A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.

learn more… | top users | synonyms (2)

0
votes
1answer
35 views

Why is the HTTP Server header not used by most servers, but the User agent used by most browsers? [on hold]

I've read that the Server header would disclose information, and that its use would be bad. The arguments made in that question also apply for the User agent header. So why is it still used, and not a ...
0
votes
1answer
31 views

Web site blocked by Windows defender and is marked as unsafe in IE

I posted this originally on Drupal Stack Exchange, and it was recommended that I try here for an answer. Here is the original question: Visiting my Drupal 7 site just now with IE 11, I get this ...
11
votes
2answers
1k views

Could a malicious JS file pointed on URL/URI attack the browser/computer?

I found some website blacklisted on Google. I mean when you try to visit them, you get something like shown on this picture: After a small search, I found that some of them have a malicious ...
2
votes
1answer
102 views

How can I avoid Canvas Fingerprinting?

Canvas Fingerprinting has been getting a lot of press these last few days. Here is a study I read on this topic: 1 and 2 What can I do to keep browsing anonymously and avoid this tracking method?
3
votes
3answers
3k views

Javascript Malware: How does it work, and how can it be mitigated?

I am wondering how malware gets served through Javascript. I've noticed a few illegitimate pop-ups while visiting some financial websites. I wonder how malware exploits work against the application ...
15
votes
1answer
4k views

Site preventing user from closing tab/closing browser

I've come across the following website hxxp://politie.nl.id169787298-7128265115.e2418.com/ [Possible malware] Whenever I open it in Firefox it prevents me from closing it, I can't even close the ...
-1
votes
1answer
18 views

Pre-given words as “ad recommendation” solution? [closed]

There are so many talks about browser tracking, or try to uniquely identify who is behind a webbrowser. These marketing people have no other choice, that's why they do tracking. Question: wouldn't ...
2
votes
2answers
86 views

Get the browser history without using a browser

I would like to get the browsing history of a computer in my network (without running that web browser), is it possible?
-1
votes
2answers
48 views

blocking of a sites on Windows

I would like to block websites like Facebook, YouTube and other social sites as part of my job and would need your advice on how to manage that. There are about 120 PCs in the building. Is something ...
1
vote
1answer
31 views

Preventing tracking in browsers by setting HOME directory

Following worked on Ubuntu 12.04 using chromium and firefox browsers. I ran following command on terminal for both firefox and chromium browser HOME=/tmp/tmpdir firefox Both browsers promptly ...
2
votes
1answer
44 views

Browser - what gets saved to the disk

We run scraping jobs on behalf of users. We use webkit-gtk as browser to do the scraping. Each job is executed as a separate process So as not to mix user data we have isolated following data per ...
1
vote
1answer
62 views

How to post comments on websites without being traced back

Just trying to get some general sense about the security on internet now-a-days. There are so many websites I go and comment on different things. If some comments are political and they don't like, I ...
0
votes
2answers
65 views

Want to build a password manager using OpenPGP.js

I'm kind of tired of the password managers that are available around... I need one that's open source, that works on OSX, that lets me store .pem files and that I can trust. As I haven't found one, I ...
121
votes
9answers
21k views

Is Adblock (Plus) a security risk?

My email-provider's website (http://www.gmx.de) recently started linking to the (German) site http://www.browsersicherheit.info/ which basically claims that due to its capabilities to modify a site's ...
28
votes
3answers
8k views

Why is the same origin policy so important?

I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
4
votes
1answer
212 views

Is there any risk to enabling CORS with a wildcard on S3?

By default, Amazon S3 blocks cross-origin requests. However, it allows users the ability to set up per-bucket CORS policies. It offers fairly elaborate controls for which domains and methods the user ...
0
votes
1answer
58 views

How can a browser hijacking attack change the browser's default homepage?

Some attacks on web browsers consist simply of advertising, so the default homepage of the browser is changed (which is just a small aspect of browser-hijacking). My question: is installing ...
1
vote
1answer
40 views

are webmalware able to hijack browsers?

Are webmalwares capbale of performing browser hijacking attacks ? Has there been any famous webmalware that functioned this way ?
1
vote
1answer
95 views

Why do sandboxing environments not rely on antivirus programs?

Since years ago, miscreants use JavaScript to craft web malware attacks such as drive-by download attack that is used for example to install the famous CoolWebSearch virus. There are static methods ...
1
vote
1answer
55 views

Is installing malicious add-ons via drive-by attacks the only way to add new toolbars to browsers?

Some attacks on web browsers consist in installing new toolbars on the browser of the user (which is just a small aspect of browser-hijacking. My question: is installing (malicious) add-ons (via ...
3
votes
1answer
35 views

What are the webmalware effects on Windows XP?

I am redirecting URLs to a virtual machine (Windows operating system) to check if there is malware on the website i want to visit (JavaScript attacks, drive-by download attacks, infected pictures/PDF ...
1
vote
1answer
48 views

Is it safe to call an untrusted service with jquery.ajax and dataType 'jsonp'

From what I understand, the JSON-P technique generates a script tag into the DOM of an HTML page to get across the single-origin restrictions imposed on the XMLHttpRequest JavaScript API for AJAX ...
3
votes
1answer
107 views

How is YouTube able to identify anonymous users?

A few days ago I was searching YouTube and I noticed an "outlier" video poped up in the suggestions list. This video had nothing to do with the topic being searched, but instead it was based on a ...
0
votes
2answers
96 views

How much I can depend on TOR to protect my identity, especially from outlook.com

guys I am using Tor browser from some time, few weeks maybe and I am still trying to determine the level of anonymity that the browser gives. I am using the browser to advertise a service that I am ...
2
votes
2answers
837 views

How can Bank of America tell that I'm logging in on a computer I haven't used with them before?

When you sign into Bank of America for the first time on a computer that you haven't used with them before, they detect this and force you to answer one of your security questions. I think I've seen ...
3
votes
1answer
76 views

How browser detects Phishing Pages?

I want to know how browsers detect phishing pages.And also what methodology browsers use to detect phishing pages?
1
vote
2answers
74 views

Creating an application in which all user content is encrypted

Does any one have references or sources on how to approach developing a web application in which the content is encrypted and unreadable for the developers or company owners; I'm referring to content ...
0
votes
0answers
42 views

Google Chrome Crash Report Analysis

I am new to the field of crash analysis. I recently, by accident, happened to crash Google Chrome. I do not know the reason as to why the crash really happened. I'd like to know it in depth though. ...
7
votes
4answers
2k views

What web browsers support OCSP stapling? Are the privacy and performance features the same?

OCSP stapling decreases the load on a PKI infrastructure's OCSP server by attaching a signed OCSP response to the target in a TLS connection. In addition it creates a more secure/private session ...
4
votes
2answers
221 views

Learning XSS: Why is my javascript ignored?

<a href='mailto:</a><script>/*'></a><script>/*</a>: <br> <hr> <a href='mailto:*/location.href=/*'>*/location.href=/*</a>: <br> ...
0
votes
1answer
27 views

Is it Possible for a Java Applet to Record Cursor Movements Inside the Applet? [closed]

I am using my mouse to interact with a Java applet in a browser. Clearly the party that owns the Java applet can record where I click inside the applet. What I'm wondering about now is whether it is ...
0
votes
0answers
36 views

Is opportunistic encryption support optional for HTTP/2?

I'm a little unclear on the subject of opportunistic encryption of the HTTP:// address scheme in HTTP/2. According to the bug report, it looks like it's kinda optional, and an afterthought: ...
1
vote
0answers
80 views

Accessing Chrome and Gmail on a stolen drive

I was trying to search for this, but could not find the answer anywhere - apology in advance if already answered. I have a Linux desktop installed on a thumb drive, which I keep in my pocket. This ...
0
votes
0answers
7 views

TypedURLsTime convert value of key to time [migrated]

How can I convert the binary value in the TypedURLsTime to a time value? As I was researching this it appears the value of the key is Windows FileTime structure and I haven't found much information on ...
0
votes
1answer
52 views

Understanding Same origin policy

I am trying to understand same origin policy better. From what I understand same origin policy restricts code from one "origin" not access data from another "origin". What I am trying to understand is ...
6
votes
3answers
160 views

How to sandbox Iceweasel (Firefox) on Debian? [closed]

Are there any tools for sandboxing Iceweasel (Firefox) on Debian systems? I'm mostly interested in tools distributed by Debian. (An equally trustworthy source would be second best.) (I suppose that ...
0
votes
1answer
56 views

Security of starbucks gift card redemption feature

Someone sent me a Starbucks gift card. The email contained a redemption link, and that redemption link ended in a long secure hash, much like those on github secret gists. Clicking the redemption ...
2
votes
1answer
70 views

Where do browsers store HTTP Authentication details

Where do browsers store HTTP Authentication credentials ? If I gain access to a browser, is there some place I can look where all HTTP Authentication details would be available? In most browsers, even ...
1
vote
1answer
73 views

How to harden a “dedicated” Firefox?

I want to set up an instance of Firefox to be used to access a strictly limited "white list" of websites (my bank's, my credit cards', etc.). How can I harden such an instance of Firefox to reduce ...
5
votes
2answers
137 views

Exactly how secure is VM browsing?

I generally do all of my web browsing in a VM. I have one "safe" VM running Ubuntu that has guest services installed. I generally only go to sites I deem are trustworthy here. I also have an "unsafe" ...
26
votes
2answers
3k views

How can webpage get MAC address?

I was logged on to my router and filling out some information. I clicked a button and a field was automatically filled in with my computers MAC address. How is this possible? Does it present a ...
3
votes
3answers
135 views

When downloading from an https web page - will the download also use ssl?

If I click on a download link on a page that uses ssl, will the download also use ssl? If the answer is not (or: sometimes yes, sometimes not) - is there any way I can force it to be protected? I'm ...
-1
votes
1answer
138 views

How to recognize if someone using password Reminder Script [closed]

I have been trying to know what these so called Gmail hacking scripts actually does (just studying for some knowledge purpose) and one of such scripts is this, which seems beyond my knowledge: ...
2
votes
3answers
1k views

How to block the websites on client machines

In our office we are blocking sites like Facebook, Twitter etc.The problem is that some of the users bypass our proxy and firewalls through external proxy sites like www.youhide.com or ...
8
votes
6answers
4k views

Why are iframes allowed at all in modern browsers?

I read a number of IT security blogs (though I'm no security expert), and it seems a significant percentage of exploits in the wild are delivered through adding malicious iframes to a hacked website, ...
1
vote
1answer
105 views

Can HSTS be defeated?

As I know HSTS is mainly implemented to mitigate famous sslstrip attack in which browser is forced to use ssl when connecting to particular site. And I think it also prevents user to proceed to site ...
34
votes
4answers
5k views

Should websites be allowed to disable autocomplete on forms or fields?

Currently, there is an HTML form/input attribute called autocomplete, which, when set to off, disables autocomplete/autofill for that form or element. Some banks seem to use this to prevent password ...
1
vote
2answers
91 views

How can Facebook use history data in browser

Web is filled up with the recent decision by Facebook to track user browsing history like adage.com andNYTimes. How can a web application use browsing history which is local to that browser? Is it ...
0
votes
1answer
86 views

Why has Convergence stalled out? [closed]

Convergence is a well-thought out system to replace certificate authorities built by Marlin Moxiespike back in 2011. Since it's debut, it seems to have largely stalled out, with no additional major ...
4
votes
4answers
1k views

Is online banking more secure on iOS than a desktop computer?

Does Apple's iOS provide a more secure environment for online commerce (banking or shopping) than Windows or Mac OS X? Since the only software that can run on iOS must be vetted by Apple, the ...