We have been asked to evaluate Conversant Tracking.
The main issue I have is they require us to point two cnames at their system to allow for "First Party Cookies".
I know this means all cookies would have to be changed to www.foobar.com, instead of foobar.com, to avoid any issues with information being possible exposed to their end.
But more I was wondering what type of attacks this could open us up to if they had a security issue, if this is more or less secure than google's re-marketings model, and what issues could this cause for us with PCI compliance?
PS We use Braintree and Braintree.js so we are just covered under PCI for handling of Tokens, if that matters at all.