IFTTT looks like a powerful service but I'm also highly sceptical of its security. Could somebody give me a brief rundown of how you think it works and what the security implications are please? I've done some research myself but can't find a clear explanation of its principle of operation. My main query is, in giving IFTTT read and write permissions for all one's online accounts, does that create a single point of failure, where one vulnerability could result in compromise of all protected assets? Am I getting the wrong end of stick here?
I think the security threats come from a few places:
- Data accessed by IFTTT. An attack can happen in transit, in memory, or in storage (for a security evaluation I'll assume that IFTTT stores all data it accesses).
- Accounts and devices connected to IFTTT. While you're recipes may not access sensitive data, if IFTTT has access due to mobile app permissions, login credentials, or other, an attacker may be able to get access to it.
- Profile information. IFTTT has quite a lot of data about your accounts across many systems and devices. Exposure of just that list of accounts and devices may be harmful.
There may be others that I've not thought of.
Your email password and SMS messages are likely among the most sensitive information they have access to as these are frequently used to reset passwords for many accounts.