A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.

learn more… | top users | synonyms (2)

2
votes
7answers
117 views

How can I allow only authorized browsers to access a website?

I have a website and I want it to be accessible only by authorized clients/browsers (ex. with a certficate). The idea is that the users can only access the webpage in their office's computers ...
1
vote
0answers
56 views

Content-Security-Policy & Facebook login

This question seems to be related to http://stackoverflow.com/questions/15913200/facebook-js-sdk-not-executed-in-my-chrome-extension , but I am not developing a chrome extension. I am developing a ...
1
vote
1answer
40 views

Simple protection against reflected XSS

I was going through some CLIENT side defenses against reflected XSS e.g. XSS auditor(chrome), IE8 XSS Filters, Noscript. They use regular expression and other sophisticated techniques. My question ...
-2
votes
0answers
57 views

okcupid hackable with Hydra? [closed]

Is it possible to hack an okcupid account using THC Hydra, Brutus, or Cain and Abel? *I'm not asking for anything illegal, just asking if it's possible using one of those tools
21
votes
1answer
2k views

Why would the BBC web site always ask for a personal certificate, and how do I avoid giving it away?

After installing a CAcert personal certificate, every time I land on the BBC weather site it asks me to identify myself with a certificate. Why would any non-malicious web site do that unless I've ...
1
vote
1answer
55 views

IE11 on windows 8.1 and ssl fallback

I'm having problems with SSL certs and my SSL accelerator. I have a Sonicwall SSL-R and it only supports SSLv2, SSLv3, and TLS1.0. I have it configured to decode SSL with SSLv3 as the TLS1.0 ...
0
votes
2answers
72 views

Can malware cause firefox to send GET requests?

Is it possible for a site to host malware such that if a certain page is accessed, Firefox is made to send additional GET requests? I'm seeing traffic for attacks coming from me that I haven't done. ...
1
vote
0answers
60 views

Is Google Chrome Extension access to SSL certificate validation output possible?

I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My ...
-1
votes
1answer
83 views

Heart Bleeding Bus [duplicate]

This may be a unwise question, but I'll ask anyhow. I have been analysis relatively a bit about the Heart Bleed vulnerability, and I'm curious as to whether it only affects web applications or could ...
1
vote
0answers
32 views

What part of the browser is typically attacked? [closed]

Pretty sure that browsers are compromised most often through their plugins, at least, that's what I keep reading. So, then, does that mean the browser itself has vulnerabilities, and the plugins are ...
1
vote
1answer
28 views

Which is safer as a URL storage, favorites or browsing history?

Somewhere on this site I read that I should connect to websites by entering the URL myself or using a bookmark when security is critical. I started wondering why that didn't include browsing history. ...
3
votes
1answer
38 views

user data accessible through javascript in browser

There are websites which display user information, such as browser version and operating system This website goes even further, and displays some additional information, such as desktop resolution, ...
2
votes
1answer
69 views

Which Browsers support TACK?

TACK is an IETF draft that allows certificate pinning for a TLS web server, provided the clients' bowsers support it. Unlike the certificate pinning feature available with HSTS preloading, the ...
2
votes
2answers
91 views

How to prevent popping up a login dialogue using a malicious hotlinked image and HTTP Basic Auth header?

While using Firefox to browse my forums, I noticed that a malicious user posted an image (via hotlinking, not by uploading to my server) with the extension .png which complies with the forum rules ...
2
votes
2answers
177 views

Security of a Windows XP system after April 8th when running the latest Firefox or Chrome

As we all know, Microsoft stops developing security patches for Windows XP very soon. If a bug in the kernel was to be found that would allow an attacker to take control by, say, sending a specially ...
1
vote
1answer
188 views

IIS Host Header Attacks

Is IIS and ASP vulnerable to the same Host Header Attacks we have seen on Apache and Nginx? Specifically the attacks that use the HTTP Host Header to reset a password or implement web-cache poisoning. ...
2
votes
5answers
160 views

running firefox as unprivileged user on Linux

On a typical desktop (with no listening services such as Apache, SSH, ...) it seems to me, the browser is the most exposed application and a potential security compromise (and even more so with Java ...
-4
votes
4answers
79 views

How to check the safety of a link? [duplicate]

Someone gave me a link and asked me to open it, but I don't trust that guy. I'm not sure the link whether safe to open or not. I want to know if there a way to check the safety of the link? I have not ...
0
votes
1answer
48 views

Good reason to continue using fraudulent certificate?

A relative of mine used a favorites link to login to yahoo. The favorite link is https://de.mg40.mail.yahoo.com/neo/launch? However, this link uses a fraudulent certificate. Visiting the Yahoo ...
41
votes
13answers
5k views

Why should I care if a site uses encryption or not if I'm not exchanging any sensitive data? [duplicate]

Lots of sites these days, that don't deal with sensitive data, enable encryption. I think it's mostly to make (paranoid?) users feel safer. In cases where there is a user's account being logged in, ...
0
votes
2answers
102 views

How to hide real IP from browsers while using VPN?

You probably know that even when you use a VPN service, browsers like Chrome and Safari can still somehow provide your real location to Google Maps etc (if you give it a permission). My question is: ...
0
votes
1answer
60 views

Prevent Page from appearing in history

I have inherited an ASP site where sensitive data was passed in the query string as part of the URL. Something like this: www.example.Com/Test?details=Username&moreDetails=blahblah If we chnage ...
0
votes
1answer
44 views

Are there software solutions take encrypted credit card data taken straight off a square credit card reader and insert them into a standard web form? [closed]

Does anyone know how you can take the encrypted output of a square card reader and insert it directly into a standard web form?
1
vote
3answers
144 views

What version of TLS does any web browser use when connecting to server where all SSL Protocols are enabled?

All (almost all) web browsers have TLSv1.0 enabled by default, moreover TLSv1.1 and even TLSv1.2 can also be enabled by default. What version of TLS will be used to connect to web server (e.g. ...
0
votes
1answer
77 views

False Positives- Server side protection against XSS

I read about XSS attacks and its prevention mechanism on server-side. It seems only protection is to sanitize the input by escaping special characters on server side (Using some PHP functions such as ...
22
votes
1answer
2k views

Why does Firefox not trust this US government SSL certificate?

Shouldn't this be a trusted certificate considering it's a wildcard SSL certificate? That is, shouldn't *.delaware.gov cover www.corp.delaware.gov?
1
vote
2answers
96 views

Do Chrome/browser extensions break the tab sandbox?

So, as far as I know, Chrome and possibly other browsers have a very low privilege process spawned for every tab. How do browser extensions interact in regard to this sandboxing? I'm not talking ...
3
votes
2answers
108 views

How can users be sure the browser's URL bar is not faked?

For a user to defend against something like Don't understand how my mum's Gmail account was hacked , they should pay attention to URL bar before typing their credentials. But how can you make ...
118
votes
9answers
15k views

Is Adblock (Plus) a security risk?

My email-provider's website (http://www.gmx.de) recently started linking to the (German) site http://www.browsersicherheit.info/ which basically claims that due to its capabilities to modify a site's ...
0
votes
2answers
41 views

Displaying a video through the web whilst hiding the location

I felt this fit more here than SO, if not, please vote to migrate. We've been approached by a company who would like to use our platform to host their videos. The issue is that right now, we use the ...
1
vote
1answer
94 views

How can I be sure that my browser does not exfiltrate my passwords to some server?

This is my first question and I dont even know if it is the right place. If this is an off-topic just mark it as off-topic, don't go crazy and downvote. :P But how can I detect if my browser is not ...
1
vote
2answers
60 views

Mechanisms to offer inexpensive https to all second level .wiki domains

I'm working with the registry for .wiki, a new generic top level domain set for public availability in June 2014. We're going to be giving away hosted wikis to registrants of .wiki domains and I'd ...
1
vote
2answers
239 views

Why is my browsing history visible outside my network?

Whatever I and my family members do at 'Home PC' is visible in the history in Google chrome in my 'Office PC'. The two networks are entirely different! I saw all websites visited on our home PC by my ...
2
votes
3answers
177 views

Is it secure to access web with Xubuntu in VirtualBox running in Windows XP?

Support for Windows XP is ending soon. Therefore, I am seeking a secure solution to continue with Windows XP. When I access the web from Xubuntu in VirtualBox running in Windows XP, is the Windows ...
2
votes
2answers
160 views

Can cookies reveal my email address?

When I visit livescore.com, ten seconds later I receive marketing emails from gambling companies. If I don't visit this site, I don't receive these emails. Similar things happen when I visit Twitter ...
1
vote
2answers
59 views

Where do suspect requests from logged-in users to my website come from?

I have an ASP.Net MVC 4 web application that is hosted on a Windows 2008 server. The application is secured by a custom ASP.Net membership provider. Only users who are granted permission by the admin ...
2
votes
1answer
132 views

Can a webpage read another page's cookies?

I was listening to Pandora as I logged in here, and the next commercial was about InfoSec. That set me wondering as to whether that was a coincidence (probably) or if they knew somehow. To make a long ...
1
vote
2answers
170 views

Extracting Facebook ID or E-Mail from Browser History

While i was looking at my browser history i noticed there has been a facebook login from my computer, there are some facebook related messaging and profile links in my browser history (chrome). The ...
0
votes
1answer
46 views

How can I view the contents of a web page without running malicious code? [closed]

I received a strange email which has some strange URL in it. I would like to know what is "behind" the url, but without the risk of running anything malicious. How can see the contents of the URL, ...
0
votes
1answer
90 views

What are the implications of storing sensitive data in bookmarklets?

While discussing alternatives for asking the browser to remember your password, one guy suggested using a bookmarklet to store users' credentials. The original answer is in portuguese, but I'll ...
15
votes
1answer
539 views

Does Gibson's fingerprinting service add much additional security?

I just read this post and it proposes a method of storing SSL fingerprints online so that you can double check that your certificates have not been tampered with. But is it really relevant or useful? ...
20
votes
4answers
1k views

Should websites be allowed to disable autocomplete on forms or fields?

Currently, there is an HTML form/input attribute called autocomplete, which, when set to off, disables autocomplete/autofill for that form or element. Some banks seem to use this to prevent password ...
3
votes
1answer
84 views

Danger of hidden html form uploading users local files without their knowledge

Is there a danger that a webpage could have a hidden form with a file upload input and js script that would try and take a random guesses at files on a users system and attach them to the form and ...
0
votes
2answers
215 views

What information can be gained from an Email Header?

What information is present in an Email Header that can be used to track a sent mail? For example, are some of these present? Web Browser used? Operating system Type of Network (broadband/dial up)? ...
0
votes
1answer
108 views

Java Drive By & Stub - Explanation [closed]

I have been trying to make some extensions for chrome lately to block some unwanted stuff. I have also been searching for quite some time to find what a JDB does.So , the applet downloads a file , ...
1
vote
1answer
114 views

Anomaly detection in HTTP REFERER

I'm trying to put some anomoly detection in place and I'm looking at referrer data (I know that this is optional, and can be fudged in some circumstances). But I'm seeing too many cases of what I ...
0
votes
1answer
94 views

What is the full extent of information about my computer that a website can get?

I need to know what all information a random website can get from my computer, and whether a website can tell which of my two computers on the same router I'm using. I know websites can determine ...
2
votes
1answer
63 views

Chrome inline JavaScript string interpreatation

If you have an HTML file that contains the following code : <!doctype html> <html lang="en"> <head> <meta charset="UTF-8"> </head> ...
0
votes
1answer
335 views

UTF-7 XSS attacks in modern browsers

I've recently read about utf-7 XSS-attacks (i.e. Ned Batchelders article at http://nedbatchelder.com/blog/200704/xss_with_utf7.html) but could not get any UTF-7 attack to work in modern browsers. (I ...
11
votes
6answers
368 views

Can a website determine what OS or webbrowser a visitor is using if the useragent is blanked/changed?

Assume that a visitor to a website has changed his useragent to something like the following, but he's using linux: Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0 Assume that the ...