13

IFTTT looks like a powerful service but I'm also highly sceptical of its security. Could somebody give me a brief rundown of how you think it works and what the security implications are please? I've done some research myself but can't find a clear explanation of its principle of operation. My main query is, in giving IFTTT read and write permissions for all one's online accounts, does that create a single point of failure, where one vulnerability could result in compromise of all protected assets? Am I getting the wrong end of stick here?

  • 2
    IFTT secures your data, but it is still recommended that you do not share access to any sensitive information (such as the same login information needed to access your bank account). You should treat your IFTTT security with the same caution that you would any other free web-service: be aware of what services and devices it has access to and monitor for security leaks. – Ali May 17 '15 at 11:40
6

I think the security threats come from a few places:

  1. Data accessed by IFTTT. An attack can happen in transit, in memory, or in storage (for a security evaluation I'll assume that IFTTT stores all data it accesses).
  2. Accounts and devices connected to IFTTT. While you're recipes may not access sensitive data, if IFTTT has access due to mobile app permissions, login credentials, or other, an attacker may be able to get access to it.
  3. Profile information. IFTTT has quite a lot of data about your accounts across many systems and devices. Exposure of just that list of accounts and devices may be harmful.

There may be others that I've not thought of.

Your email password and SMS messages are likely among the most sensitive information they have access to as these are frequently used to reset passwords for many accounts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.