A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.
40
votes
4answers
5k views
How much can I trust Tor?
Greetings.
How much can I depend on Tor for anonymity? Is it completely secure? My usage is limited to accessing Twitter and Wordpress.
I am a political activist from India and I do not enjoy the ...
26
votes
2answers
3k views
What malicious things can happen when clicking on links in email?
I've received a spam from one of my friends (well I'm sure he didn't send it). so there's this link, and i'd thought what exactly would be the implications of clicking the link (i've not clicked it ...
26
votes
9answers
4k views
Is visiting HTTPS websites on a public hotspot secure?
It's often said that HTTPS SSL/TLS connections are encrypted and said to be secure because the communication between the server and me is encrypted (also provides server authentication) so if someone ...
21
votes
8answers
2k views
Is anybody using client browser certificates?
Client browser certificates seem to be a nice way to protect sites from intruders - it is impossible to guess and should be harder to steal. Of course, they do not solve all the problems, but they add ...
20
votes
2answers
1k views
From a technical standpoint, how does the zero-day Internet Explorer vulnerability discovered in September 2012 work?
I'm looking for an answer that explains the issue from the prespective of a developer/engineer. What is exactly being exploited and why does it work?
Please note that I am not looking for ...
19
votes
4answers
8k views
Why is passing the session id as url parameter insecure?
I recently followed a discussion, where one person was stating that passing the session id as url parameter is insecure and that cookies should be used instead. The other person said the opposite and ...
18
votes
2answers
3k views
Why is the same origin policy so important?
I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
18
votes
2answers
4k views
Can web sites detect whether you are using private browsing mode?
Most modern browsers support "private browsing mode" (also known in Chrome as "Incognito mode"), where the browser does not save any information to disk about your browsing while in this mode.
In ...
18
votes
3answers
826 views
NoScript: How to determine which sites/scripts to whitelist?
NoScript is a great plug-in, both for security and for ad blocking. However, I've found it's not always easy to figure out what scripts need to be permitted on certain pages, to be able to use the ...
18
votes
4answers
2k views
How secure are my passwords in the hands of Firefox using a Master Password?
I'm relying on Firefox to remember my passwords, using a Master Password of more than 25 characters. How secure is this set-up?
17
votes
4answers
1k views
Why doesn't the client's web browser need to be PCI compliant?
A hypothetical online store that accepts credit card payment will have to be PCI compliant because it receives (transmit), process and possibly store credit card numbers.
But the client's web browser ...
17
votes
8answers
838 views
Ways to secure yourself from Firesheep kiddies and other sniffing
Just a few days ago I had my first encounter with Firesheep. Luckily I was the one using it. Well, it scared me into looking for ways to secure myself. So I have two questions:
In exactly what ...
16
votes
4answers
881 views
IMG tag vulnerability
Is it safe to display images from arbitrary domains? I.e. let's say I have an image on my page:
<img src="http://badguy.com/image.gif" />
What if image.gif will return some js attack vector, ...
16
votes
2answers
6k views
Can you get virus just by visiting a website in chrome
I've recently read Google Chrome: The End of Drive-By Downloads. Is it true to say that drive-by-downloads are history in Google Chrome?
So if I have a link (from a spam email) I can right-click >> ...
15
votes
2answers
3k views
Google Chrome Browser - Privacy Concerns
After i saw many people using Chrome i wanted to inform myself on this browser and everything concerning it as i am a Firefox user since it existed. However i am always afraid of Google being a "data ...
14
votes
6answers
1k views
What are the security implications of people downloading addons, wrongly thinking that they are safe?
I recently learned about a plugin for Firefox called Fire Sheep, which was featured on the Security Now podcast. I downloaded F.S. and began examining it. To my surprise it includes C++ code that must ...
14
votes
1answer
493 views
Are there any security problems with Google false start for TLS?
Google recently announced false start in Chrome browsers which increased TLS performance by 30%
http://news.softpedia.com/news/Google-Chrome-s-SSL-False-Start-201253.shtml
I know TLS has been poked ...
14
votes
4answers
2k views
TLS 1.0 JavaScript injection vulnerability (BEAST): what to do client-side?
With the alleged SSL/TLS vulnerabilities used by the BEAST exploit, there seems to be a security gap between TLS versions; TLS 1.0 being the problematic one but still the only option for many sites.
...
13
votes
4answers
1k views
Why does Facebook serve several SSL certificates?
Facebook seems to be alternately serving two SSL certificates, one from DigiCert and one from VeriSign. There are only two reasons for this that I can think of:
They're in the middle of a ...
13
votes
4answers
915 views
Should sensitive data ever be passed in the query string?
Should sensitive data ever be passed via the query string as opposed to the postback? I realize that the query string will be encrypted, but are there other reasons to avoid passing data in the ...
13
votes
5answers
2k views
Preventing information disclosure from browser back button/history?
I have sensitive data that will be hosted on a website, and I would like to prevent the data from being exposed in this scenario:
The primary user logs off the application, but does not close the ...
13
votes
5answers
530 views
Are address bars unphishable?
I've taken, out of curiosity, the Phishing Quiz by OpenDNS that tries to teach the general public about detecting phishing:
Ever wonder how good you are at telling the difference between a ...
12
votes
4answers
1k views
Why users want to disable cookies?
I just started to create a new web application. In the documentation, it is written that I have to prepare for the situation where users have disabled cookies. This is not the first time I have read ...
12
votes
5answers
1k views
Solution to allow JavaScript input but prevent XSS
We have a simple Blog system that allows users to input html and JavaScript to build a blog page. I'm aware that allowing javascript open up the door to xss attacks. We do however need to allow users ...
12
votes
5answers
782 views
Is Google Chrome a better secured browser?
I was amazed that IE 8, Safari, Firefox were hacked so fast. Is it really Chrome so good or it was not tested?
Has anyone other results of independent investigations about security of web browsers?
...
11
votes
4answers
787 views
Is clipboard secure?
Can a browser get the data on my clipboard? Data could be for example my temporary password?
Any browser or operating system that allows this?
11
votes
3answers
445 views
URL Shortening - How to verify if it is a non-malicous URL?
Again, I must mention that I have just started to learn about security. So, please bear with my newbie questions.
If I receive a shortened URL from somewhere, say in an my-email or in a social media ...
11
votes
6answers
1k views
Anonymous web browser. Is it real?
Do anonymous browsers work? What principles do they use? Can I use them to test access to my web site? Can I detect if a visitor is using one? What is the different between traditional and anonymous ...
11
votes
7answers
838 views
How to browse the Internet safely?
What is the best way to browse the Internet safely? By safely I mean:
anonymously
having encrypted communication
Extra bonus for:
being able to do it with little or no performance impact
cheaply ...
11
votes
4answers
751 views
How are browser saved passwords vulnerable?
Most browsers offer to save the password after entering it on many logon pages. What types of vulnerabilities are there for such saved passwords. I'm interested in what ways malware on web pages ...
11
votes
3answers
675 views
Elaborate websockets security
I'm interested in learning more about web sockets security. Read that web sockets were originally in Firefox, removed for security reasons and now added back in with the problem resolved:
...
11
votes
2answers
490 views
How to fight browser fingerprinting?
https://panopticlick.eff.org/ , aka "How unique and trackable is your browser". For example it usually gives me a unique score. The biggest entropy values come from navigator.plugins and fonts via ...
11
votes
5answers
923 views
Different strategies for online anonymity and their +/-s?
I saw this question about anonymous web browser, but I wanted to go a little bit more in depth. I prefer answers that take into account how a connection would be traced back, time it would take to ...
11
votes
3answers
1k views
How can I prevent tracking by ETAGs?
An ETAG is a HTTP header that is sent-behind-the-scenes between a web browser and an web server. This value is intended to control how long a particular file is cached on the client side.
There is ...
11
votes
2answers
191 views
Why do browsers allow public websites to attack intranet sites?
When I'm visiting a website on the public internet, the website can cause my browser to send requests to a local IP address (such as 10.0.0.1). This can be used to attack internal web sites, e.g., ...
10
votes
4answers
664 views
Why isn't OCSP required by default in browsers?
According to the following screenshot, taken from firefox-3.6.17-1.fc14.i686, Firefox has an option to fail closed when unable to connect to OCSP servers.
Can someone please explain why this isn't ...
10
votes
4answers
667 views
Security measures against packet sniffing
I work in a environment where packet sniffing can be easily done . I was worried about my confidential data . Please suggest how is it done and precaution which i can take at client level.
10
votes
4answers
495 views
Why do browsers warn about mixed content for images?
I'm dealing with a phpBB forum user who wants to set up SSL on their entire site to secure user credentials and "private" parts of the website.
However, they want to preserve the traditional forum ...
10
votes
3answers
366 views
What bad coding practices makes a browser extension vulnerable?
I'm trying to scan JavaScript files for vulnerabilities using JSHint. Specifically, I'm scanning the JavaScript files of browser extensions. To look for possible vulnerabilities I'm looking for bad ...
10
votes
2answers
209 views
What should I look for when auditing a Browser extension / plugin?
I've been asked to do a security audit on a cross-browser plugin for desktop browsers developed by a third party. I am a web developer with a reasonable grasp of Javascript but am not a browser ...
10
votes
3answers
297 views
Should I ask a user to re-authenticate if the browser thumbprint changes? Is a server side library available?
Is there a security benefit to using the browser's thumbprint in addition to a session identifier to identify a unique session?
Would it then be advisable to ask the user to reauthenticate (or simply ...
10
votes
1answer
1k views
enable browser caching with HTTPS
I understand that sensitive data should not be cached (ie, you dont want to cache an HTML file with all of your bank account details in it), but there are some things that HTTPS protected sites should ...
10
votes
3answers
247 views
How to test if a browser add-on is safe
I came across this plug-in that started some alarm bells ringing. The add-on would help submit a website to web directories. The first 100 submissions are free, then you need to pay $20 via pay-pal ...
10
votes
4answers
493 views
Vulnerabilities common only in mobile solutions?
I was wondering if there are any threats for web-applications used on mobile phones that haven't been known in the "full size" browsers earlier.
I haven't heard of any serious or common problems that ...
10
votes
1answer
956 views
SSL TLS renegotiation vulnerability - current situation in clients
Reading about the SSL renegotiation problem CVE-2009-3555 one knows that servers supporting old type of renegotiation are vulnerable to data injection. We also have tools to test them (openssl ...
10
votes
1answer
389 views
How can I embed iframe securely without restricting its functionality?
I'd want to embed an iframe from untrusted site into web application. Iframe:
should be able to run Javascript and browser plugins (Flash, etc.)
should not be able to access my web application ...
9
votes
4answers
5k views
Is it possible to easily retrieve Thunderbird's passwords with access to HDD?
I know Firefox 8 stores it's passwords in a SQLite database, which can easily be stolen with access to the HDD!
What about Thunderbird 8? How does it store the passwords and how can one retieve them?
...
9
votes
2answers
676 views
Why do Chrome plugins need access to 'all my data' and 'browsing activity'?
Often I install simple add-ons for Google Chrome. However, they almost all need what appears to me as excessive access to my data. For instance, I install a plugin that allows me to click on any part ...
9
votes
2answers
2k views
Are there any statistics about webservers and browsers TLS support?
From Hackers break SSL encryption used by millions of sites:
The vulnerability resides in versions 1.0 and earlier of TLS, or transport layer security, the successor to the secure sockets layer ...
9
votes
3answers
769 views
localStorage for apps over https. What expectations are there?
I run an online gradebook. To keep student data private, I transfer all data over https.
Now, I'd like to use localStorage to avoid redundant calculations and server requests. However, according to ...
