For example, the site is supposed to adhere to cybersecurity standards for the federal government set by the National Institute of Standards and Technologies.
But just because all the standards are met does not mean all the holes are plugged. Some cybersecurity experts have echoed Mr. McAfee's comments. Here are some of the red flags they raise.
Request forgery. One potential flaw with the Obamacare website would grant automated “all-Access Request For Other Sites” – which basically allows another site to make a certain kinds of request to healthcare.gov that could lead to “cross-site request forgery” and potentially fooling the government site into releasing restricted information, writes Nidhi Shah, who works on research and development for HP's Web Security Research Group, on a company blog. That red flag appeared on some of the site's pages, but she admits it could not be confirmed at the time on the site’s most secure areas because of high traffic volume.
'Clickjacking.' The government site lacks defenses to prevent an attacker from putting an invisible layer over the legitimate website, Ms. Shah added. As a result, a user clicking on a link or button might end up at a renegade site that looked just the same – and end up divulging personal information to that site.
Verification. A more fundamental problem is the way the website is set up, contends Christopher Budd, communications manager for Trend Micro, a Tokyo-based cybersecurity company. "The health insurance exchange isn't made up of a single, authoritative site where people can go and register for coverage," he wrote in a blog post. "In addition to the federal site, people can apply for coverage at sites run by individual states. Then, within each state, there can also be legitimate third-party sites that provide assistance and even broker coverage," he said.