A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.

learn more… | top users | synonyms (2)

1
vote
0answers
41 views

Encrypting data before sending to SaaS tool and decrypting on browser view

I'd like to send data to a SaaS tool, where the data is stored in the cloud. I'll use Google Analytics as an example, but it applies to any similar service. Google Analytics does not allow you to ...
-1
votes
0answers
38 views

Do iPhone Chrome & Safari keep refreshing and sending my IP address to websites while in background?

You can put a browser like Safari or Chrome into the background on iOS without closing your tabs. Will they keep refreshing themselves and send out personal details like your IP address? What about ...
5
votes
2answers
363 views

Questions on true anonymity

I am going to use Tails to connect to Tor through VPN which has AES-256 data encryption, SHA-256 data authentication and RSA-4096 handshake encryption on my Mac on my school's WiFi (as public as I can ...
0
votes
1answer
74 views

Scam caller claimed to have elderly friend's “Windows unique identifier”

An elderly friend received a telephone call similar to this Information Security SE post and this one. The caller claimed that my friend's computer had a problem that needed to be fixed. My friend ...
0
votes
0answers
238 views

Does Microsoft Edge (Spartan) share Cookies, Cache, Passwords, or TLS Certificates with Internet Explorer?

Windows 10 was released with a new browser called Microsoft Edge. Interestingly, Internet Explorer is also installed on the same default install. Given that Chrome and Firefox tend to separate their ...
0
votes
1answer
57 views

Is injecting malicious file with browser localstorage possible?

Lets say, I visited a "malicioussite.com" and the server had a "malicious.js" in it whose job is to write malicious code to my browser localStorage and save it to the my computer then execute it to ...
3
votes
1answer
65 views

Browsers root CA accepted, countries and checking fingerprints

This is a question derived from several others, and I can not comment on those, so it is not duplicated, please read: In some related questions some users comment that: "They wouldn't ...
2
votes
1answer
70 views

Google Analytics use of JSONP, what are the security risks?

These days Google Analytics uses a JSONP request to load ga.js into user's web pages via a callback function. According to the Wikipedia, JSONP can "inject any content into a website." What exactly ...
1
vote
1answer
41 views

How much protection is really offered by TLS_FALLBACK_SCSV?

I'm researching the extent to which TLS_FALLBACK_SCSV protects against Cipher Suite Downgrade attacks. I understand that the correct way to protect is to remove support for the insecure cipher ...
2
votes
1answer
46 views

Using RSA for Web Application Authentication

I have a network that is only accessible through bastion servers over ssh. In it, I am developing web applications that are exposed to end users via GUI's served up over websockets. All traffic into ...
3
votes
3answers
99 views

How do browsers negotiate SSL/TLS connection parameters?

For the purpose of this question, let assume that an SSL/TLS connection has 4 parameters: protocol, symmetric encryption method, asymmetric encryption method, MAC. During the negotiation of SSL ...
3
votes
2answers
74 views

Internet Explorer - Advanced Properties for Trusted Root Certificates

If you go to IE -> Internet Options -> Content -> Certificates -> Trusted Root Certification Authorities. Now Click on some CA certificates and click on Advanced You can add properties to the ...
3
votes
2answers
297 views

Ways around browser xss detection

Most modern browsers will detect xss attempts (script code in the URL) and prevent execution. Are there any known standard ways around this or are xss attacks pretty much impossible now?
14
votes
4answers
2k views

What are the security issues with “eval()” in JavaScript?

Every time that someone mentions eval(), everyone says that there are "security issues" with it, but nobody ever goes into detail about what they are. Most modern browsers seem to be able to debug ...
-2
votes
0answers
25 views

So I have a compter from my company and I want to know. if I am not on windows working page can my employer still see my browsing data? [duplicate]

So I go on incognito and I watch videos and browse websites. so if I do this can my employer see what I am doing? And how can they see. Please give a brief step by step description. By the way I ...
1
vote
0answers
24 views

Pop ups after adware removal [closed]

I have a user who had a program called "Shopshop" running on his system that would cause page redirecting when using Chrome, IE, etc. I was able to remove the infection and extensions and ran AV and ...
5
votes
3answers
110 views

Can a website detect my local WIFI network I am in?

I have two computers, both of them locate at the same local WIFI network ( ie: connected to the same router). I use VPN on a computer to visit a website, and don't use VPN on another to visit the ...
13
votes
1answer
1k views

Which parts of an HTTPS connection can be revealed? [duplicate]

Say, I use a public WiFi connection to load https://google.com in the browser, and then continue browsing on that site for a few more pages (performing searches in Google). Can anyone else (like ...
3
votes
1answer
88 views

Can OpenVPN monitor my passwords in my browser?

I want to know if I run OpenVPN when I want to log in to websites (like Gmail etc.....) is my username/password in danger? Can they monitor saved passwords in my browser or anything else? I'm new to ...
-1
votes
1answer
69 views

What is the meaning of “www-ssl” in the URL https://www-ssl.intel.com/? [closed]

While browsing INTEL website I came across the following link ...
3
votes
1answer
37 views

What are the security benefits to block all http referer header requests for web browser?

I would like to know also if you lose site functionality. Is this a security benefit that is beneficial than compromising functionality (if compromising at all)? What I mean by this is one a ...
4
votes
1answer
72 views

How can I see which sites have set the HSTS flag in my browser?

My question is about Firefox and Chrome. Is there a possibility to see which sites have set the HSTS flag in my browser?
1
vote
1answer
112 views

Browser response to SHA1 signed cert

Generated a IIS server certificate using my domain certificate authority (presumed to be an intermediate to the 'secret' root CA) via the Server Certificates -> Create Domain Certificate 'wizard'. ...
1
vote
1answer
55 views

Does WebCrypto also mandate the crypto algorithms be implemented in Javascript?

I am trying to understand what WebCrypto means. From what I understand it is - A Javascript Crypto API spec that all browsers must (hopefully) support. Am I correct? If so are the crypto algorithms ...
0
votes
2answers
85 views

Finance with the multitude of “Secure Browsers” [closed]

[Thanks for the great answers! But it was put on hold so I've edited my question to be a lot less opinion-based. Based on the answers already given, though, I am getting the sense that booting off a ...
2
votes
2answers
193 views

Chrome status warning on a netbanking secure site connection [duplicate]

I visited my bank's web banking site and clicked on the Green Lock in the address bar of my Google Chrome browser out of curiosity. Under the "Connections" tab Chrome spits out this disturbing ...
1
vote
0answers
35 views

What are the security implications of enabling a SNI-hole on a web server?

A web server (let's say Apache 2.4) implements SNI. It is configured with a 4096 bit SHA384-signed Wildcard Certificate (*.land.org) with a Subject Alternative Name (land.org). The Certificate ...
0
votes
2answers
47 views

Is browser side encryption realistically secure?

I have a web app I'm hoping to write where a selection of files are zipped and encrypted in the browser before being uploaded to my server. I have a prototype of the system and it's working great. I ...
3
votes
3answers
125 views

Why did I see an insecure browser warning on my page?

Originally I was under the impression that a particular page on a site I visited was showing an insecure content warning in my browsers due to the tags on the page having plan http href attributes. ...
0
votes
1answer
160 views

Defeating Browser Fingerprinting by spoofing the browser user agent and VPN

I don't want any website to identify me and to know what is my geographical location. As far as a website is concerned, I am always a new visitor who never visits it prior. If I leave the website, ...
0
votes
4answers
574 views

“Virus Found” Web Browser Pop-up

I use a website that typically creates a new tab with an ad on the first click. Usually, I can close the tab without even looking at it, but recently a more aggressive strain brings up a pop-up (for ...
5
votes
1answer
124 views

Video site requests Adblocker to be shut off, next day I have 3 “weird” bookmarks

I was on a site trying to view a video and the site requested that I turn off my adblocker to view the video. So I did and then the next day I noticed that I had 3 "weird" bookmarks in my bookmark ...
2
votes
3answers
331 views

GET and POST request vulnerable to CSRF attack?

Are both GET and POST request vulnerable to CSRF? Should we use PUT instead?
4
votes
1answer
109 views

Why did browsers deprecate 1024-bit RSA, but retain SHA-1?

I was reading Mozilla's security blog Phasing out Certificates with 1024-bit RSA Keys. Effectively, some browsers are deprecating 1024-bit RSA for CAs and Subordinate CAs because the certificate must ...
1
vote
1answer
72 views

Give Someone Access to Secure Website? [closed]

I have someone I hired on a Freelancing website working for me - so far he has worked for me for about two weeks and is doing a good job. In order for him to complete his work he will need access to ...
3
votes
3answers
182 views

Can a browser JavaScript console ever be an issue?

I'm sure most of you are familiar with the JavaScript-based game Candy Box. As you probably know, one can cheat this game's candy system by sending commands to the console. For instance, if you ...
28
votes
5answers
2k views

Why do you need to close your browser window after logging out of a website?

I might be wrong, but I believe the request to close the browser window after logging out is common, though it's completely unclear what the risks might be of failing to close a browser window ...
1
vote
7answers
4k views

Malware ad.adsmatte infection

My PC is infected with malware, whenever I open a webpage and click on it a new tab opens on "ad.adsmatte.com". I scanned my PC with Malwarebytes but was unable to resolve the problem. So I ...
1
vote
0answers
127 views

What web browsers support ECC vs DSA vs RSA for SSL/TLS?

We are updating our wildcard certificate and see that we have the option to use both RSA or DSA with Symantec (for free), while Digicert offers 3 options for wildcards ECC, DSA and RSA. Is there a ...
0
votes
0answers
499 views

Does this list every Chrome extension/addin that may leak privacy?

I am looking for a simple list of all extensions, preference, custom processes, and "flags" that may disclose a user's privacy or other details to a 3rd party. To that end, I discovered: ...
1
vote
1answer
60 views

Does a TLS-connection to a proxy-server encrypt the destination url's?

If I use a browser through a proxy-server over a secure connection (i.e. the proxy is HTTPS) - does that mean that everything is encrypted, or just the page returned from the site? And who does the ...
5
votes
1answer
150 views

How do I securely embed an <img> tag using a user-given URL?

If I hypothetically wanted to allow users to use an avatar from an arbitrary URL like this: <img class="avatar" src="{user input}" /> There are many problems that I can think about: There ...
0
votes
1answer
76 views

configuring burp to use in proxy environment

my university internet connection runs behind proxy.its host name is 192.168.1.103 and port no is 3128.how to configure proxy in burp suite if i should enter above proxy setting in my firefox browser. ...
-1
votes
1answer
99 views

What to do if I suspect a website I visit and link to was compromised via an XSS?

EDIT: The script has been removed and apparently the vulnerability has been patched. My employer links to this resource: http://www.myplan.com/ I recently noticed a JavaScript alert was added into ...
0
votes
1answer
37 views

In What Ways Can X-Foward-For Header Information Be Used In An Attack

By enabling X-Foward-For on our proxy, we would essentially be advertising our internal IP addresses externally. However, we use a private range. Everything goes through NAT. So, the best anyone would ...
2
votes
2answers
118 views

Best practice for caching sensitive data

My server returns private data in the body of an HTTPS response. It's not passwords or credit cards, but it is user-generated text and images, which should not be accessed by others. The data for a ...
0
votes
1answer
36 views

Sharing sensitive information across servers on visits from the same browser

I have this scenario: Webserver domain A. Generates sensitive information when a request from a browser is received but this information is not disclosed to the browser. Webserver domain B. ...
6
votes
3answers
172 views

Same Origin Policy - XHR response

I know that Same Origin Policy (SOP) prevents a page/script from one origin to read response from another origin, but it does not prevents the page/script from making a XMLHttpRequest (XHR) request to ...
3
votes
1answer
69 views

Bing bar without admin rights

I know viruses uses exploits to gain admin rights to install software. My question is here at work, we have people end up with the Bing Bar installed from time to time on their machines. It is listed ...
3
votes
4answers
155 views

Do search engines give searcher's IP address to sites that come up in search? [closed]

Ok so for example, I search "stackexchange" and a bunch of pages come up in the search result - of course most of them from this very site, and many other ones talking about stackexchange. Would this ...