A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

learn more… | top users | synonyms (2)

0
votes
0answers
17 views

Problem with Firefox browser about user privacy [migrated]

Every time I use my firefox browser to visit sites like this I end up with multi redirection popups on every single click. however, I solved the problem accidentally by visiting the previous site ...
3
votes
1answer
49 views

Should my company change the internal Root CA hash method from SHA-1 to SHA-2?

My company have a Root Certificate Authority which is installed on a Windows Server 2003 and uses SHA-1 as hash method. We will migrate to Windows Server 2012. Checking the root certificates of my ...
-4
votes
0answers
27 views

Specific ad links only with Chrome (not in incognito mode or Firefox)

I'm seeing some particular ad (erectile disfunction) links in [website removed] (right in the header) and I'd like to make sure this is not a problem with my pc. I only see those links with Chrome ...
1
vote
3answers
109 views

How can I find an unauthorized/unknown proxy on my home network?

I recently started receiving an error while trying to stream netflix that I'm using a proxy. Exactly this error code here: https://help.netflix.com/en/node/277?ba=GSButtonClick&q= My problem is ...
3
votes
1answer
55 views

Is same origin policy for web only useful because of cookies?

There is a same origin policy in the browser to ensure that e.g. bad site won't read your data from Facebook. But it seems that the only problem that it tries to solve is that cookies are ...
3
votes
0answers
26 views

How to check if redirected site like OAuth is genuine?

One common security advise is to open sites only from bookmarks (see also Explain to non tech savvy person how to check that your connection to mybank.com is safe? ). This approach fails if a site ...
0
votes
0answers
6 views

Autofill Username Creation [migrated]

As an administrator I have found various usernames in the autofill bar when you attempt to log in to sites. These usernames are unknown and I was wondering if anyone knew of a way that I can find out ...
-2
votes
1answer
43 views

Is Tor Browser vulnerable to WebRTC leak?

If so, which are all the possible solutions to the problem? Are there similar issues to be aware of? Thank you in advance.
5
votes
1answer
41 views

Does prefetching/preloading in web browsers pose a security risk?

Today I googled the name of a domain that was reportedly serving up malware. My search results came up (with the compromised domain at the top of the list) and within seconds my AV gave an alert ...
1
vote
3answers
39 views

Security implications of FileExists() from javascript in browser

What would the security implications be if JavaScript, in a browser, could perform a typical FileExists() operation with normal file paths (win and/or mac)? Something like Node's fs.existsSync(path) ...
0
votes
1answer
56 views

How to prevent hotlinking on binary content served through PHP?

I am trying to secure a byte serving script, written in PHP, mostly taken from http://www.tuxxin.com/php-mp4-streaming/ to protect against linking the video directly and easy downloading. I therefore ...
0
votes
1answer
48 views

Virus: Images get replaced on website [closed]

I have installed Windows 7 again on my laptop with Chrome as browser. The problem is that on different websites I visit, the actual images of the website get replaced with out of context images. It ...
0
votes
1answer
88 views

Why would a website want to know what operating system you are using?

As per this question, websites can learn what operating system a client is running by examining the HTTP headers. There are some addons that prevent this from working. What is a legitimate use of ...
1
vote
1answer
63 views

How do websites recognize visitors? [duplicate]

Being more specific, I would like to know which are the possibilities for a webbsite owner to detect whether the same user logs with different accounts, and how to bypass each of them. For example, I ...
1
vote
3answers
88 views

Can Google Chrome read/scan my ProtonMail inbox page?

If I used Google Chrome to visit ProtonMail website, it would not be difficult for Google to read my emails since it would just need to scan/read the content of the page. Messages are encrypted just ...
3
votes
3answers
156 views

Why are root certificate authorites allowed to issue certficates for any domain?

Why are certificate authorites allowed to issue certificates trusted by browsers for any domain name? Doesn't that imply that one highjacked root certificate authority can issue trusted fake ...
0
votes
1answer
42 views

Is firefox disabling of insecure TLS fallback part of the HSTS spec?

I've been looking into HSTS, and I can see that Firefox has supported it since version 4, but I can also see that you could click through untrusted cert browser warnings until Firefox 37. Is the ...
0
votes
0answers
24 views

Since yesterday, NoScript has asked twice whether to “allow scripts from example.com”. What gives?

Since yesterday 2015-01-19, I have had two occasions where NoScript has apparently blocked scripts from "example.com", the actual domain, not the meta-level foo variable. According to this Wikipedia ...
1
vote
0answers
21 views

Where should I store sensitive data within an Apache Cordova application?

I have to implement a 2 factor authentication (2FA) feature within an Apache Cordova application so that the user is able to login into the desktop application using the generated token. Common 2FA ...
0
votes
0answers
18 views

Is keeping business data in browser database websql secure?

Knowing that Server always validates the data before saving it. Browser app is generating the data based on user input and some business logic and is storing it locally. Browser app then synchronize ...
-1
votes
0answers
11 views

What is the Site “chrome://FirefoxAccounts (Firefox Accounts credentials)” under “Saved Logins” section in Firefox for ? [migrated]

Created a user account in firefox and saved it , I saw these 2 entires in "Saved Login"? It's a bit creepy because I was trying to switch over to Firefox from Chrome.Why is it prefixed "chrome://" ...
0
votes
0answers
12 views

Tor browser with external Vidalia proxy [migrated]

I have configured an Onion router successfully - based on this tutorial. I connect to the wireless network, and all of my connections are using Tor. I also started Vidalia on port 8118 on the ...
0
votes
1answer
61 views

What are the exact security risks of having JavaScript enabled?

There are a lot of websites out there that state that you should disable JavaScript because of the possible security risks. There's also a reason that an AddOn like NoScript has been developed and is ...
11
votes
5answers
2k views

Why do most browsers store browsing history by default?

Why do most browsers store browsing history by default? It seems like people often have to go to the hassle of manually deleting their history or using incognito mode. Are there some major advantages ...
38
votes
3answers
5k views

Why do some internet banks force logout on back button?

A design pattern I've noticed on internet banking sites is that you get automatically logged out and sent to a warning page if/when you hit the back button on your browser, ending your session and ...
1
vote
3answers
88 views

Why limit internet access while connected to a remote desktop?

I work in the nuclear industry, and sometimes we have some strange (but understandable) standards for information security. I have encountered one which seems odd and would like to know the potential ...
0
votes
2answers
37 views

Are third party authentification provider included via iframe by default considered (in)secure?

Authentification provider X is used by many non-related websites like A, B and C as (sole) authentification provider. X therefor provides a framework for athentification which includes a login form ...
0
votes
1answer
67 views

How might my browser session be hijacked on iOS Safari?

I'm currently on iOS using Safari, and my browser session was just hijacked. Ive never seen any hint of malware on iOS, so I'm going to assume the hijacking occured (consistently happens when visiting ...
3
votes
1answer
131 views

How to read the key3.db file?

The file key3.db contains the key that is used to encrypt the Firefox passwords stored in logins.json file. I don't use master password in Firefox, but according to this article, my passwords are ...
5
votes
2answers
112 views

Why do so many browsers show sites with revoked certificates?

Everyone seems to agree that it is REALLY important to protect private keys so the encrypted Internet can remain just that (see for example at How do certification authorities store their private root ...
22
votes
1answer
1k views

How does Firefox encrypt passwords without selecting Master Password?

I know that the file logins.json contains all my encrypted passwords in Firefox browser. How does Firefox encrypt these passwords if I don't use the 'Master Password' option? Does this mean key3.db ...
1
vote
1answer
54 views

Panopticlick performance for Tor Browser not great. Why?

These are the results for the Panopticlick test on Tor Browser that I just performed: Is your browser blocking tracking ads? Partial protection Is your browser blocking invisible trackers? ...
-2
votes
1answer
81 views

Storing Data Without Knowing Anything About the User

Let me start by stating that this is really my first foray into encryption. I have written username/password systems, and such, and am familiar with salting and hashing passwords... but I have never ...
2
votes
1answer
46 views

Crypto in browser

It's almost 2016 and javascript encryption libraries have been around for a while. My question is, have they improved? Or should we still abandon the idea of having encryption done in our browsers? ...
-4
votes
1answer
54 views

Can I disable corporate monitoring by disabling my network connection? [closed]

Can my activities be traced if the Ethernet cable is not connected? If I disconnect the company's Ethernet cable & connect my PC to tethering, will the browser history be still captured once I ...
2
votes
1answer
81 views

WebCrypto algorithms and differences with other crypto libraries

I was looking at the WebCrypto crypto libraries coming form the W3C. Looks like only a few cryptosystems are supported, including AES-CBC, AES-CTR, AES-GCM, and RSA-OAEP. ...
4
votes
1answer
140 views

How make Firefox ignore X-XSS-Protection header from server?

I have two questions: 1)How can I make Firefox ignore X-XSS-Protection header? I have a website which sends X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it destroys ...
-3
votes
3answers
62 views

How important are my cookies from a security perspective?

If a hacker makes a copy of all my browsing cookies, what could he/she do with that? What are the worst case scenarios?
3
votes
4answers
94 views

What are the mostly used and known or less known web tracking techniques? [closed]

I know about HTTP cookies, flash cookies, ETag when dealing with user tracking on the web. Are there other technologies, known or less known? Thanks.
3
votes
1answer
61 views

Tor browser further anonymity requirements [duplicate]

Tor and Tor Browser do a good job of providing anonymity, but we cannot rely on them alone. The development of newer techniques for identifying web users (such as canvas fingerprinting) mean that ...
0
votes
1answer
42 views

What's the best practice for MitM'ing https traffic to distinguish self-signed certs?

My organisation is concerned about viruses and attacks coming into our network. Since http traffic has been declared persona non grata by some browser makers and other parties, it becomes ...
1
vote
1answer
34 views

HTTPS everywhere rulesets confusion

When using HTTPS everywhere I frequently notice the ruleset counter next to the search bar. I understand the counter represents the number of rulesets for each page, which can be seen by clicking next ...
0
votes
1answer
60 views

Does the server administrator see what sites I visit

I have seen a lot of answers but here is the peculiarity of mine. In the office we all have a login to the WiFi, First with that login, if I use Tor will my visited sites still be logged by the ...
1
vote
0answers
40 views

Few sites are shown as Certificate is obsolete in Chrome(https is struck off). But they're marked as green in IE [duplicate]

For example, for few sites the 'https' part of website is when loaded through Chrome (installed in workplace) states that the connection is certified but it also states that the resources in the page ...
0
votes
1answer
51 views

Security concerns about Web browser [closed]

It seems that its like a black point in my mind that I think about browser when I research information security. Its clear that its the browser applies security rules while we navigate websites. In ...
7
votes
3answers
522 views

Why do Firefox and Chrome “leak” critical security information out of the browser and how can I stop it?

In studying SSL / TLS handshakes and encryption, I found a method that describes how to export the SSL / TLS session keys from Firefox to an user or environmental variable outside the browser, and ...
2
votes
1answer
85 views

Why do Browsers warn about self-signed certificates but not about plain HTTP (which is not even encrypted)? [duplicate]

Let's keep it short: On HTTP everyone can listen easily. MITM attacks are no problem. On HTTPS (self-signed) everything is at least encrypted, it's much harder to MITM-attack and only private key ...
0
votes
0answers
22 views

Different chanels for BeEF UI and Communication Server

I am working with BeEF tool and I want to access the UI interface using https (I don't want to communicate via VPN to access the control panel), while at the same time, I need to serve the http hooks ...
6
votes
1answer
68 views

Is there any benefit in having CNNIC certificates installed, if you're not in China?

All modern browsers/OS come with root certificates from the China Internet Network Information Center. AFAIK these certificates are required for computers sitting behind the Great Firewall to function ...
0
votes
2answers
53 views

Java code signing vs. sandboxing

I'm trying to understand the rationale behind Java Applet development these past few years. Back in the old days, most Applets were unsigned, and the code for these was run in a sandbox where barring ...