Re:We handled a recent phishing incident that targeted Dropbox
by not2b on Tuesday November 01, 2022 @11:54AM
(#33422933)
Yes, that's a big problem at my employer. So many functions have been contracted out that I have to deal with official functions via sites belonging to at least 15 outside companies, many for sensitive HR-related functions, expense reports, and purchasing. It's hard to keep track of all that, and makes it more likely that some employee will make a mistake.
[ Parent
| on HN ]
Re:We handled a recent phishing incident that targeted Dropbox
by dotBen on Tuesday November 01, 2022 @12:06PM
(#33423145)
But it's just as easy to point a DNS record from hr.internal.dropbox.com or techblog.dropbox.com to trusted third party vendors as it is to set up a new domain, but the use of subdomains maintains the security model.
Re:We handled a recent phishing incident that targeted Dropbox
by jefftk on Tuesday November 01, 2022 @12:32PM
(#33423526)
In the standard way of configuring cookies, allowing third parties to use a subdomain of your domain lets them collect your HTTP_ONLY SECURE cookies and impersonate your users.
The security policy at the FAANG I used to work at required third party vendor code to run on other domains for this reason.