I recently added Disqus to my site. Looking at the "scripts" tab on Firebug, I noticed a script called, http://scorecardresearch.com/beacon.js (here is a prettified version - the script is not accessible directly through the url provided).
What does beacon.js do? What does this report mean?
As far as I understand beacon.js along with cookies does a bunch of tracking of visitors, but I am unclear as to details and implications.
Here is the only hard coded JS on the pages that show the beacon.js script
The above ends up modifying the html on my page to include a script link to "scorecardresearch.com/beaons.js"
This is the get request to scorecardresearch.com when I am completely logged out in Chrome incongnito mode:
And here is Disqus' embed script, which adds in scorecardresearch.com and google-analytics too:
- Am I essentially giving scorecardresearch.com access to my users and user's cookies for my domain, since the script tag is on my page?
- What does this mean? I assume they have the same power to parse my user traffic as, say Google Analytics.
- Could they use the Disqus cookies stored on my site to log in to a user's Disqus account or access Disqus on another domain somehow?
- What practical implication does that xss report have?
- What are the disadvantages of allowing third party cookies on your site?