Timeline for iframe basic auth or token security
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 31, 2016 at 20:43 | comment | added | Neil Smithline | @SabrinaGelbart - there are only a couple of questions on this site about IFTTT. You can read their answers. Both point out that giving a 3rd-party site like IFTTT your credentials is risky. | |
| Jul 31, 2016 at 20:39 | comment | added | Neil Smithline | @SabrinaGelbart - just because SalesForce supports uname/pwd authentication, it doesn't mean it is a secure option. They also support OAuth authentication, that is the secure option. I suspect that the uname/pwd solution is for legacy systems that can't support OAuth. The same is true for Zapier and the similar IFTTT. It is very risky to tell a 3rd-party app your password. | |
| Jul 31, 2016 at 19:19 | comment | added | Sabrina Gelbart | The site storing the passwords (site1) is SalesForce, I'm not entirely sure how they do, but clearly they feel strong enough in their security to offer it as a solution to developers doing integrations (see developer.salesforce.com/docs/atlas.en-us.apexcode.meta/…). I believe Zapier offers this as well. My question isn't necessarily if storing credentials on the backend is secure or not, it's more about how to pass those credentials to the front end without making it even more insecure, if that makes sense. | |
| Jul 29, 2016 at 14:12 | history | edited | Neil Smithline | CC BY-SA 3.0 |
added 202 characters in body
|
| Jul 29, 2016 at 14:06 | history | answered | Neil Smithline | CC BY-SA 3.0 |