A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.

learn more… | top users | synonyms (2)

2
votes
4answers
74 views

Do search engines give searcher's IP address to sites that come up in search?

Ok so for example, I search "stackexchange" and a bunch of pages come up in the search result - of course most of them from this very site, and many other ones talking about stackexchange. Would this ...
2
votes
0answers
20 views

How to get directly to text versions of Google cached pages [on hold]

http://navigators.com/cached.html According to the bottom of that site, it seems the easiest way to view websites without giving them your IP is: "Edit the heck out" of google URLs like this: ...
2
votes
1answer
23 views

Click to play plugins vs. AdBlock?

Reading through articles like Faked Flash-based ads... I'm wondering what is a better way to keep yourself safe from malvertising. Many people suggest setting your browser's plugin settings to "Click ...
1
vote
1answer
27 views

Does visiting cached pages disclose my IP address to site admin?

I know it discloses my IP to Google, but is my IP also disclosed to the owner of the site of which Google made cached pages that I'm looking at? And how about anything I do within the cached page - ...
1
vote
2answers
62 views

Foolproof way to hide your IP when browsing

is there a fool proof-ish way to hide your IP from websites you visit? I heard even if you use VPN, there can be 'leaks'? And one step more secure is Anonymizer or Tor? Can they have 'leaks', too? ...
3
votes
2answers
100 views

Payment form from http is secure? [on hold]

There are lot of payment gateways (Worldpay, PayPal, ..) offering easy integration, when the plain webpage using URL redirection to the payment page. HTTPS (worldpay,paypal), where the user posts his ...
1
vote
1answer
42 views

What are some useful tags and payloads for HTML injection on CSP-protected sites?

I'm pen-testing a website that fixed most of its XSS vulnerabilities by just adding a Content Security Policy. There are still HTML injections in several places. I've tried to get a ...
0
votes
2answers
251 views

HTTPS icon red and crossed out - Chrome browser

I just would like to ask what actually means when HTTPS icon is red / crossed - out. Is this site is vulnerable to Man in the Middle Attack? Is it safe or not?
-1
votes
0answers
42 views

Do any websites actually use Intel Identity Protection Technology (Intel IPT)? [closed]

Do any websites (or anything else) actually use Intel Identity Protection Technology (Intel IPT)? I found a link to an Intel page that was supposed to have a list of sites, but it returns a 404 ...
1
vote
3answers
99 views

Benefit to disabling TLS1.1 and TLS1.2?

In light of recent developments on SSL issues such as BEAST and POODLE, I decided to configure my browser to only allow TLS1.1 and higher. The trouble is, that I am finding a lot of websites which do ...
-1
votes
1answer
61 views

What are the heuristics for a malicious url? [closed]

I know that there is nothing like a safe website ,any website which is safe today could be hacked and its visitors could be served with latest malware. What I'm curious about is what checks can we ...
0
votes
0answers
29 views

Browser not blocking popups [migrated]

I have disable showing popups for all sites in my chrome browser. But when I visit http://www.hdfcbank.com/ and click Login , it show a pop up window. Why chrome is not blocking this? Are there some ...
23
votes
2answers
3k views

Does browser 'view-source' mode avoid scripting attacks?

Let's say there's a URL www.badjs.com which is untrusted and may contain bad scripts. Intuitively, a view-source navigation to that URL does not execute any scripts so it should be safe. It would at ...
11
votes
2answers
650 views

Why does rfc6797 say “An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport.”

Why does the RFC prohibit the server from sending HSTS to the client over HTTP? I can see that if a HTTP client responds to that unsecure HTTP response it might cause that site to be inaccessible ...
0
votes
0answers
16 views

What is the best way to manipulate the browser fingerprint? [migrated]

The test here worries me: http://panopticlick.eff.org/ and I'd like to know if there is a good way to manipulate the browser fingerprint?
5
votes
1answer
93 views

How to add certificate pinning for a certain domain to my web browser?

There is HPKP (HTTP Public Key Pinning) which servers use to tell the client's web browser which certificates to trust (in the future) for the domain that is being contacted. Google's Chrome and ...
1
vote
1answer
114 views

Does the browser still stores the website you visited Private Browsing [incognito Firefox]?

As they clearly state in their website they mention that What does Private Browsing not save? Visited pages: No pages will be added to the list of sites in the History menu, the Library window's ...
0
votes
1answer
113 views

Is there any security benefit in stripping only `<script>` tags that contain code?

On a client's corporate network something is stripping all <script> elements that contain code, i.e. things like <script type="text/javascript">do_something();</script> will simply ...
0
votes
0answers
48 views

Firefox stopped working with our app after 36.0.1 [migrated]

We have a web application that works on all browsers and firefox before 36.0.1 Have done all the typical things, clearing cache, reinstalling ff, etc. Multiple different machine from different ...
-1
votes
1answer
49 views

Custom TLS in Browser [duplicate]

We are developing a JSF web application that has a main requirement of using our own TLS implementation (custom algorithm suites). The clients will connect via a browser. Is there any way (customising ...
0
votes
2answers
135 views

Source code disclosure vulnerability

I am a bit confused about the discussion here about hiding javascript source code. Let's say if I browse to a url like this: http://www.example.com/site/somejs.js and then what I see is something like ...
0
votes
1answer
45 views

Can video feed be used to track location of an IP?

I dont know if it is possible but i read that while a user is viewing video, the location of user can be traced without sharing its knowledge to the user. Even when user has disabled the option to ...
0
votes
2answers
110 views

Restrict website access

I want website (A) to only work if a visitor came by clicking a link from a specific other website (B). Initially I thought of using the document.referrer from website A to check whether website B is ...
2
votes
1answer
278 views

Can someone explain, in simple terms, how the FREAK attack on browsers works?

Is there a reason it only affects browsers on Windows machines and not Mac's or UNIX/LINUX environments? A lot of the wording on this site is particularly complicated and I don't understand fully what ...
1
vote
1answer
89 views

Cross Domain Javascript security [duplicate]

I used a web vulnerability scanner to scan my web site. It indicates several links with "Cross domain Java script source file inclusion." May I know how would an attacker exploit this type of ...
1
vote
1answer
631 views

Untrusted connection visiting https://www.opensource.apple.com/

Somebody on Stackoverflow posted some code from https://www.opensource.apple.com/ When I click this link in Firefox (36.0) it says "This Connection is Untrusted". But other people on that thread on ...
3
votes
1answer
62 views

Does a browser have to make multiple requests to verify an SSL certificate chain?

I've learned that SSL certificates can be chained, and the browser will use the issuer's public key to verify the issuer's signature. I have read this article, which has a very helpful diagram, but it ...
2
votes
4answers
152 views

How safe is SSL on an untrusted computer and network?

In situations where the consumer doesn't trust/control the workstation and the network, can consumer safely do potentially sensitive activities (like making a payment or transferring confidential ...
34
votes
8answers
5k views

Why do browsers default to http: and not https: for typed in URLs? [duplicate]

When I type example.com without any scheme into the browser bar and press Enter it is interpreted as HTTP://example.com, not HTTPS://example.com. Why? And where are the plans to fix this? (To be ...
3
votes
3answers
240 views

External cross domain include script

One of my web application underwent a vulnerability assessment recently, and one of the findings is about cross domain include script. Our web app uses addthis_widget.js from AddThis to bookmark ...
0
votes
1answer
66 views

Clarification on a website security

I am new to work on website handling and here are my questions. 1) How can I ensure that the pages accessing is secure enough for data transmission , sql injection and several other attacks. 2) How ...
2
votes
1answer
62 views

Secure Flash with Click to Play Plugins in the Enterprise

In the recent light of repeating critical Flash vulnerabilities there are recomendations to use browserplugins like click-to-play to prevent unnecessary flash content to automatically load with every ...
1
vote
1answer
26 views

Can a Certificate Authority associated with Active Directory publish a client certificate to a browser?

Can I use some integration of Windows Active Directory and a Certificate Authority to embed a client certificate in a browser that will be trusted by a server? I have a private domain and control ...
-2
votes
2answers
89 views

How would I start becoming knowledgable about hacking and able to do it? [closed]

Is there a site I can start reading tutorials to simpler stuff to build up my skills??? Or is someone willing to give me a task (easy one) to do?
0
votes
1answer
30 views

Secure keyboard entry with JavaScript or Flash?

Is it possible to perform secure keyboard entry (similar to what is offered in the OS X Terminal app) using only web technologies and/or Flash? If not, is there any way to more broadly guarantee ...
11
votes
2answers
900 views

How can I hide my logged in sessions from other websites?

Most people go on browsing the web while connected to their facebook/gmail/etc. accounts. Other websites somehow know what accounts you're logged in. For example, if you go to hide.me's torrent page, ...
1
vote
2answers
102 views

Can Professor See Open Tabs Or History? [closed]

I have a professor that has online quizzes. They mentioned on the first day that they can see the other tabs open in the browser so don't try to cheat by looking up answers. Is this possible? If not ...
2
votes
3answers
63 views

Are auto complete forms a security concern?

I know when I fill out forms with address and email it will attempt to auto complete the rest of the information. Is it possible to include more hidden fields on the page in order to get more ...
0
votes
1answer
43 views

From a security perspective, why not a screenshot api for browser? [closed]

I mean a javascript api for capturing a renderered html page, or current viewport, and dump content onto an image. While there are obvious attacks, such as taking screenshot of sensitive information, ...
4
votes
2answers
114 views

find if 0-day flash bug was exploited (on a particular machine)

There have been several critical 0-day exploits in the past days/weeks in Flash alone. Nobody knows how long the 0-days have been exploited, and it is reasonable to expect that there are 0-days being ...
3
votes
1answer
84 views

How is this web resource hidden from the user? [closed]

Motivation: I've been interested in how various agencies hide data, either through incompetence or willful intent, that is required to be "open". Specifically I've seen oil companies use images to ...
3
votes
1answer
111 views

How does the same-origin policy apply between browser tabs? [duplicate]

Let's assume that we have 2 open tabs in a browser containing page A (A.html, A.js) into the first tab and page B (B.html, B.js) into the second tab and that page A and B have the same origin (scheme, ...
9
votes
2answers
426 views

How to improve the security and privacy of Firefox

What would be a sensible approach to enhance the security and privacy of Firefox? I did not find a question about this and I feel that some guidelines for casual web users would be handy. Currently ...
3
votes
1answer
107 views

Login to one site using other site's credentials

I am frequently seeing websites that allows a user to log-in to their site using other websites log-on credentials. If there is a page that allows me to log-in using my google account or facebook ...
5
votes
1answer
112 views

Why is a child window allowed to change the location of its parent?

Maybe a silly question. When opening a new tab via target="_blank", the page that loads in that tab is allowed to set a new location in the parent tab using: ...
0
votes
1answer
133 views

Can HTTPS be compromised by first contact?

Let's say I am behind my PC and want to go to any secured website (HTTPS). I have the direct IP address so any possible hack on DNS level is not possible (because I am not using it ;) ). The packet ...
0
votes
0answers
56 views

Chromium Sandbox on Mac OSX: Is it enabled by default?

I have decided to finally replace the closed source and privately owned Google Chrome with the open-source Chromium on my Mac OSX 10.9.2 (Mavericks). I have read the differences between both here: ...
2
votes
1answer
220 views

Are my passwords saved in Google Chrome safe when I'm logged out?

I understand that Chrome uses the OS's password storage mechanism to protect passwords on your computer. 1 I also understand that these passwords can be (in my case, are) protected with a passphrase ...
3
votes
1answer
85 views

PKI - Why Root CA is in intermediate CA section?

I can't understand why, when I accept to "install" a custom self signed Root CA on IE browser, the root certificate ends up in the "intermediate CA" section, rather than in "Root CA" section in the ...
2
votes
1answer
46 views

Spoofing of Server Sent Events

In the spec for Server Sent Events, it says Authors should check the origin attribute to ensure that messages are only accepted from domains that they expect to receive messages from. Otherwise, ...