Is it a security risk to embed a commenting service (like Disqus) into our site?

Question

Can commenting services like Disqus, IntenseDebate, etc. pose a security risk for corporations?

Edit: What risks could arise when embedding such services into corporate websites?

Answer 1

Answer to the original question: No, it's not a security risk for your employees to use Disqus etc. -- at least, no more than any other form of communication.

Of course, if employees post sensitive corporate information on these systems, then that may harm the corporation's interests. But you could say the same of any other means of communication. Hopefully, you train employees not to do that, and can rely upon them to be sensible.

---

Answer to the edited question: Yes, embedding these services on your corporation's web site is a security risk. The way you embed them is by embedding some Javascript and running it on your web domain. Since that Javascript gets access to your website, cookies for your website, your user's passwords on your website, etc., this requires complete trust in that Javascript. If the third-party comment provider (e.g., Disqus) is malicious or suffers from a security breach, it could use the access it has to attack your web page and your users. For more details, see Jeremiah Grossman's Third-Party Web Widget Security FAQ.

Answer 2

Adding to @D.W.'s great answer...

If your company is regulated and requires all communications to be audited by a 3rd party then that could be an issue.

For an example, financial advisors are required under FINRA to have all communications logged and monitored by someone like SMARSH. The implementation of such a compliance solution outside of email is a headache depending on the compliance officers requirements.

I'll suggest checking on a department by department basis, or business line.

Answer 3

I personally believe that using Disqus is more secure. My logic you ask? It's simple. Disqus gives you a few popular service that you can use to log in with, Facebook, OpenID, etc. I would much rather use credentials stored on their servers, than on some total random site that I can't verify has decent security. I'm not saying that just because the services Disqus provides are popular that they are secure, I just think they've had more time to correct & improve their security. There are exceptions of course.