Collaborate Disseminate
There are multiple mechanisms (some now defunct) that allow me to access service A (the Relying Party / RP) using a token granted by service B (the Identity Provider / IdP). Typically these replace a username-and-password log… Continue reading Can an identity provider impersonate me? (Can Facebook post Stack Overflow questions under my name?)
I want to scrape data from Fanball.com to keep track of the fantasy football players that I have drafted, and create a visualization of my exposure to different players. This is a tool that I have seen other people request an… Continue reading Creating a 3rd party tool that requires a user’s auth token for the service
Recently I came across to a situation where an institution has hired a third party vendor to develop its business applications. I came up with the following questions related to penetration testing and independent third party… Continue reading Penetration Testing vs Secure Source Code Review
Do people implicitly trust closed sourced binaries delivered by third party vendors? I am thinking of infrastructure applications like databases and web-servers but also more made-to-measure IT applications on the server or d… Continue reading How do you measure risk due to closed source applications? [on hold]
I know many ads can store third-party cookies, but what about reading cookies? If so, what stops them from reading the session id to perform session hijacking?
Continue reading Can advertisements read cookies of the website it is on?
Answer:
Do a risk assessment.
1.) Summarized Answer
2.) Detailed Answer
3.) Answer that might help you, if you’re in the same situation as me
The CEOs at my company plan to launch an online store
to let our customers buy and download our software-products 24/7.
They want also to leave the hosting to another company that is more experienced in webhosting than we are.
Edit: Some Information about us:
The Problem
However, I am skeptical because this means that the external hosting company:
On the other hand, it’s not a good idea to host the store on our servers because:
NOTE 1:
This question is not about convincing the
CEOs to invest more in security.
NOTE 2:
The other company does not necessary has to be an ISP (directly).
It could also be a webshop-developer who takes care about the hosting (and ISP).
The Question is:
How can we know whether it is more secure to host the store on
our own (insecure) servers or on those from external vendors?
¹ For Example:
No one outside of the USA can trust US-American hosting companies. (Not really their fault)
The patriot act forces them to hand every data to the NSA. (https://en.wikipedia.org/wiki/Patriot_Act)
Combine this with economic espionage
(https://www.theregister.co.uk/2015/06/29/wikileaks_docs_show_nsa_vs_france/)
and your business is ruined.
So this is really a serious problem.
Continue reading How to decide where to host an online store?
The CEOs at my company plan to launch an online store
to let our customers buy and download our software-products 24/7.
They want also to leave the hosting to another company that is more experienced in webhosting than we are.
Edit: Some Information about us:
The Problem
However, I am skeptical because this means that the external hosting company:
On the other hand, it’s not a good idea to host the store on our servers because:
NOTE 1:
This question is not about convincing the
CEOs to invest more in security.
NOTE 2:
The other company does not necessary has to be an ISP (directly).
It could also be a webshop-developer who takes care about the hosting (and ISP).
The Question is:
How can we know whether it is more secure to host the store on
our own (insecure) servers or on those from external vendors?
¹ For Example:
No one outside of the USA can trust US-American hosting companies. (Not their fault)
The patriot act forces them to hand every data to the NSA. (https://en.wikipedia.org/wiki/Patriot_Act)
Combine this with economic espionage
(https://www.theregister.co.uk/2015/06/29/wikileaks_docs_show_nsa_vs_france/)
and your business is ruined.
So this is really a serious problem.
Continue reading How to decide where to host an online store?
I am studying the domain of Identity and Access Management in CISSP, and I come across the three terms Federated Identity Management (FIM), Third Party Identity Services (3PIS) and Single Sign-On (SSO). After some readings, i… Continue reading Examples of Federated Identity Management, Third Party Identity Services and Single Sign-On
This is a proposed architecture for submitting anonymous request to re-crawl the web page to google bot fetch. I tried to come up with the solution given below. The intention of posting it here is to know the security loopho… Continue reading What are some possible ways of sending anonymous request to re-crawl to Google?
This is a proposed architecture for submitting anonymous request to re-crawl the web page to google bot. I tried to come up with the solution given below. The intention of posting it here is to know the security loopholes in… Continue reading What are some possible ways of sending anonymous request to re-crawl to Google?