Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [third-party]

The tag has no usage guidance.

0
votes
0answers
36 views

How does the Brave browser protect against sites that a person has already logged into?

I understand that the Brave browser does not allow for 3rd party cookies to be set so that a user will not be tracked by a 3rd party site. However if I were to log into a site like Facebook and ...
0
votes
0answers
47 views

Embeddable 3rd party web tools security against stealing the key

We are building a website and we are using plenty of third-party tools that basically give you an HTML script tag and ask you to place it into your index.html. A few examples of such tools are: ...
1
vote
1answer
48 views

Best Practices for exporting sensitive database data and transforming it whilist keeping it encrypted?

Say one has to export database data to use in another tool, such as an Excel Spreadsheet or for use as a csv file with some other program. There's a problem with this, and that's that it ends up in ...
2
votes
2answers
111 views

“Don't break Debian” and bug fixes

Don't break Debian page is quite clear that always installing the latest versions of third-party software from from places other than official Debian repositories is not a good idea. Although the ...
1
vote
1answer
57 views

Is a bank's affiliate that provides services to the bank issuer required to show compliance or certification to PCI DSS

Is a bank's affiliate that provides services to the bank issuer required to demonstrate compliance or certification to PCI DSS? If so, how is this typically done?
1
vote
0answers
65 views

OWASP scan on SQL Server Compact Edition

On running a dependency check on my projects library, the tool reported multiple vulnerabilities in System.Data.SqlServerCe.dll, and CVE-2012-1856 with the highest score of 9.3 The version of the ...
78
votes
4answers
10k views

Can an identity provider impersonate me? (Can Facebook post Stack Overflow questions under my name?)

There are multiple mechanisms (some now defunct) that allow me to access service A (the Relying Party / RP) using a token granted by service B (the Identity Provider / IdP). Typically these replace a ...
0
votes
1answer
54 views

Creating a 3rd party tool that requires a user's auth token for the service

I want to scrape data from Fanball.com to keep track of the fantasy football players that I have drafted, and create a visualization of my exposure to different players. This is a tool that I have ...
1
vote
1answer
658 views

Penetration Testing vs Secure Source Code Review [duplicate]

Recently I came across to a situation where an institution has hired a third party vendor to develop its business applications. I came up with the following questions related to penetration testing ...
2
votes
1answer
88 views

Evaluating security of 3rd party <script>

I am researching about the 3rd party tools to use in a project, and I haven't found any conclusive evidence about this: Is it better* to include 3rd party scripts with a <script> tag or to host ...
3
votes
1answer
79 views

Hiring a Third Party Developer, what config files & certificates are ok to share?

So my cofounder and I hired a developer through Guru to build our native iOS and Android MVP's. Long story short, he agreed to integrate Firebase and BrainTree, and originally asked for our account ...
40
votes
2answers
6k views

Can advertisements read cookies of the website it is on?

I know many ads can store third-party cookies, but what about reading cookies? If so, what stops them from reading the session id to perform session hijacking?
1
vote
1answer
208 views

How to check if a third party jar(JRecord) has any security issues

We are in the process of using a third party jar which is not available in Maven Repo. It needs to be manually downloaded for usage. Is there any tool or way to find if the JAR has security issues? ...
0
votes
5answers
187 views

How to decide where to host an online store?

How can one know whether it is more secure to host the store on our own servers or on those from external vendors? Answer: Do a risk assessment. 1.) Summarized Answer 2.) Detailed Answer 3.) ...
4
votes
2answers
541 views

Examples of Federated Identity Management, Third Party Identity Services and Single Sign-On

I am studying the domain of Identity and Access Management in CISSP, and I come across the three terms Federated Identity Management (FIM), Third Party Identity Services (3PIS) and Single Sign-On (SSO)...
0
votes
1answer
170 views

What are some possible ways of sending anonymous request to re-crawl to Google? [closed]

This is a proposed architecture for submitting anonymous request to re-crawl the web page to google bot. I tried to come up with the solution given below. The intention of posting it here is to know ...
4
votes
1answer
150 views

How does the use of Microsoft-branded Azure products affect my privacy policy?

I have an existing on premise infrastructure which I'm considering moving to Azure. On that platform, there are products that enhance my security, presumably by collecting metadata (IP, session, etc). ...
1
vote
1answer
50 views

How to restrict third closed source process to read only own folders on Linux? [closed]

I have DropBox, Opera, Steam and others third closed software on my ArchLinux. I don't trust them, so I want limit its to read only its own folders aiming security and privacy protection.
9
votes
4answers
2k views

CSP allowing all Google domains?

I'm trying to develop a CSP for the site https://www.lidl-tour.ro. Right now there is a policy than runs in report-only-mode, so nothing is blocked at the moment. The site contacts googleads.g....
7
votes
3answers
95 views

Should I delete locally synced data if the user can't log in?

I'm building a Mac app that syncs the user's documents down from a third-party cloud service. When you set it up, it will sync all your documents down to the local hard disc, at which point you can ...
3
votes
1answer
44 views

How does a third party account reset work?

In Facebook for example, when I want to reset my password the website provides several options, one of them is just to login to my email in another tab in the same browser window then Facebook lets me ...
7
votes
2answers
937 views

Ebay sniping services - are passwords stored in plaintext?

For the uninitiated, eBay sniping services are third-party organisations that people can use to bid on an eBay auction at the last second, obviously this requires the user to provide their eBay ...
1
vote
0answers
173 views

How to prevent cache-based side-channel attacks in IoT devices

The sharing of hardware resources from various vendors in the Internet of things is fundamental for efficient processing in the cloud. The presence of a myraid of clients accessing the same hardware ...
1
vote
2answers
45 views

Should a Web site be allowed to use a third party web service directly?

Imagine I have a web site running on an IIS. The web site needs to get/send sensitive data from a 3rd party REST web service. Is there any reason why a web site (server side, not client side) should ...
0
votes
2answers
69 views

Is there any added security/vulnerabilities if you allow a “trusted-party” to vouch you are legit, if you were locked out of your account?

I was reading this answer on a question. https://security.stackexchange.com/a/498/106817 Recently, at the OWASP AppSec 2010 conference in Orange County, Bill Cheswick from AT&T talked at ...
1
vote
2answers
2k views

Third-party desktop client for accessing Google Drive cloud storage

I am considering signing up for a third-party service called Insync to access my Google Drive account. (Google does not offer a Linux client.) Insync reports in its FAQ: Does Insync store any ...
1
vote
1answer
63 views

Can a 3rd party validate the origin of an HTTPS session?

I'm wondering if HTTPS can be used as proof that a server reported an answer. If I understand correctly, the initial handshake is for HTTPS is the only time that the public/private key of the server ...
1
vote
1answer
32 views

Why mobile applications share device characteristics with third parties?

It is known that mobile applications can share with third parties many different types of data from information about the device to search terms used in the application. I understand that search ...
1
vote
0answers
44 views

What should I do when I find out some company user database I am listed in was leaked?

Today the antispam tool in the company I work for blocked several emails. It has been months since last time, so I took the time to analyze the quarantined messages. Since I almost never give my ...
5
votes
1answer
134 views

Keeping login in sync with third party providers

When you use a third party for authentication (E.g. Google/Facebook javascript SDK), their SDK keeps track of the login status. If I have my own server, which requires an access token of it's own (...
4
votes
3answers
696 views

Good way of storing lots of third-party passwords

I've consulted this question, but I'd like to hear some more input. I'm building a scraping app that is going to act as an aggregator of sorts for a large number of businesses which use a few popular ...
1
vote
1answer
57 views

Between point to point connectivity and remote network access, which is riskier?

Between point to point connectivity and remote network access, which is riskier? If I have a third party accessing my company's network, which are the different modes through which they can access and ...
0
votes
1answer
83 views

Security of Data and Source Code in a 3rd Party Hosting Environment [closed]

What expectation should I have for the security of my data and codebase hosted with a 3rd party e.g. godaddy, or any other similar hosting provider. How common is it that some IT employee within the ...
1
vote
2answers
222 views

Online Marketing company want me to share my Google Account login details?

We are a small business and use "Google Apps for Work" and my google apps account was used to set up the business's "Google My Business" and related Google+ pages We have now engaged an online ...
1
vote
0answers
271 views

What are the risks of adding third-party Root CA certificate into NTAuth Store?

What are the risks associated with importing a third-party Root CA certificate into the Enterprise NTAuth Store in a Windows Active Directory domain? (Except that the CA is then trusted to issue ...
2
votes
2answers
66 views

How dangerous is it to use textmods from internet sources?

I have been playing a game (.exe file downloaded from Internet) that supports the use of Textmods (altering of the game code in terms of textures) so long as they only affect visuals, and not actual ...
3
votes
1answer
144 views

Separate third-party cookies for each website

Instead of blocking third-party cookies (which might be useful), why don't browsers allow them, but keep all cookies separate for each address-bar website? For example, if a third-party website sets ...
16
votes
2answers
1k views

How to decide “I'll trust this software” for closed-source or precompiled software?

I am interested in watching an upcoming webinar that will discuss Puppet on AWS. In order to participate one needs to install a software application. Naturally, I won't do that as I can find enough ...
0
votes
1answer
61 views

Could it be insecure to suggest linking accounts to other identity providers based on their email address?

Let's say I have a site where users can log in with Google+ or Twitter. Now imagine a user called Bob going through the following steps: Sign in to my site using their twitter account. I request ...
1
vote
2answers
270 views

HTTP/S <-> HTTP/S cross-site requests: what do third-party websites know about where their objects are being referenced from?

There are four general cross-site request combinations security-wise, and I want to know whether ysite.com, in each case, knows that the reason I downloaded one of its resources was because I was ...
1
vote
2answers
28k views

SSL handshake exception: unable to find valid certification path to requested target

We are using a third party payment service for our web users to be able to pay for courses. Once payment is completed however, payu attempts to connect to our site and run an IPN. However, they get ...
18
votes
4answers
7k views

What to do about “approved” direct banking MITM sites like sofort.com?

Brussels Airlines allows several payment types, only two of which are free: Maestro and Sofort Banking: The second option was new to me, but direct debit is usually a free and practical way to pay: ...
0
votes
2answers
94 views

Deniable discussions online [closed]

Consider this scenario: Alice is a typical corporate shark. She wants to get ahead in her organisation. Alice has a sensitive information security scenario, she needs expert consultation but she ...
2
votes
2answers
730 views

security reviews of third party code

I am not familiar with all the steps involved in a full-fledged information security review of an in-house developed application, so I am wondering whether or not the following scenario is ...
2
votes
0answers
356 views

Allowing third-party clients to authenticate with an app server

I'm working on an app that is planned to be licensed to OEMs, who would in turn offer it as a service to their users.  We would host the app server and the OEM would optionally host the app's web ...
1
vote
1answer
219 views

Could a third party access my system - particularly browsing history?

Could clicking on an e-mail attachment (a Microsoft Excel file) from a trusted source (work colleague) have installed a tracking virus that would have allowed the sender to obtain browsing history ...
0
votes
1answer
56 views

How could a comments plugin be securely loaded from domains people are already logged into?

The fundamental idea is to load a blog comments plugin (like Disqus) from a domain someone is already logged into to save users time and increase engagement. I like the facebook comments plugin ...
5
votes
2answers
767 views

Facebook iOS SDK Authentication

The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app. If I find out an app's app ID, can't I just create another iOS app with that app's ...
3
votes
3answers
700 views

Should I install an SSL certificate for a website that uses a third party payment gateway?

I understand what an SSL certificate does but I need help evaluating if I need one for my client's website. His website sells holiday packages online but does so without asking for any credit card ...
1
vote
3answers
448 views

Can I trust profile data a 3rd party auth provider send to me?

This question may be related to this one, but I think we need to be sure. My website implement login via OpenID (or Google, or Facebook, etc.). On my website, authorization is based on user email ...