A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

learn more… | top users | synonyms (2)

12
votes
7answers
1k views

How to browse the Internet safely?

What is the best way to browse the Internet safely? By safely I mean: anonymously having encrypted communication Extra bonus for: being able to do it with little or no performance impact cheaply ...
4
votes
1answer
681 views

SSL, SSH, OPENVPN, etc which one?

To start with I am not a security professional, in fact I am on the other end of the spectrum. In the opinion of people on this site what would you choose for secure internet browsing. I will be ...
17
votes
3answers
5k views

Google Chrome Browser - Privacy Concerns

After i saw many people using Chrome i wanted to inform myself on this browser and everything concerning it as i am a Firefox user since it existed. However i am always afraid of Google being a "data ...
7
votes
3answers
289 views

Detecting OAuth malicious Implementation

I am wondering how can an end-user detect a maliciously implemented OAuth whether 2-legged or 3-legged. Particularly I am interested in those cases where the consumer requester is maliciously ...
8
votes
5answers
4k views

Is finding vulnerabilities in the major browsers easy or not?

If young hackers can detect them, why can't security analysts get and patch them? Also, I dream of finding a vulnerability in a major software, like IE or Chrome. Is it easy? Is it systematic or is ...
3
votes
1answer
252 views

How can I assess the trust worthiness of a browser add-on?

Having learned a bit more about what add-ons/extensions can do in Firefox, I want to minimize my risk and use some safer mechanism to download videos (FLV in particular) for later viewing. ...
9
votes
4answers
2k views

Web browser password management security [duplicate]

Possible Duplicate: How are browser saved passwords vulnerable? How secure are the password managers that are built into modern web browsers? Currently I use lastpass plugin as I believed the ...
3
votes
1answer
1k views

Zone elevation protection in Google Chrome

Internet Explorer has a security feature called "Zone Elevation Protection", in which sites outside a list of trusted sites (which can be configured) are not allowed to navigate to the ones on the ...
14
votes
2answers
1k views

Can a Firefox add-on or plug-in access the user's websites' saved passwords in decrypted mode?

Going deeper into the previous question on Firefox plugins and add-ons malware risks: Could a Firefox add-on potentially decode and capture the encrypted websites' passwords saved in the browser?
17
votes
6answers
2k views

What are the security implications of people downloading addons, wrongly thinking that they are safe?

I recently learned about a plugin for Firefox called Fire Sheep, which was featured on the Security Now podcast. I downloaded F.S. and began examining it. To my surprise it includes C++ code that must ...
12
votes
1answer
2k views

SSL TLS renegotiation vulnerability - current situation in clients

Reading about the SSL renegotiation problem CVE-2009-3555 one knows that servers supporting old type of renegotiation are vulnerable to data injection. We also have tools to test them (openssl ...
-1
votes
4answers
236 views

What is the validity of the article which claimed that IE is more secure than Chrome? [closed]

What is the validity of this article which claimed that IE is more secure than Chrome?
14
votes
4answers
966 views

Unknown malware, how to report it and whom to report it to?

I'm a professional Windows system administrator, but I've been caught off-guard (or maybe some malware writer has been very clever) and I caught some unknown malware on my home computer (Windows 7 x64 ...
4
votes
4answers
272 views

Attack where browser URL appears valid

I remember reading about an attack where the "location bar" in a user's browser displays a valid URL (e.g. https://www.paypal.com/), but the traffic is really being directed to or intercepted by an ...
3
votes
2answers
1k views

List of web session attacks and counter measures

I'm writing a new website in PHP and I will be using cookies to track user session data. Before I finalize the design, I want to make sure that the site is not vulnerable to attacks. I have written a ...
25
votes
3answers
3k views

NoScript: How to determine which sites/scripts to whitelist?

NoScript is a great plug-in, both for security and for ad blocking. However, I've found it's not always easy to figure out what scripts need to be permitted on certain pages, to be able to use the ...
3
votes
3answers
174 views

Warn about specific CA in Firefox

Consider a setup where all HTTP/HTTPS traffic goes through a proxy. The certificate of this proxy must be trusted by all browsers (in this case, Firefox). This certificate replaces the original ...
13
votes
5answers
3k views

Solution to allow JavaScript input but prevent XSS

We have a simple Blog system that allows users to input html and JavaScript to build a blog page. I'm aware that allowing javascript open up the door to xss attacks. We do however need to allow users ...
1
vote
1answer
612 views

Firefox Desktop Shortcut Being Renamed

On my Vista PC the Firefox shortcut icon is being randomly renamed. The name changes to some variation of a recently visited URL. This unwanted action has survived several version updates. Of course I ...
6
votes
3answers
3k views

How can a “server” know that what browser i'm using besides the user-agent?

How can a "webserver" know (or a sniffer between the srv<->and the client) that what browser i'm using besides the user-agent? Are there any "magic tricks"? javascript? java? How can I securely, ...
13
votes
3answers
1k views

Elaborate websockets security

I'm interested in learning more about web sockets security. Read that web sockets were originally in Firefox, removed for security reasons and now added back in with the problem resolved: http://news....
14
votes
1answer
799 views

Are there any security problems with Google false start for TLS?

Google recently announced false start in Chrome browsers which increased TLS performance by 30% http://news.softpedia.com/news/Google-Chrome-s-SSL-False-Start-201253.shtml I know TLS has been poked ...
12
votes
4answers
2k views

Why isn't OCSP required by default in browsers?

According to the following screenshot, taken from firefox-3.6.17-1.fc14.i686, Firefox has an option to fail closed when unable to connect to OCSP servers. Can someone please explain why this isn't ...
7
votes
2answers
618 views

Firefox Add-ons not using HTTPS? Security bug. (?)

If I add a rule in Privoxy: echo '{ +redirect{s@http://@https://@} } .mozilla.org' >> /etc/privoxy/user.action then I can't install Firefox Add-ons. Why? I though the Firefox Add-ons ...
7
votes
4answers
694 views

What abuses can an infected webpage do to me if I'm using Chrome and Flash is disabled

as a follow-up to this question Can you get virus just by visiting a website in chrome., I've read these pages: http://www.straightsectalk.com/?p=47 http://www.vupen.com/demos/VUPEN_Pwning_Chrome....
32
votes
3answers
53k views

Can you get virus just by visiting a website in Chrome?

I've recently read Google Chrome: The End of Drive-By Downloads. Is it true to say that drive-by-downloads are history in Google Chrome? So if I have a link (from a spam email) I can right-click >> ...
7
votes
1answer
965 views

Access to other local files from a local HTML file

I tried this question on programmers site with no luck Do you see any reason to block a local html file from accessing another local files located in the same folder? I mean, if a user downloaded an ...
7
votes
5answers
5k views

Browser hijacked - how to fix and prevent?

For the second time in a month, my work PC has been infected with malware that is hijacking my Google search results in Firefox. A search for the URL hijacked searches end up at turns up nothing on ...
16
votes
4answers
1k views

How are browser saved passwords vulnerable?

Most browsers offer to save the password after entering it on many logon pages. What types of vulnerabilities are there for such saved passwords. I'm interested in what ways malware on web pages ...
37
votes
2answers
16k views

What malicious things can happen when clicking on links in email?

I've received a spam from one of my friends (well I'm sure he didn't send it). so there's this link, and i'd thought what exactly would be the implications of clicking the link (i've not clicked it ...
4
votes
4answers
626 views

Is flash or javascript a bigger security concern? [closed]

Many flash website whitelisting extensions for chrome (such as flashblock and flashcontrol) use javascript in order to selectively block Adobe Flash from functioning. Thus, In order to get this ...
2
votes
1answer
314 views

How to tell if Firefox Home (iOS) is using Data Protection API?

The source code is here: http://mxr.mozilla.org/services-central/source/fx-home/ What should I be looking/search for? Or even how to extract /ffhomeDB.sq3 and see what it contains.
8
votes
2answers
2k views

MIME sniffing protection

As it is known, older versions of MSIE (before 8) have a nasty habit of treating images as HTML if they "look like" HTML, which can lead to nasty vulnerabilities for sites that allow people to upload ...
22
votes
4answers
3k views

Why doesn't the client's web browser need to be PCI compliant?

A hypothetical online store that accepts credit card payment will have to be PCI compliant because it receives (transmit), process and possibly store credit card numbers. But the client's web browser ...
5
votes
3answers
468 views

Is Content Security Policy an approach that is worth to support?

Mozilla Firefox 4.0 supports something called Content Security Policy that disables the interpretation of embedded Java Script. Only external Java Script files that are referenced using a script tag ...
5
votes
7answers
473 views

Malicious Websites

Just wanted to get everyone's opinion on this. In Information Security, you get various alerts about particular machines on your network going to sites and/or IPs that have been flagged as "malicious"....
12
votes
5answers
2k views

Is clipboard secure?

Can a browser get the data on my clipboard? Data could be for example my temporary password? Any browser or operating system that allows this?
4
votes
3answers
2k views

sslstrip vs. privoxy redirect rule on clients

I watched this video: http://www.securitytube.net/video/193 Now I'm thinking about an example. Suppose I have a privoxy proxy on my PC: user.action file (just part of it): { +redirect{s@http://@...
18
votes
5answers
2k views

Different strategies for online anonymity and their +/-s?

I saw this question about anonymous web browser, but I wanted to go a little bit more in depth. I prefer answers that take into account how a connection would be traced back, time it would take to ...
6
votes
2answers
268 views

plugins to lengthen short urls for security purposes

Came across this question What browser plugins can help us to see the actual destination of such shortened URLs?
18
votes
4answers
7k views

Options when defending against SSLstrip?

I'm wondering, does anyone have any suggestions to defend against SSLstrip particularly?
0
votes
2answers
412 views

What browser plugins (ActiveX, or those for Chrome/Firefox/Safari etc) pose the most risk for your company?

I'm looking for a list of risky browser plugins that we should prevent their use on the desktop. It's probably safe to assume that old versions of Flash are on the list, but what versions? What ...
2
votes
2answers
397 views

Protecting websites from outdated browsers and plugins via a whitelist/blacklist combination?

Aside from using browser headers, I want to blacklist/whitelist browser and plugins from my site so that I can prevent these older unpatched systems from (1) being a general user of my site (2) ...
6
votes
5answers
346 views

What's the real reason behind blocking the social sites? Even legitimate sites like Twitter which acts as a knowledge repository?

I see some sites are blocked for IT security at schools, colleges and offices. But, why are some obvious good sites blocked too?
5
votes
1answer
309 views

How much protection does the Kill-Bit provide for ActiveX controls?

I have some ActiveX controls that are not supposed to run in the browser but only in my particular Front-End. I know that by setting the Kill-Bit I disable their execution in Internet Explorer and MS ...
60
votes
9answers
32k views

Is visiting HTTPS websites on a public hotspot secure?

It's often said that HTTPS SSL/TLS connections are encrypted and said to be secure because the communication between the server and me is encrypted (also provides server authentication) so if someone ...
35
votes
10answers
11k views

Is anybody using client browser certificates?

Client browser certificates seem to be a nice way to protect sites from intruders - it is impossible to guess and should be harder to steal. Of course, they do not solve all the problems, but they add ...
93
votes
6answers
17k views

How much can I trust Tor?

How much can I depend on Tor for anonymity? Is it completely secure? My usage is limited to accessing Twitter and Wordpress. I am a political activist from India and I do not enjoy the freedom of ...
17
votes
6answers
3k views

Anonymous web browser. Is it real?

Do anonymous browsers work? What principles do they use? Can I use them to test access to my web site? Can I detect if a visitor is using one? What is the different between traditional and anonymous ...
5
votes
3answers
358 views

Strategy against browser exploits on Windows?

On a friend's computer is some kind of spam bot installed. It sends messages like Hello: I received my apple iPad 32GB ordered on an online shop (www.elevalley.com ) today. So exciting ,...