The tag has no usage guidance.

learn more… | top users | synonyms

1
vote
2answers
31 views

Should a Web site be allowed to use a third party web service directly?

Imagine I have a web site running on an IIS. The web site needs to get/send sensitive data from a 3rd party REST web service. Is there any reason why a web site (server side, not client side) should ...
0
votes
2answers
41 views

Is there any added security/vulnerabilities if you allow a “trusted-party” to vouch you are legit, if you were locked out of your account?

I was reading this answer on a question. http://security.stackexchange.com/a/498/106817 Recently, at the OWASP AppSec 2010 conference in Orange County, Bill Cheswick from AT&T talked at ...
1
vote
2answers
83 views

Third-party desktop client for accessing Google Drive cloud storage

I am considering signing up for a third-party service called Insync to access my Google Drive account. (Google does not offer a Linux client.) Insync reports in its FAQ: Does Insync store any ...
0
votes
1answer
32 views

Can a 3rd party validate the origin of an HTTPS session?

I'm wondering if HTTPS can be used as proof that a server reported an answer. If I understand correctly, the initial handshake is for HTTPS is the only time that the public/private key of the server ...
1
vote
1answer
25 views

Why mobile applications share device characteristics with third parties?

It is known that mobile applications can share with third parties many different types of data from information about the device to search terms used in the application. I understand that search ...
1
vote
0answers
39 views

What should I do when I find out some company user database I am listed in was leaked?

Today the antispam tool in the company I work for blocked several emails. It has been months since last time, so I took the time to analyze the quarantined messages. Since I almost never give my ...
5
votes
1answer
67 views

Keeping login in sync with third party providers

When you use a third party for authentication (E.g. Google/Facebook javascript SDK), their SDK keeps track of the login status. If I have my own server, which requires an access token of it's own (...
0
votes
0answers
18 views

Receiving third-party credentials on AWS

In my previous question, I was trying to figure out how to store third-party passwords safely. Now it seems that they'll be sent to my AWS instance from another AWS instance. I imagine the transfer ...
3
votes
3answers
146 views

Good way of storing lots of third-party passwords

I've consulted this question, but I'd like to hear some more input. I'm building a scraping app that is going to act as an aggregator of sorts for a large number of businesses which use a few popular ...
1
vote
1answer
47 views

Between point to point connectivity and remote network access, which is riskier?

Between point to point connectivity and remote network access, which is riskier? If I have a third party accessing my company's network, which are the different modes through which they can access and ...
0
votes
1answer
51 views

Security of Data and Source Code in a 3rd Party Hosting Environment [closed]

What expectation should I have for the security of my data and codebase hosted with a 3rd party e.g. godaddy, or any other similar hosting provider. How common is it that some IT employee within the ...
1
vote
2answers
130 views

Online Marketing company want me to share my Google Account login details?

We are a small business and use "Google Apps for Work" and my google apps account was used to set up the business's "Google My Business" and related Google+ pages We have now engaged an online ...
1
vote
0answers
104 views

What are the risks of adding third-party Root CA certificate into NTAuth Store?

What are the risks associated with importing a third-party Root CA certificate into the Enterprise NTAuth Store in a Windows Active Directory domain? (Except that the CA is then trusted to issue ...
2
votes
2answers
49 views

How dangerous is it to use textmods from internet sources?

I have been playing a game (.exe file downloaded from Internet) that supports the use of Textmods (altering of the game code in terms of textures) so long as they only affect visuals, and not actual ...
3
votes
1answer
89 views

Separate third-party cookies for each website

Instead of blocking third-party cookies (which might be useful), why don't browsers allow them, but keep all cookies separate for each address-bar website? For example, if a third-party website sets ...
12
votes
2answers
1k views

How to decide “I'll trust this software” for closed-source or precompiled software?

I am interested in watching an upcoming webinar that will discuss Puppet on AWS. In order to participate one needs to install a software application. Naturally, I won't do that as I can find enough ...
0
votes
1answer
45 views

Could it be insecure to suggest linking accounts to other identity providers based on their email address?

Let's say I have a site where users can log in with Google+ or Twitter. Now imagine a user called Bob going through the following steps: Sign in to my site using their twitter account. I request ...
0
votes
2answers
113 views

HTTP/S <-> HTTP/S cross-site requests: what do third-party websites know about where their objects are being referenced from?

There are four general cross-site request combinations security-wise, and I want to know whether ysite.com, in each case, knows that the reason I downloaded one of its resources was because I was ...
1
vote
2answers
20k views

SSL handshake exception: unable to find valid certification path to requested target

We are using a third party payment service for our web users to be able to pay for courses. Once payment is completed however, payu attempts to connect to our site and run an IPN. However, they get ...
7
votes
2answers
2k views

What to do about “approved” direct banking MITM sites like sofort.com?

Brussels Airlines allows several payment types, only two of which are free: Maestro and Sofort Banking: The second option was new to me, but direct debit is usually a free and practical way to pay: ...
0
votes
2answers
76 views

Deniable discussions online [closed]

Consider this scenario: Alice is a typical corporate shark. She wants to get ahead in her organisation. Alice has a sensitive information security scenario, she needs expert consultation but she ...
2
votes
2answers
296 views

security reviews of third party code

I am not familiar with all the steps involved in a full-fledged information security review of an in-house developed application, so I am wondering whether or not the following scenario is ...
2
votes
0answers
174 views

Allowing third-party clients to authenticate with an app server

I'm working on an app that is planned to be licensed to OEMs, who would in turn offer it as a service to their users.  We would host the app server and the OEM would optionally host the app's web ...
1
vote
1answer
160 views

Could a third party access my system - particularly browsing history?

Could clicking on an e-mail attachment (a Microsoft Excel file) from a trusted source (work colleague) have installed a tracking virus that would have allowed the sender to obtain browsing history ...
0
votes
1answer
52 views

How could a comments plugin be securely loaded from domains people are already logged into?

The fundamental idea is to load a blog comments plugin (like Disqus) from a domain someone is already logged into to save users time and increase engagement. I like the facebook comments plugin ...
4
votes
2answers
660 views

Facebook iOS SDK Authentication

The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app. If I find out an app's app ID, can't I just create another iOS app with that app's ...
3
votes
3answers
460 views

Should I install an SSL certificate for a website that uses a third party payment gateway?

I understand what an SSL certificate does but I need help evaluating if I need one for my client's website. His website sells holiday packages online but does so without asking for any credit card ...
1
vote
3answers
184 views

Can I trust profile data a 3rd party auth provider send to me?

This question may be related to this one, but I think we need to be sure. My website implement login via OpenID (or Google, or Facebook, etc.). On my website, authorization is based on user email ...
1
vote
1answer
543 views

Security implications of hosting third-party Javascript [duplicate]

A client of ours wants us to host a blob of Javascript for their custom-branded version of our website. It is hosted on a subdomain of our site (customer.example.com), but uses the same cookie domain ...