I'm confused. I want to use '_mkto_trk'. I don't want to pass anything in the email link, like a lead id, so the email link performance stats can be aggregated within marketo. Therefore I think the lead has to be associated or else the cookie id won't return any data. Is that right?
That's right. If you include a token in the link, the links are differentiated. However, this is the only way to have a directly linked non-Marketo site be aware of the targeted lead from the very first page view. The reporting drawback is a prime reason it's better to bounce the user off a Marketo LP so that you have that data available.
I'm aware of the DoS vulnerability. I guess I thought the chance of that happening is comparable to someone throwing a brick through my front window. It could definitely happen, but I think I'll keep my window.
I don't think online security/risk/reliability concerns compare to neighborhood vandalism, unless you live in a neighborhood where there are rocks thrown at your house thousands of times per day!
This attack could be executed by a single disgruntled customer, a very junior hacker just trying to prove his/her skills, or a competitor (or someone trying to impress a competitor). A DoS attack that can be executed by a single machine running over a 56K modem is something I have to take seriously. This isn't something that takes a botnet to execute (that would fall into the acceptable risk category, esp. because your site probably couldn't handle the traffic anyway).
And if it kept happening, then I would stop doing it. In life we live with risk, but it would be good if there were a way to minimize that risk and still get prefill on an external page. Is there a way to do that?
Yes, there is. It's something I'm going to publish at some point (hopefully on the Community blog when I get access).
.png)