Tag Info

New answers tagged

0

All of the above posts are correct in that you need to trust the third party in order to safely use external js resources. The only thing I would add on to that is make sure that you are accessing those resources over SSL and that it's an up-to-date implementation (proper cipher suite, TLS v1, etc). If you are going to trust the third party, SSL is needed ...


4

This has more to do with risk management. You do not have any contract with Facebook or Twitter. So you have a risk that they may change the contents of the JavaScript file without you knowing. This can be malicious or accidental, either way you have no control of this risk. So unless you get a contract with the external party which moves the liability to ...


0

Hosting locally will not prevent them from doing anything malicious. In this case, if you are importing a JavaScript file from external source, into your page, you will have to 100% trust the JavaScript as this script will be executed within your own origin. Hosting them locally might provide some advantage in case the source you trusted is compromise. The ...


0

I didn't implement such a system. But I can still answer your questions (I hope). A different password for each application is a nice feature to enhance security, so that a broken password won't immediatly give you access to all apps. The problem with logging in with a different password for each application is the amount of passwords. Google has like 10 ...


0

Infected? Probably not. Google thinks you're in a different country, but that has happened to others. The link to report a websearch misidentification is here1 Just to be complete, the link itself is examined elsewhere: What does the ei mean with a decode of a sample and a link to a guide A similar discussion in WilderSecurity forums, where the suggestion ...


1

If you happen to use a proxy server or the Tor browser, and open google.com, then the page that actually opens will be dependent on the country where the exit node or the proxy server is located. For example, opening google.com with Tor with the exit relay at Switzerland, will redirect to google.ch instead. For the Chrome browser, you can try an extension ...


1

Token expiration may take place on the server side causing the client to reauth after x time. If youre looking to do social logins this method should be fine as long as youre transmitting the data over SSL and not saving credentials (U/P Combos) on your systems. The login endpoint should be running on HTTPS (again, read, secure) and should be connecting to ...


2

Short answer: You're flows are identifying any traffic to any google operated servers on the internet. Longer answer: What quack's link is saying is that every google owned IP address resolves to the 1e100.net domain. $ dig +short www.google.com 74.125.239.52 74.125.239.48 74.125.239.49 74.125.239.51 74.125.239.50 $ dig +short -x 74.125.239.52 ...



Top 50 recent answers are included