Questions tagged [web-browser]

A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

Filter by
Sorted by
Tagged with
0 votes
0 answers
37 views

Secure web browsing and the internet [closed]

With all the tools legally available to “secure” one’s connection to the internet nowadays, why aren’t government organisations like the CIA taking any action against the companies and people behind ...
primeCEOstack's user avatar
19 votes
6 answers
10k views

Are Cyrillic characters a real threat?

I've seen people in security saying URLs with Cyrillic characters are dangerous. If you ever type such characters on a browser you'd see they break into crazy unrecognizable URLs that have nothing to ...
Gatonito's user avatar
  • 343
0 votes
1 answer
52 views

How can the Beef Tool be used? [closed]

Can the hijacked browser's history and saved information be viewed? Is it possible to create a backdoor in the browser? In other words, can it be secretly redirected to any site or downloaded and ...
lkk4325's user avatar
2 votes
1 answer
124 views

Securely storing derived key in web app and handling user identity

I am currently working on an open source project to securely store notes, payment card numbers, etc. I would like to implement a zero knowledge encryption method so that no one but the user can ...
mson's user avatar
  • 21
13 votes
3 answers
7k views

Why are iframes allowed by default?

Clickjacking is still very possible in 2024, because iframe embedding is allowed by default. Why is this the case? In 2013 there was a question about why iframes exist at all (Why are iframes allowed ...
yeerk's user avatar
  • 238
0 votes
1 answer
85 views

Does enabling hardware acceleration increase the attack surface of software?

For software that process untrusted data and have an option to use hardware acceleration, does enabling hardware acceleration increase the attack surface of the software? Examples of situations where ...
Flux's user avatar
  • 873
0 votes
1 answer
191 views

How to determine which Chrome extension is re-directing me to ad sites

Twice now, seemingly randomly, I've been redirected to an ad site. I believe it has occurred both times when I have a new tab open, type what I'm searching for (Google is my default search engine), ...
johnfernow's user avatar
2 votes
0 answers
117 views

CSP: Allow inline scripts while blocking javascript: in iframe src

We wan't to prevent attacks comming in from src attribute "javascript:" but still allow lnline script tags. Currently the only option is to add sha-hash's but there are too many inline ...
Chris Gunawardena's user avatar
2 votes
0 answers
84 views

How is this website able to determine my country? [closed]

Today I wanted to visit https://scp-wiki.wikidot.com/scp-4999 to conduct some scientific research. Upon loading the page, I was greeted with a text saying Russia (the country I'm in) and Belarus are ...
Gallifreyan's user avatar
0 votes
1 answer
95 views

Can you retrieve messages from instagram or messenger off of a SIM card?

Can you retrieve personal information ie; messages from browsers, off of a SIM card?
Josh Coleman's user avatar
0 votes
0 answers
26 views

When using a VPN is the device DNS cache still written to? [duplicate]

When I am using ProtonVPN, does the VPN server run DNS resolution upon receiving the request, similar to a Tor exit node, thereby bypassing the device's DNS cache? Or do my browser's DNS queries still ...
yellow-saint's user avatar
1 vote
1 answer
218 views

Are 2FA browser plugins sufficiently secure?

Regarding 2FA browser plugins, I follow the uneducated opinion that they usually provide sufficient security. Since a desktop computer is a unique device (even a virtual machine) and provides that ...
Jonathan Root's user avatar
1 vote
1 answer
138 views

Does not storing passwords in browser really matter given cookie hijacking exists?

I see lots of articles suggesting not storing passwords in the browser, and it made perfect sense to me, if I can access this data easily, an attacker probably can too. But then I found out about ...
Arthur Moraes Do Lago's user avatar
2 votes
1 answer
393 views

In the modern context, what max harm can a webpage do, if the creator is malignant? [duplicate]

Note: this does not answer my question as it mentions Java/Flash(not in the modern context. The question is from like 10 years ago so probably outdated), and mentions weakness introduced by the user(...
Nicholas's user avatar
  • 131
0 votes
0 answers
56 views

Methods to look for when checking if a javascript program is making network requests

I'm trying to quickly audit a js browser extension to see if it doesn't talk to the outside. Am I right in thinking that I can just grep the code for the following: XMLHttpRequest fetch $.ajax axios....
Scb's user avatar
  • 101
0 votes
0 answers
68 views

Which system variables are exposed from browser JavaScript context?

I know that the TZ variable aka TimeZone can be read by servers, especially with fingerprinting. What are the exposed variables to browser's ?
Gilles Quénot's user avatar
1 vote
1 answer
242 views

How safe it is to view PDF file in browser without downloading the file into PC?

When I view the PDF file in a browser such as FireFox without downloading the file into my PC, does FireFox temporarily store the PDF file in my PC? I heard that FireFox has been sandbox heavily and ...
JUZ Aviewer's user avatar
1 vote
0 answers
120 views

Does the browser pass the name of the camera being used to the website [closed]

Does the browser pass the name of the camera being used to the website which is accessing our camera like when we use obs virtual cam so is the website able to detect that a virtual camera is being ...
jinchuriki's user avatar
0 votes
1 answer
74 views

How vulnerable is Opera using a version of Chromium that is 3 versions behind?

Uses Chromium 115 when current stable is 118. They do claim to have the latest chromium security updates. Does patching old chromium with the latest security fixes bring it on par with the latest ...
Shubham Deshmukh's user avatar
1 vote
1 answer
228 views

Since yt-dlp simulates a browser, can it be fingerprinted in the same ways (e.g. canvas and audiocontext)?

I know that wget and curl can mitigate fingerprinting (aside from http header and user agent), but will yt-dlp give away more data?
BigAl's user avatar
  • 11
0 votes
1 answer
79 views

How to properly migrate authentication cookies to using a new encryption scheme on a website while being backwards compatible?

When a user logs in with their email/password combo and gets authenticated to our website, the backend sends the web browser an encrypted cookie based off of their memberId with us. While this ...
user1068636's user avatar
0 votes
2 answers
298 views

Why do we use Session ID cookies on the web instead of a unique device identifier?

Session IDs aren't exactly secure, you can copy them from one device to another just by copying the browser's temp files. Techniques to tell apart one device from another have existed in browsers for ...
u7w2's user avatar
  • 1
18 votes
2 answers
6k views

How is Xiaomi changing my browser home page?

I have recently observed that the home page of Google Chrome on my Xiaomi Android phone has been altered to a website called "Mintnav". I did not update any software. How is Xiaomi able to ...
samurai jack's user avatar
1 vote
1 answer
224 views

CSP script-scr blob

What are the risks to allow a "blob:" directive to the script-src CSP? Is it safe? I have a list of allowed domains defined in script-src, but nonetheless I got an error specifying the ...
Giuseppe Canto's user avatar
0 votes
0 answers
70 views

What can be leaked using a browser extension where one of the extensions loads JavaScript from a remote site?

Can one remotely log my IP, browser history, and saved passwords? I think the IP should be easily done if one of the extensions load a remote JavaScript to run in my browser. I'm not sure about other ...
Maxfield's user avatar
  • 127
1 vote
1 answer
217 views

Do CSRF Tokens need to be tied to user IDs?

I am implementing a web system using Golang and have incorporated gorilla/csrf for CSRF protection. However, I've encountered an issue. When I have tab1 open in my browser, logged in as user1, and ...
Kholin's user avatar
  • 11
1 vote
1 answer
172 views

CryptoKey with IndexedDB to secure stateless authentication

Stateless authentication using e.g. JWT can be dangerous as they are non-revocable and can leak giving full access. But they are really flexible. I'm considering a scenario where the issued JWT is ...
Szyszka947's user avatar
1 vote
0 answers
100 views

Is there a way to prevent/detect DOM Clobbering in the browser?

It is possible to clobber document attributes, e.g.: <img name="cookie"> ... typeof(document.cookie) //=> 'object' Is there any way to prevent this from happening, access the ...
muhashi's user avatar
  • 11
1 vote
0 answers
93 views

Recovering Lost Brave Browser Usernames and Passwords

I recently changed my password for my local Windows 10 account and found out that my usernames/passwords in Brave's password manager are no longer visible. Unfortunately, I executed Brave after the ...
arn's user avatar
  • 11
1 vote
1 answer
234 views

Can a browser-based HTTPS proxy secure browsing data while using a system-level proxy?

I use Nekoray to set up proxies for my Windows system. When I connect to those proxies, does using a browser-based proxy with HTTPS encryption secure my transferred data through the web browser? Can ...
Winner1's user avatar
  • 113
0 votes
0 answers
77 views

Are there any html Sanitizer() API configs that allow javascript execution?

I'm talking specifically about the HTML Sanitizer API: https://developer.mozilla.org/en-US/docs/Web/API/HTML_Sanitizer_API The API allows you to configure the sanitizer with a list of allowed elements ...
user1131308's user avatar
2 votes
1 answer
137 views

Distinguish origin of password prompts

I am wondering how to distinguish (password) prompts that the OS issued from prompts that are delivered application-side. This question first occurred to me when considering Firefox master passwords, ...
kaiyazeera's user avatar
1 vote
1 answer
486 views

Are CORS headers useless?

It is common to say that CORS headers protect against CSRF, so that if you visit a malicious website, it cannot make a request to your web application because the referer header (the URL of the ...
Vitor Figueredo Marques's user avatar
9 votes
1 answer
2k views

What is the current (April 2023) browser support for Ed25519 certificate signatures?

It seems that Firefox and Chrome both support x25519 keys, but they do not accept keys signed using Ed25519. Am I correct? If so, where can I find the official source of this information?
TonyStacker's user avatar
3 votes
2 answers
807 views

XSS in a href with target=_blank

I have found out that in most browsers the following code won't execute: <a href="javascript:alert(1)" target=_blank>click</a> But the same code without blank will. My question ...
The Modern Gamer's user avatar
1 vote
2 answers
351 views

How securely is data deleted with IndexedDB?

I'd like to understand how securely is data deleted when we request for its deletion using .clear(). I suspect it being weak. Is there a method available from the browser API (would write/delete junk ...
comte's user avatar
  • 113
0 votes
1 answer
168 views

How to safely share data between 2 SPAs?

Let's say I have 2 SPAs (single page applications), SPA A and SPA B. I want to share data between the 2 applications for an end-to-end flow. How can I safely share data such that it would not be ...
Adam Thompson's user avatar
0 votes
1 answer
250 views

How to reliably identify referrer on client browser?

Is there any way to reliably identify the referring site on modern browsers (not considering manual HTTP requests outside of a browser e.g. cURL, etc.)? Referrer header will not work because the ...
Adam Thompson's user avatar
7 votes
3 answers
3k views

ESTABLISHED TCP connections after opening browser in linux

I am using netstat -acp | grep ESTABLISHED command to check established connection between with my system. $ sudo netstat -acp | grep ESTABLISHED tcp 0 0 rg-Vostro-3546:51874 server-18-...
Coder's user avatar
  • 187
1 vote
1 answer
114 views

Ways to safeguard Internet users from fraudulent websites

Extended Validation SSL certificates have been effectively abandoned, as web browsers do not even show them as something special, so my question is: how would you go about safeguarding the user from ...
Artem S. Tashkinov's user avatar
2 votes
1 answer
215 views

Is it dangerous to publicly surf the web while my browser is being run in an IDE?

While developing web software, I typically run a browser (chrome) from my IDE. Here's an example launch.json in VSCode: { // Use IntelliSense to learn about possible attributes. // Hover to ...
Nathan Goings's user avatar
3 votes
1 answer
2k views

Is there any secure way to make sure that a request comes from a browser and via a specific domain (by just using frontend)?

Let us assume that we have a public API, for example, company.com/publicEndpoint, that can accept requests from any source. Various websites, like foo.com and bar.com, use JavaScripts that call this ...
John's user avatar
  • 31
0 votes
0 answers
100 views

Can WebASM provide JavaScript style interactivity without the same vulnerabilities?

JavaScript is useful for interactivity. However, it is often disabled by security conscious browsers, such as the Tor Browser Bundle, and blocked with plugins such as NoScript. I was wondering if it ...
user5623335's user avatar
1 vote
0 answers
258 views

Is it safe to enable password sync on Microsoft Edge?

Microsoft Edge, as well as other Chromium browsers, have a password sync feature built into their browsers, which look something like the image below. Before I enable this feature for convenience and ...
Skeleton Bow's user avatar
0 votes
1 answer
396 views

HTTPS/TLS security with an invalid certificate

I'm trying to use a site that's https but has it's own certificate, and when I add an exception it still shows it as unsecure, with an exclamation on the padlock and when I click the padlock it says &...
vertigo's user avatar
  • 13
1 vote
1 answer
182 views

Reducing web browser artifacts from a web developers perspective

Situation: Let’s say, I am about to develop a website based on known means of its creation, which would be the luggage of HTML + JS/TS/PHP + CSS wrapped in some framework, e.g. Angular, React, Laravel,...
Thedrick's user avatar
0 votes
1 answer
149 views

How do browsers defend the user against XSS?

I'm learning about the different mitigations employed by browsers against XSS vulnerabilities. Let's say, the developer made a mistake and there is a XSS vulnerability on a site. Unfortunately, a ...
Loresim's user avatar
2 votes
1 answer
288 views

A web browser localy encrypted by default

Some years ago, I've found a web browser which I can't remember the name. It had pretty impressive security standards. For example: Symmetric encryption key (password) is mandatory for saving ...
cryptostudy's user avatar
1 vote
1 answer
271 views

How secure is it to implement most of the applications functionality using WASM on the client side/ in the browser?

I understand that nothing is perfectly secured. If we have a web app where most of the functionality is done inside the browser using WASM, can someone get the binary of that WASM and use most of its ...
Maxfield's user avatar
  • 127
0 votes
1 answer
149 views

How are Fetch Metadata Request Headers more secure than the Referer Header?

https://www.w3.org/TR/fetch-metadata/ for reference. It seems like this is a simplified version of referer headers. Is the only advantage backend developer usability?
Prime's user avatar
  • 514

1
2 3 4 5
34