If you have encountered issues with site visitors with malicious intent, where they are trying to “impersonate” your existing contacts and have the concern that these visitors could send or modify data into your instance, there are a series of steps that you can take to ensure your Drift instance is more secure than before. 

In this article, we'll go over:

• Security Misconfiguration Details
• Frequently Asked Questions

Security Misconfiguration Details

This is a security misconfiguration that only affects instances where three conditions must be true:

To start, here are the details:

1. You are using a csv upload, drift.identify, or the dev api to create contact records in Drift.
2. You are using those methods to create a contact and you are setting an externalId that is guessable.  (We have seen some customers with a small number of guessable external identifiers present, typically email address - this is likely via an integration or CSV upload. 
3. Signed Identities are not set to required - DISABLED and ENABLED will allow for impersonation of the end user.

Frequently Asked Questions

Q: Why does the above combo of settings create a security issue? 

A: It boils down to the fact that, if those three things are true, an impostor can go to your website and use the client side drift.identify method to tell Drift that they are someone else .
 

Q: How do we prevent/fix this?

A: Ensure that your signed identities are set to REQUIRED. To view and modify this setting, navigate to Settings > App Settings > Drift Widget > Widget Security
 

Q: Why does turning on signed identities solve this?  

A: By turning signed identities to REQUIRED, an impostor can no longer use the drift.identify method in the browser to impersonate someone, unless you also have the JSON Web Token signed by the unique token assigned to your given instance (This can be found under the Widget Security settings) It's basically password protecting the use of drift.identify.

Q: Why aren't other orgs that don't use csv uploads, drift.identify or the dev api to create contacts affected?  

A: The default Drift process of creating contact records and their externalIds uses unguessable strings that look something like this:  bdfe2e42-d4b6-4172-9a21-28bfda310d94. 

The drift_aid cookie value (also referred to as externalIds) would need to be guessed in order to use drift.identify to impersonate another user. 

The drift_aid cookie values are roughly a 1 out of 36^36 possibility of guessing, so even if signed identities is disabled in orgs that use the 'default' contact creation process, it's nearly impossible to guess the externalIds of existing contacts in order to impersonate them using drift.identify.
 

Q: What happens if I set Signed Identities to required now?

A: This depends on if you are, or are not using drift.identify.

• If you ARE NOT using drift.identify method anywhere in your client side code, there will be no impact to Drift if/when you turn on signed identities. 
• If you ARE using drift.identify, you will need to modify your client side code to include the JSON Web Token when calling drift.identify.