A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

learn more… | top users | synonyms (2)

1
vote
1answer
3k views

Sending Client Certificate to Server

I have a simple question. Is a web browser sends client certificate to the web server on demand(means web server is configured for client authentication and demand the client certificate) or just ...
17
votes
4answers
23k views

Remove RC4 from SSL/TLS ciphers in Chromium

Recently I started to live without RC4 within my Firefox session. Discussion about it can be found here. While it is quite easy in Firefox (Enter about:config and then rc4), I found no possibility to ...
5
votes
1answer
6k views

Is it safe to give an Oauth token to client side javascript so it can directly make requests to a server?

I currently have a simple backbone.js application served from my domain (example.com), which is provided an Oauth token. Specifically, I pass the Oauth token through my page template into the ...
2
votes
1answer
417 views

I don't quite understand the principle of “use after free” and CVE-2010-1119

I am a rookie hacker studying android vulnerabilities. My partner and I are studying "CVE-2010-1119". Unfortunately there does not appear to be enough information online. Could anyone please help me ...
12
votes
5answers
2k views

Is clipboard secure?

Can a browser get the data on my clipboard? Data could be for example my temporary password? Any browser or operating system that allows this?
2
votes
1answer
109 views

Possible to redact information in the clipboard, or to auto-redact when it hits a webpage?

Sometimes when I paste information to a website I realize after I post the information that I inadvertently included an IP address, username, email address, or other information I'd like to consider ...
2
votes
1answer
224 views

Does Internet Explorer handle Extended Validation properly

I'm reading about Extended Validation (EV) certificates and have a few questions. From what I understand, EV allows domain owners to pay extra for a especially trusted certificate (that the browser ...
0
votes
2answers
219 views

Can Tor browser bundle be attacked like this?

When using the Tor browser bundle, you load the check.torproject.org on start. It tells you when there is a security update to downloads, and let's you click a link to get it. The way for users to ...
0
votes
1answer
115 views

How to investigate this anomaly?

According to the IT managers, this problem is neither at the server nor at the client but is suspected to be somewhere inbetween e.g. some DNS server that has been infected. Do you recognize this ...
0
votes
1answer
1k views

How do Java applet exploits work? [closed]

Browsers store web pages in a local cache on the client's machine. How does a hostile Java applet exploit this information to gain more privileges than it is entitled to? My understanding is that a ...
1
vote
2answers
298 views

How to restrict access to unwanted sites?

I use Ubuntu 13.10. I tried to used OpenDNS to restrict some websites. Unfortunately, I couldn't do that. I use AirStream 1200 USB modem to access WiMax internet. OpenDNS setting didn't work for me at ...
1
vote
1answer
313 views

How to check whether a link is safe or not? [closed]

I've been working on a task to find threats in a social network called Skyrock. For which, I've managed to retrieve a significant amount of URLs by crawling various user profiles and parsing the data ...
6
votes
2answers
2k views

Considering that SRP is better than SSH and Basic Auth, how can it be implemented in a website?

SRP is short for Secure Remote Password protocol, and provides a better way for passwords to be sent over the internet. I've read the information at it's Stanford University home page, the Wiki ...
17
votes
6answers
3k views

Anonymous web browser. Is it real?

Do anonymous browsers work? What principles do they use? Can I use them to test access to my web site? Can I detect if a visitor is using one? What is the different between traditional and anonymous ...
1
vote
2answers
626 views

Can I encrypt the packets that are sent to my router?

Is there a way to encrypt HTTP traffic to avoid man-in-the-middle attacks? I use Google Chrome.
4
votes
3answers
1k views

Web Certificate invalidation - You might be connecting to a website that is pretending to be [Site name]

Recently while trying to log-in to Facebook this notification starts to appear: At first I ignored it (by pressing Continue), but it started to popup every time I navigate through the website! I ...
3
votes
1answer
128 views

What's malicious about file links?

Why did Chrome and Firefox disallow file:/// links? I can imagine an iframe opening a local resource, but which resource is the scary one? They could have just disabled iframes to file:///? Ajax ...
0
votes
0answers
21 views

Error 150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a forgery [duplicate]

Can you tell me shortly how to fix this problem in Chrome? Error 150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a forgery
1
vote
1answer
603 views

Export ciphers prevalance

I would like to clarify the consequences of not supporting export ciphers. When I run a qualys ssl test on ebay.com, I notice that the following cipher suites are supported. ...
12
votes
4answers
14k views

Security measures against packet sniffing

I work in a environment where packet sniffing can be easily done . I was worried about my confidential data . Please suggest how is it done and precaution which i can take at client level.
0
votes
2answers
479 views

Can you trust the URL shown when 'hovering' on a link? [duplicate]

When using a modern web browser, if you hover on a link, the browser will show you the link in a little display on the bottom left corner of the browser screen. Can I trust this? Can this display be ...
0
votes
3answers
2k views

On a public wifi I just tried to access google over HTTPS and was forced on to HTTP, how?

I'm on a coffee shop wifi. I just typed https://google.com in to my browser and noticed that I got redirected to http://google.com. I tried other google domains (google.ie) and these work fine, so ...
4
votes
1answer
1k views

Different SSL states as seen by Safari, Chrome and Firefox

Today, I visited some sites of the German DHL group. While Chrome and Safari complain about an invalid certificate of Firefox accepts it. Which one is right, which one is wrong? Which decision ...
3
votes
3answers
327 views

Do on-demand SSL certificates exist?

A few days ago, I visited an SSL protected website. Since Safari complained about the SSL-certificate, I did a short inspection: The certificate was issued by GoDaddy in just the minute I ...
1
vote
1answer
937 views

Does google use browser fingerprinting? [closed]

I'm wondering whether besides collecting the typical tracking information (IP + cookies) google has already implemented browser fingerprinting? I read sometime not long ago about it being a ...
3
votes
3answers
715 views

How can I protect my browser from being compromised?

In enterprise environments, I have found great benefit to use binary white-listing, web security gateway and end-point AV to help protect the end-user/system. Unfortunately, I still see the browsers ...
0
votes
1answer
115 views

Browser Extension to show how your session is being shared

A while back I came across a browser extension (was available for Firefox and Chrome, maybe others) that showed you through a graphical 'node' interface how your browser session was shared with so ...
0
votes
1answer
3k views

Google Chrome - save usernames NOT passwords [closed]

I've scoured the settings page and googled this to no avail. I want Chrome to stop saving my passwords BUT keep saving usernames/email. Is that possible? All I seem to be able to do is disable ...
-1
votes
1answer
200 views

Reflected XSS Prevention plugin [closed]

Is there any plugin out there which prevent reflected XSS? Plugin could be either for firefox or chrome. Thanks.
1
vote
1answer
1k views

Force browser to use higher security connection

How can I force my Chrome broswer (or even Firefox) to always use a higher security encryption?, for example 256bit (or more) encryption when using https. I guess it should be some flag to force the ...
1
vote
2answers
901 views

Is it illegal to use Fake User-agents? [closed]

Is it illegal to impersonate user-agents when you are crawling a website? If so, what and how a legal action can be taken against the faking requester? Is this law applies only for crawlers or a user ...
14
votes
4answers
769 views

Entering passwords at public computers

Sometimes it happens that I have to access my email or some other web service from public machines. Are there any options to make it secure or at least reduce risks to acceptable levels? I am most ...
3
votes
2answers
1k views

How long should a browser session last?

I have two online accounts from different banks, one bank expires my session faster than the other, it's quite annoying. I was wondering how long (or short) should a session be for it to be ...
3
votes
2answers
688 views

Crypto Browser add-on

What are the known limitations with browser addon/extensions that do in browser encryption vs a native implementation in the browser. The addon would expose cryptographic primitives for use in ...
7
votes
1answer
822 views

Child iFrame hash verification of parent iFrame content

Consider the following scenario: Alice wishes to browse Victor's website while on the job at Initech. Victor's website is hosted on an alternative domain name system to which Initech's DNS does not ...
8
votes
5answers
428 views

Threat model for huge warnings on untrusted SSL certificates and no warnings for plain HTTP connections? [duplicate]

Why do untrusted/expired SSL certificates get such a huge warning in modern browsers even with "DO NOT VISIT THIS SITE!" messages, whereas a regular HTTP connection, which is more prone to ...
8
votes
1answer
492 views

Are there any reasons why browsers should block mixed passive content by default?

Most browsers block "active" content that's being loaded over HTTP on HTTPS pages. This includes stuff like javascript which can be modified with an MITM and compromise the security of the entire ...
2
votes
1answer
162 views

Does it have sense to fuzz a ASCII file format with mutators that mess with Unicode or String Case?

I'm trying to fuzz an ASCII file format. Specifically, I'm defining some HTML5/HTML structures to be used as definition file for a smart fuzzer to fuzz web browsers. This smart fuzzer allows to ...
3
votes
2answers
156 views

Securely render SVG

How can I securely render SVG documents in a media sharing application? I think the same-origin policy might help a bit if I host the SVG documents on a separate domain and render them inside an ...
3
votes
2answers
1k views

Do any web browsers create cached copies of local HTML files?

Suppose that we create a sensitive file as a HTML document, and then view that file with a web browser such as Firefox, or other. Is it possible that the file is treated as if it were a document ...
3
votes
2answers
572 views

Accessing keystrokes directed at iframe?

So I was making a virtual credit card from entropay.com and when I decided to Top up it up with my existing debit card. It opened up the 'Verified by Visa' page(A page in which you have to enter a ...
39
votes
8answers
2k views

Is the Web browser status bar always trustable?

If I bring the mouse pointer to a link, but not click on it, I can see in the left/bottom corner that it displays the URL of it. Q: Could this URL (in the left/bottom) be different from the one that ...
-1
votes
1answer
3k views

Is Opera spying on its users when traffic conpression is enabled?

Correct me if I misunderstand the following quoted paragraphs, but basically to compress something it must be decrypted first. This seems to be the claim of the article but I don't see this as true. ...
7
votes
3answers
2k views

Are Web Views in android secure?

"Web Views" are views that display some online content, usually a webpage within an android app. Implemented "Web Views" usually don't seem to have any kind of status bar or an address bar to confirm ...
1
vote
1answer
552 views

Secure browser storage

Where is a secure place to store a "secret" in a web browser that a User has access to and JavaScript does not? Thinking was along the lines of web history, bookmarks, built in password manager & ...
7
votes
2answers
1k views

Browser based virtual machines

How would applying hypervisor (e.g. xen) principles in the development of a web browser offering isolated browser tabs (virtual machines) improve or reduce security of existing web applications (good ...
0
votes
2answers
212 views

Why do browsers leak their version info to the webserver?

The question surmises it all. If my firefox browser puts something like "..Gecko/xxyy Firefox/nn.mm.." in the USER_AGENT attribute, then from security point-of-view, isn't it an open invitation to the ...
1
vote
3answers
2k views

How can this web page access the USB? [closed]

A friend bought a "smart" headset (working with voice commands). I had to install a software on Windows to be able to configure this headset. After downloading the software from the page, this page ...
2
votes
1answer
343 views

Twitter.com in private browsing leaks data to normal browser. Other sites as well? Bug or feature?

This is the first time I encountered similar thing. When I log into the Twitter web site in Chrome (namely, the Iron version which is said to be security enhanced, but that does not matter here) in ...
0
votes
1answer
117 views

What are the risks of uploading and downloading data in binary (non-encoded) format to servers and browsers?

I admit up-front that this question may be the result of unfounded paranoia. But I am concerned that uploading and downloading data in binary form opens the door to exploits that might not be ...