unfortunately, this means that DNS is too broad of a blocking mechanism in this scenario (compared to taglocker, for example).

Please know that Greg and I only raised these concerns because website and mobile app functionality is impacted due to the inclusion of these domains. Hopefully we've been transparent in our dialog and we've shown that we're more concerned with functionality issues than we are with analytics or user research.

Please let @gcase or me know if you have any other questions! Thanks for shopping at Target, and thank you for putting a useful blacklist together. As a Target employee, I sincerely appreciate the former, and as a technologist, I appreciate you providing the latter as a useful service to the internet community.

[lightswitch05]

Fine I'll remove redsky.target.com - perhaps put it on my aggressive list. Its sad that your tracking is so integrated into your website and apps that it leaves no way to remove it without breaking everything. I know that I can go to your privacy policy and 'opt-out', but everyone knows cookie-based opting out is a joke with multiple devices and apps. Also, if you try to avoid tracking by deleting cookies, you just removed your opt-outs, how convenient for those trying to track people.

Here is a wonderful snippet from your privacy policy

Sharing with Other Companies (for their marketing purposes)
We may share your personal information with other companies, or organizations which are not part of Target. These companies and organizations may use the information we share to provide special offers and opportunities to you. To opt-out of our sharing of your personal information with such companies and organizations, go to the Choices section of this privacy policy.

It makes special note that this isn't some sort of aggregate non-identifiable info that is being shared, its legitimate personal information being shared freely with 3rd parties - and not for some sort of critical service like shipping, but just for advertising purposes. Combine this with your joke of an opt-out and what choices are your users left to avoid this shit? When did target stop being a Brick and mortar and get into the business of selling PII to whatever 3rd party bids the most?

[gcase]

@lightswitch05 Thank you for your prompt action.

[dnmTX]

@gcase take a note from the last @lightswitch05's post and fix that shit instead of thanking.Such a hypocrites,sick of you. 🖕

[rcyrus]

@dnmTX how is a broad privacy policy of a mega corporation @gcase's problem to fix? It has been mentioned that some of the these endpoints have trackers for performance metrics but they do not say that said metrics are sold. Do you consider performance analytics aggressive and unreasonable tracking? If so, I have some bad news for you! Might as well pack up your router and go find a cave to live in.

Toxic people like you give folks who actually care about digital privacy a bad rep.

[lightswitch05]

It's spelled out in the privacy policy to share PII with 3rd parties specifically for advertising. That doesn't sound like a "broad privacy policy" to me @rcyrus, it sounds like very specific use case

[dnmTX]

@rcyrus MENTIONED??????? BY WHO???? Those two jerks here are the last people i'm gonna believe on how they handle privacy on their end. And so you know...you more toxic then me defending them,you fucking complicit.

[rcyrus]

Gentlemen, pick your battles. Ankle biting from the bottom and attacking engineers from a large national corporation, who have no say over corp policy, will not advance your cause. These folks respectfully reached out to you and provided detailed and transparent explanations.

Keep up the good work.

[lightswitch05]

@rcyrus as I said above

Its sad that your tracking is so integrated into your website and apps that it leaves no way to remove it without breaking everything.

This is definitely something the engineering team can address. Another statement from above:

I know that I can go to your privacy policy and 'opt-out', but everyone knows cookie-based opting out is a joke with multiple devices and apps. Also, if you try to avoid tracking by deleting cookies, you just removed your opt-outs, how convenient for those trying to track people.

Wow, yet again a technical issue the engineering team could address to allow those of us who wish to be untracked and untargeted to have our privacy respected

As engineers we're responsible for what we build. To put all the blame on managers or corporate entities is disingenuous. You are responsible for what you build. You are responsible for being ethical.

[dnmTX]

@rcyrus ENJOY:
https://www.youtube.com/watch?v=F7o4oMKbStE

[lightswitch05]

Ankle biting from the bottom and attacking engineers from a large national corporation, who have no say over corp policy, will not advance your cause.

I just can't get over this. As far as these corporates are concerned there is a legitimate way to 'opt-out' of all this shit. But as this ticket clearly shows, it's not possible. Tracking has become part of the product. If I tried using cookie-based opt-outs, I would be worse off privacy-wise. Here is an article from three years ago talking about how bad cookie opt-outs are. The article concludes that the only real solution is to block ads and trackers locally. Guess what, nothing has changed! I want to re-emphasize that this is a technical problem. I set all my browsers to send Do-Not-Track signals, unfortunately only a minority of websites respect that. Cookies are not a valid way to opt-out and have not been for many years. Engineers know this, it's not something that's being debated.

Let me circle back around, as far as the corporation is concerned, there is a valid and functional way to opt-out of all this tracking, but we know better, and the engineers commenting on this thread are certainly aware.

Please give me a way to block these trackers without breaking your website. Or respect my DNT signal. Or put the opt-out into my target.com profile options. Or even better, do all three. Cookies are a joke.

[dnmTX]

@MrCrunchwrap what pissed me off was @gcase ignoring @lightswitch05's post (which was very much on point) and thanking him it's like @lightswitch05 is his employee or something and he is required to do so(is that the "polite dialog" you talking about?...he he he).So how i'm responding to such a arrogance and selfishness it's absolutely my business and mine along.
Why you even keep posting here,you got what you came for,hope you happy,now go sell my info,make a buck.....Mr....Engineer.

[lightswitch05]

@MrCrunchwrap I hope you can make a difference. I'm going to close this before Godwin's law is invoked. A functional opt-out isn't much of an ask. If only we had GDPR here in the states, but that will never happen.

[lightswitch05]

@nickjacques care to share if sapphire-api.target.com is tracking/ad-experiments only and can safely be blocked?

[nickjacques]

Hi @lightswitch05, unfortunately I don't think I can comment as I am no longer at Target. Perhaps @gcase can answer this question or refer it to someone else at Target.

(I don't want to give the impression that I am authoritatively speaking for Target or represent Target, since they are no longer my employer - not attempting to pass the buck because the answer to your question is bad or controversial. Hope that makes sense.)

[lightswitch05]

Thanks for the feedback @nickjacques. My testing shows that its experiment-related only and can be safely blocked without negatively affecting the target customer's experience. However, given the history here, I wanted to ask for confirmation first.

If no feedback is received, I'll consider it positive and that it can be blocked without issue.