A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

learn more… | top users | synonyms (2)

4
votes
3answers
4k views

Do client certificates provide protection against MITM?

I'm looking for a way to protect clients from a MITM attack without using a VPN, and ToR. My thought is that client certificates might do the job, but I'm not entirely sure since not too much server ...
16
votes
4answers
1k views

How are browser saved passwords vulnerable?

Most browsers offer to save the password after entering it on many logon pages. What types of vulnerabilities are there for such saved passwords. I'm interested in what ways malware on web pages ...
13
votes
5answers
3k views

Solution to allow JavaScript input but prevent XSS

We have a simple Blog system that allows users to input html and JavaScript to build a blog page. I'm aware that allowing javascript open up the door to xss attacks. We do however need to allow users ...
11
votes
1answer
11k views

Does Google Chrome protect against cross site scripting (XSS)?

In Firefox I've been using the NoScript extension to protect myself from certain kinds of malware attacks. NoScript is well known as a very powerful extension for Firefox and introduced protection ...
20
votes
2answers
5k views

HSTS extra security over HTTPS

Is HSTS good to use even if my servers are configured to use HTTPS (Even if HTTP is used, the rewrite rules in apache makes it to HTTPS) Also does HSTS make even the resources like CSS, images to be ...
18
votes
3answers
2k views

URL Shortening - How to verify if it is a non-malicious URL?

Again, I must mention that I have just started to learn about security. So, please bear with my newbie questions. If I receive a shortened URL from somewhere, say in an my-email or in a social media ...
8
votes
3answers
11k views

Force a connection via SSL3 to detect POODLE vulnerability

I have been reading up on the POODLE vulnerability. From my understanding, and correct me if I am wrong, you need to allow connections to be made via SSLv3 on the server. The server I am currently ...
7
votes
3answers
5k views

Do browsers allows pages loaded on one tab to access/intercept/inject data in other tabs?

I was surprised to hear from this Reuters video that it was possible for a page loaded on one tab to access and/or inject data onto another page loaded on a different tab. TL;DW (too lazy; didn't ...
29
votes
3answers
16k views

How can a webpage get the MAC address?

I was logged on to my router and filling out some information. I clicked a button and a field was automatically filled in with my computer's MAC address. How is this possible? Does it present a ...
10
votes
2answers
8k views

How to thwart sslstrip attack?

I need help understanding the dynamics of an sslstrip attack. I'm using it to test the security of a site that I own. I can successfully sniff the victim (in this case, myself) credentials over the ...
9
votes
2answers
4k views

How can end-users detect malicious attempts at SSL spoofing when the network already has an authorized SSL proxy?

I'm working on one client's network where they have enabled HTTPS authority spoofing on their proxy. This allows them to effectively perform a man-in-the-middle attack to decipher all outgoing ...
5
votes
3answers
26k views

Can a website still detect my real MAC address even if I use different virtual machine each time I visit the website?

Suppose I use a proxy and a different virtual machine each time I visit a particular website, will a website still be able to detect my MAC address and/or uniquely identify me? Assume that the website ...
15
votes
5answers
2k views

What is the difference between http and https with a self-signed SSL certificate?

A colleague of mine has told me he doesn't see why there is a warning when visiting a HTTPS website with a self-signed certificate saying that the security may be compromised, but there is no warning ...
12
votes
4answers
2k views

Why isn't OCSP required by default in browsers?

According to the following screenshot, taken from firefox-3.6.17-1.fc14.i686, Firefox has an option to fail closed when unable to connect to OCSP servers. Can someone please explain why this isn't ...
6
votes
2answers
2k views

Considering that SRP is better than SSH and Basic Auth, how can it be implemented in a website?

SRP is short for Secure Remote Password protocol, and provides a better way for passwords to be sent over the internet. I've read the information at it's Stanford University home page, the Wiki ...
6
votes
3answers
78k views

HTTPS icon red and crossed out - Chrome browser

What does it actually mean when the HTTPS icon is red and crossed out in Chrome? Does this mean that the site is vulnerable to a Man in the Middle Attack? Is it safe or not?
16
votes
2answers
850 views

Why does rfc6797 say “An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport.”

Why does the RFC prohibit the server from sending HSTS to the client over HTTP? I can see that if a HTTP client responds to that unsecure HTTP response it might cause that site to be inaccessible ...
15
votes
4answers
3k views

TLS 1.0 JavaScript injection vulnerability (BEAST): what to do client-side?

With the alleged SSL/TLS vulnerabilities used by the BEAST exploit, there seems to be a security gap between TLS versions; TLS 1.0 being the problematic one but still the only option for many sites. ...
9
votes
2answers
628 views

RC4 bias protection with padding in TLS

On the answer to my previous question about RC4 vulnerabilities in TLS, Thomas Pornin gave a great answer, in which he said: One way to "fix" RC4, which has been suggested many times, is to drop ...
4
votes
3answers
2k views

sslstrip vs. privoxy redirect rule on clients

I watched this video: http://www.securitytube.net/video/193 Now I'm thinking about an example. Suppose I have a privoxy proxy on my PC: user.action file (just part of it): { +redirect{s@http://@...
4
votes
3answers
431 views

Security of a Windows XP system after April 8th when running the latest Firefox or Chrome

As we all know, Microsoft stops developing security patches for Windows XP very soon. If a bug in the kernel was to be found that would allow an attacker to take control by, say, sending a specially ...
4
votes
2answers
261 views

How do I protect my passwords from WebBrowserPassView?

I just got shocked with what can be achieved with WebBrowserPassView. It basically shows every password I've saved in my browser (Chrome). I guess other users on my PC could get my passwords that ...
2
votes
2answers
400 views

Protecting websites from outdated browsers and plugins via a whitelist/blacklist combination?

Aside from using browser headers, I want to blacklist/whitelist browser and plugins from my site so that I can prevent these older unpatched systems from (1) being a general user of my site (2) ...
8
votes
5answers
3k views

What do the various browser “private modes” do?

Recently there has been some disagreement as to what "private mode" means when it comes to various browsers. Primarily I am referring to... IE's "InPrivate Browsing" Google Chrome's "Incognito ...
5
votes
1answer
297 views

What issues might exist with TLS-OBC's emulation of Browser Certificates?

TLS-OBC is an RFC proposal that increases SSL/TLS security by using certificates on both ends of the TLS connection. What's special here is that the client is permitted to dynamically create a local, ...
4
votes
1answer
463 views

Why does sslstrip+ fail to intercept the traffic from websites like facebook and gmail?

I have been reading an article about sslstrip and mitm. Before the introduction of HSTS it was possible to strip ssl and send an insecure http page to the victim. Anyway it was overcome by using HSTS ...
2
votes
3answers
147 views

Is it possible for a virus to be downloaded unknowingly and run when a website is opened?

Usually, the only time I see viruses happen is when someone mistakenly runs an infected file. But could one also be infected by just visiting a website?
1
vote
1answer
141 views

What browsing history exactly would police have under proposed UK law change? Plain english

It's very unclear what '12 months' browsing history being kept by network provider' actually means to an uninformed person. Thunderbird? VPN? Startpage searches? Bit-torrent downloads? Epic browser (...
1
vote
1answer
318 views

How to check whether a link is safe or not? [closed]

I've been working on a task to find threats in a social network called Skyrock. For which, I've managed to retrieve a significant amount of URLs by crawling various user profiles and parsing the data ...
0
votes
1answer
1k views

Defeating Browser Fingerprinting by spoofing the browser user agent and VPN

I don't want any website to identify me and to know what is my geographical location. As far as a website is concerned, I am always a new visitor who never visits it prior. If I leave the website, ...
213
votes
5answers
14k views

Is the save button delay in a Firefox download dialog a security feature? What does it protect?

When I click to download a file through Firefox, a dialog window appears asking me whether I want to save the file somewhere or open it immediately once downloaded. The OK button in the dialog ...
37
votes
4answers
54k views

Why is passing the session id as url parameter insecure?

I recently followed a discussion, where one person was stating that passing the session id as url parameter is insecure and that cookies should be used instead. The other person said the opposite and ...
24
votes
9answers
9k views

Is encryption in HTTPS done by the browser or by the system?

This may be a common sense question, but I am not able to find any documentation on this after searching on google for a long time When browser makes a HTTPs request, does it encrypt the data then ...
44
votes
12answers
7k views

Why should I care if a site uses encryption or not if I'm not exchanging any sensitive data? [duplicate]

Lots of sites these days, that don't deal with sensitive data, enable encryption. I think it's mostly to make (paranoid?) users feel safer. In cases where there is a user's account being logged in, ...
8
votes
4answers
32k views

Advanced techniques for detecting a proxy/getting original IP

In what manner can a website detect my original IP address, even though I'm using a proxy server? I've noticed this with a few sites. There are four proxy methods I've used: Firefox with a proxy ...
31
votes
3answers
27k views

Why is 'avast! Web/Mail Shield Root' listed as CA for google.com?

I just noticed something weird in my browser: the certificate for www.google.com has been issued by avast! Web/Mail Shield Root. Should I be worried? I am using avast! Antivirus so it's probably a ...
24
votes
6answers
7k views

How can I prevent tracking by ETAGs?

An ETAG is a HTTP header that is sent-behind-the-scenes between a web browser and an web server. This value is intended to control how long a particular file is cached on the client side. There is ...
22
votes
4answers
12k views

Should sensitive data ever be passed in the query string?

Should sensitive data ever be passed via the query string as opposed to the postback? I realize that the query string will be encrypted, but are there other reasons to avoid passing data in the ...
12
votes
2answers
645 views

What should I look for when auditing a Firefox extension / plugin?

I've been asked to do a security audit on a Firefox add-on developed by a third party. I am a web developer with a reasonable grasp of JavaScript but am not a browser security expert. What kinds of ...
21
votes
4answers
4k views

Why does Facebook serve several SSL certificates?

Facebook seems to be alternately serving two SSL certificates, one from DigiCert and one from VeriSign. There are only two reasons for this that I can think of: They're in the middle of a ...
8
votes
5answers
2k views

Websites that interactively test browser security (XSS, CSRF, Javascript, etc)

I'm looking for a comprehensive list of browser test sites so that I can visually prove that the browser is patched and configured for safe web browsing. My intent is to know what risks may exist ...
10
votes
2answers
4k views

Are there any statistics about webservers and browsers TLS support?

From Hackers break SSL encryption used by millions of sites: The vulnerability resides in versions 1.0 and earlier of TLS, or transport layer security, the successor to the secure sockets layer ...
7
votes
3answers
5k views

SQL Injection How to inject Clean/Rest URLS

I have a question I'm hoping you could help me with? Unclean url's: http://example.com/index.php?page=foo http://example.com/products?category=2&pid=25 http://example.com/index.php?mod=profiles&...
1
vote
1answer
669 views

Understanding Same origin policy

I am trying to understand same origin policy better. From what I understand same origin policy restricts code from one "origin" not access data from another "origin". What I am trying to understand is ...
24
votes
1answer
4k views

Why would the BBC web site always ask for a personal certificate, and how do I avoid giving it away?

After installing a CAcert personal certificate, every time I land on the BBC weather site it asks me to identify myself with a certificate. Why would any non-malicious web site do that unless I've ...
15
votes
6answers
14k views

Why are iframes allowed at all in modern browsers?

I read a number of IT security blogs (though I'm no security expert), and it seems a significant percentage of exploits in the wild are delivered through adding malicious iframes to a hacked website, ...
12
votes
5answers
16k views

Benefits of identifying clients based upon the “X-Forwarded-For” or similar HTTP header in addition to Client IP

The X-Forwarded-For header is used by some HTTP proxies to identify the IP address of the client. The wiki page (linked above) mentions that ISPs may use this header as well. In addition there are a ...
8
votes
3answers
746 views

Why do Firefox and Chrome “leak” critical security information out of the browser and how can I stop it?

In studying SSL / TLS handshakes and encryption, I found a method that describes how to export the SSL / TLS session keys from Firefox to an user or environmental variable outside the browser, and ...
7
votes
3answers
4k views

How to sandbox Iceweasel (Firefox) on Debian? [closed]

Are there any tools for sandboxing Iceweasel (Firefox) on Debian systems? I'm mostly interested in tools distributed by Debian. (An equally trustworthy source would be second best.) (I suppose that ...
4
votes
2answers
3k views

Does Java applets reveal the real IP address, even when using proxy or vpn?

Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?