Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Can commenting services like Disqus, IntenseDebate, etc. pose a security risk for corporations?

Edit: What risks could arise when embedding such services into corporate websites?

share|improve this question

3 Answers 3

up vote 10 down vote accepted

Answer to the original question: No, it's not a security risk for your employees to use Disqus etc. -- at least, no more than any other form of communication.

Of course, if employees post sensitive corporate information on these systems, then that may harm the corporation's interests. But you could say the same of any other means of communication. Hopefully, you train employees not to do that, and can rely upon them to be sensible.


Answer to the edited question: Yes, embedding these services on your corporation's web site is a security risk. The way you embed them is by embedding some Javascript and running it on your web domain. Since that Javascript gets access to your website, cookies for your website, your user's passwords on your website, etc., this requires complete trust in that Javascript. If the third-party comment provider (e.g., Disqus) is malicious or suffers from a security breach, it could use the access it has to attack your web page and your users. For more details, see Jeremiah Grossman's Third-Party Web Widget Security FAQ.

share|improve this answer
    
Thanks! That goes without saying. I had concerns that an external service embedded into a local site could create some kind of backdoor or expose the information on that site. –  TheLostOne May 17 '12 at 13:45
    
@TheLostOne, do you mean you are embedding Disqus etc onto one of your corporation's web sites? If so, that wasn't clear from the question; you want to revise the question, because then the answer does become a bit different -- embedding a third-party service or widget into your web pages is indeed risky. –  D.W. May 17 '12 at 17:47
    
Sorry for the late reply. Indeed I've meant embedding such services in corporation's web sites. Sorry, should have explained clearer. –  TheLostOne May 24 '12 at 19:25
    
Thanks for the detailed answer! So any externally embedded Javascript could theoretically compromise the security. –  TheLostOne May 26 '12 at 12:26

Adding to @D.W.'s great answer...

If your company is regulated and requires all communications to be audited by a 3rd party then that could be an issue.

For an example, financial advisors are required under FINRA to have all communications logged and monitored by someone like SMARSH. The implementation of such a compliance solution outside of email is a headache depending on the compliance officers requirements.

I'll suggest checking on a department by department basis, or business line.

share|improve this answer

I personally believe that using Disqus is more secure. My logic you ask? It's simple. Disqus gives you a few popular service that you can use to log in with, Facebook, OpenID, etc. I would much rather use credentials stored on their servers, than on some total random site that I can't verify has decent security. I'm not saying that just because the services Disqus provides are popular that they are secure, I just think they've had more time to correct & improve their security. There are exceptions of course.

share|improve this answer

protected by Community Feb 21 '13 at 23:36

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.