A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

learn more… | top users | synonyms (2)

0
votes
1answer
111 views

Why has Convergence stalled out? [closed]

Convergence is a well-thought out system to replace certificate authorities built by Marlin Moxiespike back in 2011. Since it's debut, it seems to have largely stalled out, with no additional major ...
6
votes
4answers
3k views

Is online banking more secure on iOS than a desktop computer?

Does Apple's iOS provide a more secure environment for online commerce (banking or shopping) than Windows or Mac OS X? Since the only software that can run on iOS must be vetted by Apple, the ...
0
votes
2answers
80 views

It would be possible to filter user input browser side to prevent injection?

I've been studying common injection problems and examples and I've been wondering whether it would be possible to embed some filtering mechanism to prevent injection client side. For example checking ...
1
vote
2answers
435 views

Anomaly detection in HTTP REFERER

I'm trying to put some anomoly detection in place and I'm looking at referrer data (I know that this is optional, and can be fudged in some circumstances). But I'm seeing too many cases of what I ...
2
votes
1answer
329 views

Certificate pinning in a browser

I am trying to understand certificate pinning. Google started adding a whitelist of CA certs that they use for their certificates and if a cert for a google service is issued outside of this list ...
2
votes
1answer
161 views

Weird URLs in Fiddler

I was browsing the web and suddenly I started seeing "Waiting for available sockets" error in Chrome with the page showing "Network Unavailable". I thought that was weird so I opened up Fiddler and ...
1
vote
2answers
20k views

Error code: sec_error_untrusted_issuer

I need help with a security issue concerning this code that has just been popping up recently as I visit my favorite websites. Based on some past history I KNOW something is not right, and I am not ...
0
votes
2answers
104 views

Can a drive-by download attack crash the OS?

Are there cases where a serious drive-by download attack could crash the operating system or the browser ?
0
votes
1answer
1k views

Force download files protected with auth headers

By several REST clients the credentials are sent with every request through custom HTTP authorization headers to the REST service. Is there a way to force file download in the browser when accessing ...
3
votes
8answers
1k views

How can I allow only authorized browsers to access a website?

I have a website and I want it to be accessible only by authorized clients/browsers (ex. with a certficate). The idea is that the users can only access the webpage in their office's computers (...
1
vote
2answers
4k views

Which browsers are using openssl

It is asked in stackoverflow, but I suppose maybe it is more suitable to ask here. It is said that openssl are widely used, however, as far as I know, the most popular browsers seem not use openssl, ...
1
vote
1answer
2k views

Can a website download malicious content to my Windows computer without my permission or awarness? [duplicate]

Question Standard security advice is: Only download files from websites that you trust. http://windows.microsoft.com/en-ca/windows/downloading-files-internet-faq This implies that 1. we are ...
37
votes
4answers
53k views

Why is passing the session id as url parameter insecure?

I recently followed a discussion, where one person was stating that passing the session id as url parameter is insecure and that cookies should be used instead. The other person said the opposite and ...
1
vote
1answer
73 views

Are there other ways for a CA to have their certificates included in a browser?

From what I understand, the certificate authorities (CAs) have to get their root certificate included in the browser. What if the root certificate of a particular CA is not included in the web ...
1
vote
1answer
91 views

Why are certain languages chosen for security application development over others?

Specifically, why are the most popular attack proxies written in java? Is there any particular security posture to the design of the java language that makes writing tools like these simpler? Easier ...
4
votes
3answers
888 views

Is Chrome in Metro Mode more secure than Chrome in Desktop Mode?

With Windows 8, Microsoft introduces the Metro Apps which run in a sandbox environment, and therefore should be more secure. I would be interested to know if this higher security that the metro apps ...
2
votes
1answer
1k views

How to handle private key encryption/decryption for web application

In the process of designing a web app that handles public/private key pairs - a Bitcoin web app, specifically - I've had a lot of thought on how to securely handle the storage of the private key, ...
1
vote
2answers
499 views

Are web browser able to use camera without permission? [duplicate]

Is it possible to be recorded via our camera/micro via web browser without asking our permission ?
0
votes
1answer
220 views

Access-Control-Allow-Origin possible threats on static JS file

As I am working on a research, I need allow users to read my JavaScript file using Ajax. However, I want to make sure about consequences of adding Access-Control-Allow-Origin header for just this file....
5
votes
5answers
33k views

Using Private Browsing mode while connected to organization's network

At the workplace I use the organization's network for accessing internet (well that's the only option). I am not sure if the network administrators monitor what I browse, how frequently I access ...
1
vote
1answer
2k views

IE11 on windows 8.1 and ssl fallback

I'm having problems with SSL certs and my SSL accelerator. I have a Sonicwall SSL-R and it only supports SSLv2, SSLv3, and TLS1.0. I have it configured to decode SSL with SSLv3 as the TLS1.0 ...
6
votes
4answers
2k views

Suggestions to avoid cookie-hijacking in a web application

I've been developing web-apps for quite some time now. While making websites, the "remember me" feature is one of the most trivial(read as must-have-for-clients) feature to be implemented. Until today,...
0
votes
1answer
141 views

Corporate IT support for client-side cross domain requests

I have an API and a web application that exist in different domains. I can activate CORS on the API to allow for the web application to interface with the API cross-domain. However it has been ...
1
vote
3answers
223 views

Where do suspect requests from logged-in users to my website come from?

I have an ASP.Net MVC 4 web application that is hosted on a Windows 2008 server. The application is secured by a custom ASP.Net membership provider. Only users who are granted permission by the admin ...
4
votes
1answer
414 views

XSS via PDF when Content-Disposition: Inline?

There are kind of two questions here: Is it possible to have XSS in a PDF file when the Content-Disposition: is "inline"? If it is possible, does the pdf get access to the cookies for that domain ...
-2
votes
1answer
161 views

Vulnerability in Internet Explorer [closed]

An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website. This here being remote code ...
0
votes
1answer
489 views

Can I use crypto.getRandomValues to create a private key?

In the window.crypto spec: http://www.w3.org/TR/WebCryptoAPI/#RandomSource-interface It says explicitly: "Do not generate keys using the getRandomValues method. Use the generateKey method instead."...
6
votes
2answers
339 views

Zero-Day Exploit targeting Internet Explorer Versions 9 through 11

Few days ago, FireEye has found a vulnerability, which affects all versions of IE (even the latest 11). Microsoft has official statement regarding this issue. FireEye wrote a technical article on ...
1
vote
1answer
220 views

Securing Javascript plugin

My company offers a Javascript plugin that is meant to be embedded with websites. It works in a similar fashion to Google Analytics, in which you add a bit of Javascript and then it does some magic on ...
3
votes
1answer
126 views

Force user to download a file to their hard drive via hyperlink?

I want to design a scenario in which I have a web site which contains a link. If the user clicks on this link, it will save a file in a specific pat in his hard disk without his consent. Is this ...
5
votes
0answers
733 views

Content-Security-Policy & Facebook login

This question seems to be related to http://stackoverflow.com/questions/15913200/facebook-js-sdk-not-executed-in-my-chrome-extension , but I am not developing a chrome extension. I am developing a ...
13
votes
5answers
5k views

Does HTTPS Everywhere defend me against sslsniff-like attacks?

http://www.thoughtcrime.org/software/sslsniff/ If I have a domain on my HTTPS Everywhere list, so that theoretically it could be only visited via an HTTPS connection in my Firefox, then could an ...
24
votes
1answer
4k views

Why would the BBC web site always ask for a personal certificate, and how do I avoid giving it away?

After installing a CAcert personal certificate, every time I land on the BBC weather site it asks me to identify myself with a certificate. Why would any non-malicious web site do that unless I've ...
-5
votes
4answers
210 views

How to check the safety of a link? [duplicate]

Someone gave me a link and asked me to open it, but I don't trust that guy. I'm not sure the link whether safe to open or not. I want to know if there a way to check the safety of the link? I have not ...
2
votes
3answers
885 views

Is it secure to access web with Xubuntu in VirtualBox running in Windows XP?

Support for Windows XP is ending soon. Therefore, I am seeking a secure solution to continue with Windows XP. When I access the web from Xubuntu in VirtualBox running in Windows XP, is the Windows ...
1
vote
1answer
108 views

Simple protection against reflected XSS

I was going through some CLIENT side defenses against reflected XSS e.g. XSS auditor(chrome), IE8 XSS Filters, Noscript. They use regular expression and other sophisticated techniques. My question is-...
0
votes
2answers
180 views

Can malware cause firefox to send GET requests?

Is it possible for a site to host malware such that if a certain page is accessed, Firefox is made to send additional GET requests? I'm seeing traffic for attacks coming from me that I haven't done. ...
15
votes
4answers
14k views

Tor and regular browser side by side. Does that make sense?

Can I use a Tor browser session and a regular Firefox session side by side without corrupting the security of the Tor session? E.g. when I download a new Eclipse version or when I'm searching for ...
-1
votes
1answer
110 views

Heart Bleeding Bus [duplicate]

This may be a unwise question, but I'll ask anyhow. I have been analysis relatively a bit about the Heart Bleed vulnerability, and I'm curious as to whether it only affects web applications or could ...
1
vote
0answers
40 views

What part of the browser is typically attacked? [closed]

Pretty sure that browsers are compromised most often through their plugins, at least, that's what I keep reading. So, then, does that mean the browser itself has vulnerabilities, and the plugins are ...
1
vote
1answer
58 views

Which is safer as a URL storage, favorites or browsing history?

Somewhere on this site I read that I should connect to websites by entering the URL myself or using a bookmark when security is critical. I started wondering why that didn't include browsing history. ...
3
votes
3answers
10k views

What version of TLS does any web browser use when connecting to server where all SSL Protocols are enabled?

All (almost all) web browsers have TLSv1.0 enabled by default, moreover TLSv1.1 and even TLSv1.2 can also be enabled by default. What version of TLS will be used to connect to web server (e.g. Apache)...
2
votes
5answers
908 views

running firefox as unprivileged user on Linux

On a typical desktop (with no listening services such as Apache, SSH, ...) it seems to me, the browser is the most exposed application and a potential security compromise (and even more so with Java ...
44
votes
12answers
7k views

Why should I care if a site uses encryption or not if I'm not exchanging any sensitive data? [duplicate]

Lots of sites these days, that don't deal with sensitive data, enable encryption. I think it's mostly to make (paranoid?) users feel safer. In cases where there is a user's account being logged in, ...
0
votes
1answer
125 views

Good reason to continue using fraudulent certificate?

A relative of mine used a favorites link to login to yahoo. The favorite link is https://de.mg40.mail.yahoo.com/neo/launch? However, this link uses a fraudulent certificate. Visiting the Yahoo ...
0
votes
1answer
154 views
0
votes
1answer
451 views

False Positives- Server side protection against XSS

I read about XSS attacks and its prevention mechanism on server-side. It seems only protection is to sanitize the input by escaping special characters on server side (Using some PHP functions such as ...
2
votes
2answers
910 views

Do Chrome/browser extensions break the tab sandbox?

So, as far as I know, Chrome and possibly other browsers have a very low privilege process spawned for every tab. How do browser extensions interact in regard to this sandboxing? I'm not talking ...
26
votes
1answer
2k views

Why does Firefox not trust this US government SSL certificate?

Shouldn't this be a trusted certificate considering it's a wildcard SSL certificate? That is, shouldn't *.delaware.gov cover www.corp.delaware.gov?
3
votes
2answers
313 views

How can users be sure the browser's URL bar is not faked?

For a user to defend against something like Don't understand how my mum's Gmail account was hacked , they should pay attention to URL bar before typing their credentials. But how can you make ...