1

I have someone I hired on a Freelancing website working for me - so far he has worked for me for about two weeks and is doing a good job.

In order for him to complete his work he will need access to one of my accounts which has my credit card details in profile and other private details about myself. To complete his work he needs access to one or two pages on the website such as https://securesite.com/access but not to or https://securesite.com/settings.

I want to let him access the first URL but block access to all other pages including the second URL above.

I was thinking of setting up a remote server and logging into the respective site (even enabling remember my username / pass in case he gets logged out by site) and then installing a filter such as K9 (which allows me to block access to specific websites) and blocking access to every other page on the site besides the one he needs for the work.

However this will not work because K9 cannot filter https websites by URL. Is there any other solution?

Thanks

closed as unclear what you're asking by schroeder, Stephane, Lucas Kauffman, Xander, Steve Dodier-Lazaro May 22 '15 at 14:34

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    you are going to get a LOT of questions about why the person needs access to your specific account. Can you not create a duplicate account without all that data? – schroeder May 22 '15 at 5:00
  • @schroeder - No, it is impossible to duplicate the account. The account is a type of account that needs a lot of personnel details and cannot be duplicated. Think of it as a merchant account (it is not, just as example) – Keng Kolk May 22 '15 at 5:09
  • 2
    Let him connect to your machine (VNC / Teamviewer / Dameware) so you can see what's done on the screen. – Jeroen May 22 '15 at 6:44
  • @Jeroen-ITNerdbox - I cannot always be around when he connects.. – Keng Kolk May 22 '15 at 7:40
  • 2
    This sounds like a bad idea imho. A site that holds that much personal details means your freelancer can cause a lot of harm if he/she/it deliberately or accidentally discloses it to others with malicious intent. Much better to use an audit-able mechanism (like make him work on it only when your present and only on your machine with a audit logger on. – LvB May 22 '15 at 8:20
0

He needs only one page, right ? Fine then, you might want to save it somewhere, so he can access only that page.

Assuming the data he is trying to get is static, and assuming it's only for data processing purposes he needs that access, wouldn't that be a solution to save it somewhere else to give him access only to that page ?

Unless it's the secure connector he is trying to set up... So, what is your guy actually trying to achieve ?

  • it is one webpage, yes but it is NOT static so this would not work. – Keng Kolk May 22 '15 at 8:39
  • So, for dev/test purposes he needs the real actual set of data ? Sounds weird. Could it be possible to copycat the page, while putting inside non-static but fake data ? Here's what I'm trying to say : I want to obfuscate real data in such a way that he can process it without having access to the real deal. Once you give an access or your password, you are never 100% sure there is no leak of info, so best is to provide other data in the same skeleton. Apparently it looks like your were OK to give the password but "only for some pages". Sounds hard to do, though. – Doctor splooch May 22 '15 at 8:57
  • I am not giving away my password. I am logging in via chrome. The password is hidden so there is no way for him to get it unless he has pass of system. Once he is logged into site I just don't want him navigating around to other pages. – Keng Kolk May 22 '15 at 9:03
  • Ok thanks, I'm beggining to understand. The most simple thing I have in mind is setting up a parental control extension, where you only whitelist the pages you want him to have access. So everything that isn't in the whitelist should be blocked and hidden from his sight. That's just a theory though. – Doctor splooch May 22 '15 at 9:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.