A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.

learn more… | top users | synonyms (2)

1
vote
0answers
12 views

How to disable typed arrays in firefox as rowhammer mitigation

I am concerned about the potential attack surface exposed by JavaScript typed arrays as a means of performing rowhammer attacks. Is it possible to disable (via official means or otherwise) typed ...
0
votes
0answers
26 views

Block website for all user agents expect one and allow all user agents to specific URL [on hold]

I want to block all user agents except one for entire website, and at the same time allow access all user agents to one specific URL. When any user want to reset password I need to unblock all user ...
14
votes
4answers
2k views

What is the difference between http and https with a self-signed SSL certificate?

A colleague of mine has told me he doesn't see why there is a warning when visiting a HTTPS website with a self-signed certificate saying that the security may be compromised, but there is no warning ...
0
votes
0answers
38 views

browser overlay with no “close” button

I observed what I will describe as an "overlay" on my Firefox browser tabs. It contained the logo of the local (copper wire) phone company and both the horizontal and vertical scroll bars. It ...
5
votes
2answers
82 views

apple.com exploit attempt?

I recently browsed to apple.com; and the page crashed a few times, then after I reloaded I was given this alert after my browser attempted to redirect to ...
6
votes
3answers
127 views

Using Lynx on potentially malicious websites

After needing to refresh how to unpack an android ramdisk, the site I remember having good information comes up with something similar to this: Being cautious, but still wanting to get what was on ...
0
votes
0answers
28 views

“encrypted using an obsolete cypher suite” - After using IIS Crypto best practices [duplicate]

I've used the IIS Crypto tool, using best practices and I still get "encrypted using an obsolete cypher suite" In Google Chrome. There's so many various cypher suites, and I'm yet to find a ...
2
votes
3answers
123 views

Can a shim (a.k.a. polyfill) be installed in IE, FF, or Chrome without user knowledge, and can it read passwords entered by user on a login page?

The questions here are about shims in the 3 most commonly used browsers. A shim (also known as polyfill) is a piece of code (often JavaScript or Flash) implemented to augment the native API in a web ...
2
votes
2answers
79 views

Should I regularly erase cookies?

Cookies really do make for a better experience on the web but do they also create a vulnerability? How often should I clean them out and what benefits are gained by doing so?
2
votes
1answer
113 views

Does a Content-Type: text/plain header protect against XSS in browsers?

I'm creating a small web script that mostly redirects the browser but has some error conditions when input parameters cannot be validated. I'd like to display error messages like parameter XXX had ...
0
votes
0answers
34 views

Enable only TLS 1.2 connection to my website [migrated]

All those web browsers that cant make a TLS 1.2 connection to my website should not be able to access it. I am using apache tomcat server. What all configurational changes do I need to make in order ...
-2
votes
1answer
71 views

Why do browsers have no built-in features to verify the integrity of downloads? [closed]

I just started a download of a large file. Checksums were placed prominently on the download page. But I just realized that I actually never made use of any of the checksums provided for download ...
2
votes
0answers
31 views

Do any specific steps need to be taken into account for the user's browser and browser caching for a HIPAA compliant web application?

I'm currently writing a web application that will need to be HIPAA compliant. It is very JavaScript heavy, and ePHI will be sent over an encrypted connection in the form of JSON. The transmission ...
2
votes
2answers
159 views

Why do popular sites like Google, Dropbox, etc. have a “trust this computer” checkbox when it weakens security?

Let's say someone is logging onto Dropbox in the library, but the computer has a keylogger on it that steals their password. Fortunately, they are using two factor authentication, which could have ...
39
votes
4answers
6k views

Have computer criminals been known to exploit easily-edited websites like Wikipedia to embed malicious scripts?

When I was reading a page on Wikipedia several months ago (December 2014) I saw what looked like a pop-up window from BT, but I soon realized that when I closed the page the pop-up disappeared. I then ...
5
votes
1answer
104 views

Are there cases where malicious scripts on websites breached the sandbox of a browser so that files on the user's computer could be accessed?

Whenever a hosted script on a website tries to access a file on a user's computer the sandbox prevents it, but has there been any documented case where this sandbox obstacle was somehow overcome by ...
5
votes
1answer
517 views

Point several HTTPS domains to the same web server

We are currently running a SaaS over HTTPS(abc.net) and one of our clients(xyz.com) wants to do some custom branding. The client xyz.com will have their own subdomain xyz.abc.net which looks like its ...
5
votes
1answer
100 views

Is it safe to reuse a tab in a browser for different websites?

A friend of mine recently asserted that it is unsafe to reuse the same tab in a browser for different websites. In other words, if the user: Visits a sensitive website (for example logs in his bank ...
6
votes
1answer
65 views

Protection against clickjacking in Firefox without installing addons?

On some of my workstations I never allow Javascript in Firefox. The NoScript addon is installed on these machines, but I would like to remove it and disable Javascript via about:config instead. ...
7
votes
1answer
101 views

Disable HTML5 battery features

HTML5 has a feature set relating to client battery status. It has been described as a privacy hole, as it can be used to track and identify web users. Research suggests the features can be used even ...
1
vote
1answer
37 views

Selective JavaScript commands - Avoiding vulnerabilities explotation

I remember the times when JavaScript usage was so innocent. A small pop-up here a dialog message there. Nowadays JavaScript "steals" data by exploiting vulnerabilities on "mature" browsers such as ...
1
vote
2answers
59 views

Can a “client-initiated” session cookie provide more privacy and security than existing session alternatives?

There are several uses for a cookie, and I would like to offer some kind of guarantee that a cookie is being used for a specific, limited purpose and scope. In my case, I want to prove that a cookie ...
3
votes
2answers
82 views

Browser fingerprints, theory or reality?

As you may or may not be aware, even when browsing "incognito", you can theoretically be tracked. Browsers have unique fingerprints, just like people do. Check this link to learn more. While I ...
3
votes
3answers
77 views

Cipher used for request data encryption used by browser

Please note that this is not about how SSL communication happens between browser (I researched and understood it) and client but other aspects. Using Digicert's SSL mechanism explanation I have ...
1
vote
1answer
380 views

This site uses a weak security configuration - SHA-1 signatures [duplicate]

One of our users just sent us a screenshot of them browsing our site using Chrome for OS X, version 44.0.2403.130. This came as a surprise because I thought that our certificates were up to date (via ...
2
votes
1answer
85 views

How secure/private is the browsing history on browsers?

I've been using Aviator secure browser for a while which insists that you run private mode by default (cookies and history wiped after every session), which makes me wonder how secure the history is ...
1
vote
1answer
82 views

Encrypting data before sending to SaaS tool and decrypting on browser view

I'd like to send data to a SaaS tool, where the data is stored in the cloud. I'll use Google Analytics as an example, but it applies to any similar service. Google Analytics does not allow you to ...
5
votes
2answers
385 views

Questions on true anonymity

I am going to use Tails to connect to Tor through VPN which has AES-256 data encryption, SHA-256 data authentication and RSA-4096 handshake encryption on my Mac on my school's WiFi (as public as I can ...
0
votes
1answer
91 views

Scam caller claimed to have elderly friend's “Windows unique identifier”

An elderly friend received a telephone call similar to this Information Security SE post and this one. The caller claimed that my friend's computer had a problem that needed to be fixed. My friend ...
0
votes
0answers
611 views

Does Microsoft Edge (Spartan) share Cookies, Cache, Passwords, or TLS Certificates with Internet Explorer?

Windows 10 was released with a new browser called Microsoft Edge. Interestingly, Internet Explorer is also installed on the same default install. Given that Chrome and Firefox tend to separate their ...
0
votes
1answer
65 views

Is injecting malicious file with browser localstorage possible?

Lets say, I visited a "malicioussite.com" and the server had a "malicious.js" in it whose job is to write malicious code to my browser localStorage and save it to the my computer then execute it to ...
3
votes
1answer
73 views

Browsers root CA accepted, countries and checking fingerprints

This is a question derived from several others, and I can not comment on those, so it is not duplicated, please read: In some related questions some users comment that: "They wouldn't ...
2
votes
1answer
88 views

Google Analytics use of JSONP, what are the security risks?

These days Google Analytics uses a JSONP request to load ga.js into user's web pages via a callback function. According to the Wikipedia, JSONP can "inject any content into a website." What exactly ...
1
vote
1answer
51 views

How much protection is really offered by TLS_FALLBACK_SCSV?

I'm researching the extent to which TLS_FALLBACK_SCSV protects against Cipher Suite Downgrade attacks. I understand that the correct way to protect is to remove support for the insecure cipher ...
2
votes
1answer
78 views

Using RSA for Web Application Authentication

I have a network that is only accessible through bastion servers over ssh. In it, I am developing web applications that are exposed to end users via GUI's served up over websockets. All traffic into ...
3
votes
3answers
148 views

How do browsers negotiate SSL/TLS connection parameters?

For the purpose of this question, let assume that an SSL/TLS connection has 4 parameters: protocol, symmetric encryption method, asymmetric encryption method, MAC. During the negotiation of SSL ...
3
votes
2answers
90 views

Internet Explorer - Advanced Properties for Trusted Root Certificates

If you go to IE -> Internet Options -> Content -> Certificates -> Trusted Root Certification Authorities. Now Click on some CA certificates and click on Advanced You can add properties to the ...
3
votes
2answers
303 views

Ways around browser xss detection

Most modern browsers will detect xss attempts (script code in the URL) and prevent execution. Are there any known standard ways around this or are xss attacks pretty much impossible now?
14
votes
4answers
2k views

What are the security issues with “eval()” in JavaScript?

Every time that someone mentions eval(), everyone says that there are "security issues" with it, but nobody ever goes into detail about what they are. Most modern browsers seem to be able to debug ...
1
vote
0answers
26 views

Pop ups after adware removal [closed]

I have a user who had a program called "Shopshop" running on his system that would cause page redirecting when using Chrome, IE, etc. I was able to remove the infection and extensions and ran AV and ...
8
votes
5answers
194 views

Can a website detect my local WIFI network I am in?

I have two computers, both of them locate at the same local WIFI network ( ie: connected to the same router). I use VPN on a computer to visit a website, and don't use VPN on another to visit the ...
13
votes
1answer
1k views

Which parts of an HTTPS connection can be revealed? [duplicate]

Say, I use a public WiFi connection to load https://google.com in the browser, and then continue browsing on that site for a few more pages (performing searches in Google). Can anyone else (like ...
3
votes
1answer
96 views

Can OpenVPN monitor my passwords in my browser?

I want to know if I run OpenVPN when I want to log in to websites (like Gmail etc.....) is my username/password in danger? Can they monitor saved passwords in my browser or anything else? I'm new to ...
-1
votes
1answer
83 views

What is the meaning of “www-ssl” in the URL https://www-ssl.intel.com/? [closed]

While browsing INTEL website I came across the following link ...
3
votes
1answer
51 views

What are the security benefits to block all http referer header requests for web browser?

I would like to know also if you lose site functionality. Is this a security benefit that is beneficial than compromising functionality (if compromising at all)? What I mean by this is one a ...
4
votes
1answer
99 views

How can I see which sites have set the HSTS flag in my browser?

My question is about Firefox and Chrome. Is there a possibility to see which sites have set the HSTS flag in my browser?
1
vote
1answer
191 views

Browser response to SHA1 signed cert

Generated a IIS server certificate using my domain certificate authority (presumed to be an intermediate to the 'secret' root CA) via the Server Certificates -> Create Domain Certificate 'wizard'. ...
1
vote
1answer
69 views

Does WebCrypto also mandate the crypto algorithms be implemented in Javascript?

I am trying to understand what WebCrypto means. From what I understand it is - A Javascript Crypto API spec that all browsers must (hopefully) support. Am I correct? If so are the crypto algorithms ...
0
votes
2answers
88 views

Finance with the multitude of “Secure Browsers” [closed]

[Thanks for the great answers! But it was put on hold so I've edited my question to be a lot less opinion-based. Based on the answers already given, though, I am getting the sense that booting off a ...
2
votes
2answers
231 views

Chrome status warning on a netbanking secure site connection [duplicate]

I visited my bank's web banking site and clicked on the Green Lock in the address bar of my Google Chrome browser out of curiosity. Under the "Connections" tab Chrome spits out this disturbing ...