3 ms·
Yes, that's a big problem at my employer. So many functions have been contracted out that I have to deal with official functions via sites belonging to at least
by not2b 4y ago
Yes, that's a big problem at my employer. So many functions have been contracted out that I have to deal with official functions via sites belonging to at least 15 outside companies, many for sensitive HR-related functions, expense reports, and purchasing. It's hard to keep track of all that, and makes it more likely that some employee will make a mistake.
- dotBen 4y agoBut it's just as easy to point a DNS record from hr.internal.dropbox.com or techblog.dropbox.com to trusted third party vendors as it is to set up a new domain, but the use of subdomains maintains the security model.
- jefftk 4y agoIn the standard way of configuring cookies, allowing third parties to use a subdomain of your domain lets them collect your HTTP_ONLY SECURE cookies and impersonate your users. The security policy at the FAANG I used to work at required third party vendor code to run on other domains for this reason.