Questions tagged [third-party]

A third party is a person or group involved in a communication other than the principal parties (first and second). In cryptology, a hostile third party is often referred to as Eve (for "eavesdropper").

Filter by
Sorted by
Tagged with
0
votes
1answer
49 views

Can message length be useful information?

Suppose a packet is encrypted and sent via an insecure channel so that it is intercepted by a malicious third party as well as the intended recipient. As long as a suitable encryption scheme is used, ...
0
votes
0answers
50 views

My forgotten password was spelled out to me by customer support [closed]

This is regarding the same statewide online charter school I asked about here. This time I forgot my password, clicked to reset it, was directed to call customer support, and, upon identifying me, the ...
97
votes
24answers
10k views

How could I make the results of a yes/no vote inaccessible unless it's unanimous in the affirmative, without a trusted third party?

A family of N people (where N >= 3) are members of a cult. A suggestion is floated anonymously among them to leave the cult. If, in fact, every single person secretly harbors the desire to leave, ...
2
votes
2answers
74 views

Using OAuth SPA app to provide third party with access token

Say I had a centralized OAuth 2 authentication server, a Single Page Application (SPA) in an electron app, and a third-party server. The user launches this SPA, goes through the PKCE flow to obtain an ...
0
votes
1answer
52 views

Third Party Risk Management: Validating responses from vendors?

I am designing a 3PRM (Third-Party Risk Management) process in a FS company, and I'm curious about how other companies validate their supplier questionnaires. The system I'm anticipating is (after I'...
1
vote
1answer
89 views

Off-Facebook activities received from apps and websites NEVER logged in via Facebook

Facebook has recently launched "off facebook activity" which lets you see all the activities shared by other apps/websites that you have interacted with. But how did those apps and websites share ...
-3
votes
1answer
202 views

Why, with such insanely powerful computers, are no efforts to speak of spent on security? [closed]

The only technology "news" I ever hear about go on about "performance this" and "performance that". I haven't felt that my computer was "slow" since the 1990s. 20 years ago. Yet this is the only thing ...
0
votes
0answers
48 views

Inverse of Third Party Authentication

Consider this scenario. I have a file hosted on AWS with private access. I want the file to be accessible to several authorized users of a web applicaton that I have built. As I am the one ...
1
vote
1answer
73 views

What is the industry best practice for when 3rd parties are hit with ransomware? [closed]

I am interested to know if anyone has experienced this, what was the response and more importantly, is there best practices to handle these situations? My organization recently had a case where one ...
7
votes
1answer
2k views

Western Union prompts for bank login information — ridiculously bad practice? [duplicate]

I was trying to initiate a Western Union transaction from my bank account, but toward the end of the process I was prompted by this request, which is to type in my bank's login information. The ...
1
vote
2answers
127 views

PCI Compliance & Third Parties

Let's say that company X is PCI certified and compliant as a merchant. In terms of PCI compliance, what does company X have to consider while working with third parties? E.g. for business reasons ...
34
votes
1answer
5k views

How to deal with third parties in physical pentests?

From my previous question, I've seen that a "Permission to Attack" slip is crucial in ANY Penetration Test. However, that question and its answers and comments have only discusses interactions between ...
84
votes
5answers
16k views

How does Facebook track your browsing without third party cookies?

Facebook has served me an ad for a website I visited earlier in the day. I have third party cookies disabled and have not followed any links between the website and Facebook (links which could contain ...
2
votes
2answers
84 views

Handshake without asymmetric encryption

One of my teacher said "Without asymmetric encryption, we would be forced to use third-party to initiate any connection". I don't understand how it can be possible, what if an attack occur during the ...
0
votes
1answer
216 views

Content Security Policy (CSP) alternatives

Are there any off the shelf alternatives that come close to achieving the same results as Content Security Policy (CSP)? I understand the importance of CSP but it soon becomes unmanageable with inline ...
1
vote
2answers
151 views

What can a 3rd party learn about a user through only CSS and images?

In its default settings, uMatrix content blocker allows CSS and images (JPG, PNG, etc) from all sources, unless denied by a site-specific block list. It also allows 1st party cookies, scripts, and ...
-1
votes
2answers
97 views

Why do so many websites use third-party sites for hosting JavaScripts?

Why do so many websites serve JavaScripts from ajax.googleapis.com and other third-party sites? Wouldn't it be securer for these sites to host these scripts themselves?
0
votes
1answer
55 views

Can access tokens be given to a third party app's end users for a secure read/write process flow?

I have a B2B web app (and API) called XYZ. I have business customer ABC (and DEF, GHK, etc.), each of which have their own web app with their own distinct users. When a new user of ABC (or DEF, etc.) ...
0
votes
0answers
55 views

Embeddable 3rd party web tools security against stealing the key

We are building a website and we are using plenty of third-party tools that basically give you an HTML script tag and ask you to place it into your index.html. A few examples of such tools are: ...
1
vote
1answer
59 views

Best Practices for exporting sensitive database data and transforming it whilist keeping it encrypted?

Say one has to export database data to use in another tool, such as an Excel Spreadsheet or for use as a csv file with some other program. There's a problem with this, and that's that it ends up in ...
2
votes
2answers
195 views

“Don't break Debian” and bug fixes

Don't break Debian page is quite clear that always installing the latest versions of third-party software from from places other than official Debian repositories is not a good idea. Although the ...
1
vote
1answer
79 views

Is a bank's affiliate that provides services to the bank issuer required to show compliance or certification to PCI DSS

Is a bank's affiliate that provides services to the bank issuer required to demonstrate compliance or certification to PCI DSS? If so, how is this typically done?
1
vote
0answers
93 views

OWASP scan on SQL Server Compact Edition

On running a dependency check on my projects library, the tool reported multiple vulnerabilities in System.Data.SqlServerCe.dll, and CVE-2012-1856 with the highest score of 9.3 The version of the ...
78
votes
4answers
10k views

Can an identity provider impersonate me? (Can Facebook post Stack Overflow questions under my name?)

There are multiple mechanisms (some now defunct) that allow me to access service A (the Relying Party / RP) using a token granted by service B (the Identity Provider / IdP). Typically these replace a ...
0
votes
1answer
124 views

Creating a 3rd party tool that requires a user's auth token for the service

I want to scrape data from Fanball.com to keep track of the fantasy football players that I have drafted, and create a visualization of my exposure to different players. This is a tool that I have ...
1
vote
1answer
1k views

Penetration Testing vs Secure Source Code Review [duplicate]

Recently I came across to a situation where an institution has hired a third party vendor to develop its business applications. I came up with the following questions related to penetration testing ...
2
votes
1answer
122 views

Evaluating security of 3rd party <script>

I am researching about the 3rd party tools to use in a project, and I haven't found any conclusive evidence about this: Is it better* to include 3rd party scripts with a <script> tag or to host ...
3
votes
1answer
81 views

Hiring a Third Party Developer, what config files & certificates are ok to share?

So my cofounder and I hired a developer through Guru to build our native iOS and Android MVP's. Long story short, he agreed to integrate Firebase and BrainTree, and originally asked for our account ...
40
votes
2answers
7k views

Can advertisements read cookies of the website it is on?

I know many ads can store third-party cookies, but what about reading cookies? If so, what stops them from reading the session id to perform session hijacking?
1
vote
1answer
366 views

How to check if a third party jar(JRecord) has any security issues

We are in the process of using a third party jar which is not available in Maven Repo. It needs to be manually downloaded for usage. Is there any tool or way to find if the JAR has security issues? ...
1
vote
5answers
197 views

How to decide where to host an online store?

How can one know whether it is more secure to host the store on our own servers or on those from external vendors? Answer: Do a risk assessment. 1.) Summarized Answer 2.) Detailed Answer 3.) ...
4
votes
2answers
1k views

Examples of Federated Identity Management, Third Party Identity Services and Single Sign-On

I am studying the domain of Identity and Access Management in CISSP, and I come across the three terms Federated Identity Management (FIM), Third Party Identity Services (3PIS) and Single Sign-On (SSO)...
0
votes
1answer
174 views

What are some possible ways of sending anonymous request to re-crawl to Google? [closed]

This is a proposed architecture for submitting anonymous request to re-crawl the web page to google bot. I tried to come up with the solution given below. The intention of posting it here is to know ...
3
votes
1answer
151 views

How does the use of Microsoft-branded Azure products affect my privacy policy?

I have an existing on premise infrastructure which I'm considering moving to Azure. On that platform, there are products that enhance my security, presumably by collecting metadata (IP, session, etc). ...
1
vote
1answer
53 views

How to restrict third closed source process to read only own folders on Linux? [closed]

I have DropBox, Opera, Steam and others third closed software on my ArchLinux. I don't trust them, so I want limit its to read only its own folders aiming security and privacy protection.
14
votes
4answers
4k views

CSP allowing all Google domains?

I'm trying to develop a CSP for the site https://www.lidl-tour.ro. Right now there is a policy than runs in report-only-mode, so nothing is blocked at the moment. The site contacts googleads.g....
6
votes
3answers
103 views

Should I delete locally synced data if the user can't log in?

I'm building a Mac app that syncs the user's documents down from a third-party cloud service. When you set it up, it will sync all your documents down to the local hard disc, at which point you can ...
2
votes
1answer
113 views

How does a third party account reset work?

In Facebook for example, when I want to reset my password the website provides several options, one of them is just to login to my email in another tab in the same browser window then Facebook lets me ...
7
votes
2answers
968 views

Ebay sniping services - are passwords stored in plaintext?

For the uninitiated, eBay sniping services are third-party organisations that people can use to bid on an eBay auction at the last second, obviously this requires the user to provide their eBay ...
1
vote
0answers
183 views

How to prevent cache-based side-channel attacks in IoT devices

The sharing of hardware resources from various vendors in the Internet of things is fundamental for efficient processing in the cloud. The presence of a myraid of clients accessing the same hardware ...
1
vote
2answers
47 views

Should a Web site be allowed to use a third party web service directly?

Imagine I have a web site running on an IIS. The web site needs to get/send sensitive data from a 3rd party REST web service. Is there any reason why a web site (server side, not client side) should ...
0
votes
2answers
75 views

Is there any added security/vulnerabilities if you allow a “trusted-party” to vouch you are legit, if you were locked out of your account?

I was reading this answer on a question. https://security.stackexchange.com/a/498/106817 Recently, at the OWASP AppSec 2010 conference in Orange County, Bill Cheswick from AT&T talked at length ...
1
vote
2answers
2k views

Third-party desktop client for accessing Google Drive cloud storage

I am considering signing up for a third-party service called Insync to access my Google Drive account. (Google does not offer a Linux client.) Insync reports in its FAQ: Does Insync store any ...
1
vote
1answer
64 views

Can a 3rd party validate the origin of an HTTPS session?

I'm wondering if HTTPS can be used as proof that a server reported an answer. If I understand correctly, the initial handshake is for HTTPS is the only time that the public/private key of the server ...
1
vote
1answer
49 views

Why mobile applications share device characteristics with third parties?

It is known that mobile applications can share with third parties many different types of data from information about the device to search terms used in the application. I understand that search ...
1
vote
0answers
45 views

What should I do when I find out some company user database I am listed in was leaked?

Today the antispam tool in the company I work for blocked several emails. It has been months since last time, so I took the time to analyze the quarantined messages. Since I almost never give my ...
5
votes
1answer
203 views

Keeping login in sync with third party providers

When you use a third party for authentication (E.g. Google/Facebook javascript SDK), their SDK keeps track of the login status. If I have my own server, which requires an access token of it's own (...
3
votes
3answers
1k views

Good way of storing lots of third-party passwords

I've consulted this question, but I'd like to hear some more input. I'm building a scraping app that is going to act as an aggregator of sorts for a large number of businesses which use a few popular ...
1
vote
1answer
58 views

Between point to point connectivity and remote network access, which is riskier?

Between point to point connectivity and remote network access, which is riskier? If I have a third party accessing my company's network, which are the different modes through which they can access and ...
0
votes
1answer
91 views

Security of Data and Source Code in a 3rd Party Hosting Environment [closed]

What expectation should I have for the security of my data and codebase hosted with a 3rd party e.g. godaddy, or any other similar hosting provider. How common is it that some IT employee within the ...