A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.
1
vote
2answers
1k views
Error code: sec_error_untrusted_issuer
I need help with a security issue concerning this code that has just been popping up recently as I visit my favorite websites. Based on some past history I KNOW something is not right, and I am not ...
2
votes
1answer
104 views
What is the “derive” key usage?
Google Chrome gives a lot of SSL information. Here is a screenshot:
Under "Key Usage", what does "Derive" mean?
4
votes
4answers
323 views
Is online banking more secure on iOS than a desktop computer?
Does Apple's iOS provide a more secure environment for online commerce (banking or shopping) than Windows or Mac OS X? Since the only software that can run on iOS must be vetted by Apple, the ...
2
votes
2answers
355 views
How does the Yahoo webmail exploit work?
I got an email (referring to me by name) from somebody I knew a while ago and the email itself was just two/three lines containing a bit-ly link. Although it seemed like it actually could be ...
13
votes
4answers
868 views
Should sensitive data ever be passed in the query string?
Should sensitive data ever be passed via the query string as opposed to the postback? I realize that the query string will be encrypted, but are there other reasons to avoid passing data in the ...
1
vote
2answers
84 views
Do XBAP applications have the same vulnerabilities as Java Web Apps?
In response to the popular decision in disabling Java Web Apps, there has been very little mention of XBAP applications.
XBAP applications are similar to Silverlight but it offers more options to ...
3
votes
1answer
175 views
How dangerous is a virus introduced to a malicious website in chrome?
I am using Google's Chrome browser under Linux (Ubuntu) 64 bit for web browsing.
If I a virus uses for example a leak in the flash player, the virus will get the privileges of the user who started ...
1
vote
2answers
203 views
How is it possible that a virus can infect the system if the browser is started with non-admin rights
If I open my web browser (for example firefox) in Windows 7 with activated UAC as normal user (non admin) a virus - which uses a security leak in my browser - will only gets privileges of the normal ...
2
votes
3answers
198 views
How hard it would be to infect a system with malware through a portable web browser
If I use a portable web browser on a USB device like
Google Chrome Portable how hard it would be to get infected by a malware/virus in the system to which the USB device is connected?
Google Chrome ...
1
vote
2answers
333 views
HTTP Response Splitting
Is this apart of a HTTP Response Splitting attack ? Here below is some code that gets put into a web browser after clearing the url while on the website
javascript: var xhr = new XMLHttpRequest(); ...
0
votes
2answers
143 views
Is a browser with disabled scripts and disabled java enough against malware
Is a browser like Firefox with disabled scripts (for example via a plugin like no-script) and disabled java enough to be protected against dryve-by-malware from the internet.
Of course this does not ...
0
votes
1answer
119 views
Hardening Web Browsers - Detailed Guidance
Is there any specific and complete guidance on what is needed to harden a web browser given the number of attack vectors possible, particularly given that browsers allow so many varied plugins?
All I ...
8
votes
2answers
1k views
Will disabling the Java add-on in IE protect you from Java exploits?
Concerning the recent Java vulnerability (Should I be disabling Java?), the most common advise seems to be to disable Java plug-ins in the browser.
However, Heise Security suggests that, when it ...
3
votes
1answer
147 views
Is this a security flaw in Firefox 18.0?
I had a couple of .mht files which opened in IE, a browser I hate and had stopped using 5 years ago. I renamed their extension to .HTML to run it in FF. When i opened the file in FF, FF created new ...
2
votes
3answers
3k views
Browser security - Firefox + NoScript is better than Google Chrome?
I saw that NoScript + Firefox combination blocks all "dynamic content" (especially those spammy ads). I really like that. It reduces the chances of being exploited.
But, chrome only asks me to allow ...
0
votes
0answers
66 views
Client Side Negotiation
I have -MultiViews set and SSLInsecureNegotation off ( in ifmodule of mod_ssl.c) in Apache.
But still vulnerability report says I am vulnerable to client side renegotiation and "This server is ...
1
vote
4answers
889 views
Playing with Referrer Header
There are 2 sites:
http://www.site1.com
http://www.site2.com
http://www.site1.com contains link to http://www.site2.com as
<a href="http://www.site2.com/">link<a/>
When user clicks ...
10
votes
4answers
621 views
Security measures against packet sniffing
I work in a environment where packet sniffing can be easily done . I was worried about my confidential data . Please suggest how is it done and precaution which i can take at client level.
3
votes
1answer
94 views
How safe is “trust this computer” option for websites?
Many sites have a "trust this computer" option that allows one to bypass some security measures (ex.: with Google's 2-step authentication enabled, one does not need to enter the phone's code if the ...
1
vote
1answer
46 views
How can I use many LiveIDs (or Microsoft Accounts) at the same time? [closed]
I use several sites under a different "LiveID" / Microsoft Account and need to use the following under different identities
Windows Azure Management Portal
Outlook.com
MSDN Forums / Technet
...
1
vote
1answer
216 views
IE on Windows 2012 doesn't show certificate or lock icon despite using HTTPS
Can anyone explain why IE on Windows 2012 doesn't show the lock icon despite using HTTPS when visiting the following site?
https://www.microsoft.com/en-us/default.aspx
I am able to see the lock ...
2
votes
1answer
232 views
What OID Issuance Policies are appropriate for SmartCard and Browser Certificates?
I'm investigating issuance policies for SMIME and Browser certificates with different levels of assurance.
For the purposes of S/MIME and Browser certificates, should I even use an assurance policy? ...
11
votes
3answers
432 views
URL Shortening - How to verify if it is a non-malicous URL?
Again, I must mention that I have just started to learn about security. So, please bear with my newbie questions.
If I receive a shortened URL from somewhere, say in an my-email or in a social media ...
1
vote
1answer
129 views
How do I verify, parse and process the results of the HTML5 keygen tag?
I'm investigating the HTML5 attribute Keygen and discovered that it sends this data on a Form POST to the server. Here is an example POST:
...
2
votes
3answers
222 views
How can I protect my browser from being compromised?
In enterprise environments, I have found great benefit to use binary white-listing, web security gateway and end-point AV to help protect the end-user/system. Unfortunately, I still see the browsers ...
0
votes
1answer
50 views
Can IE be made to imitate the behavior of Chrome's KeyGen element?
Is there any way I can repurpose existing ActiveX controls or functionality to get IE to work with the KeyGen element?
Assistance getting Safari to work with this optional HTML5 spec would be ...
1
vote
3answers
314 views
Do client certificates provide protection against MITM?
I'm looking for a way to protect clients from a MITM attack without using a VPN, and ToR. My thought is that client certificates might do the job, but I'm not entirely sure since not too much server ...
10
votes
1answer
367 views
How can I embed iframe securely without restricting its functionality?
I'd want to embed an iframe from untrusted site into web application. Iframe:
should be able to run Javascript and browser plugins (Flash, etc.)
should not be able to access my web application ...
8
votes
2answers
124 views
Preventing user supplied javascript from posting to external server
I am writing an internal tool that will support plugins written by other developers. Ideally, these plugins would have a Javascript component to allow people to make widgets. Some of the pages these ...
3
votes
1answer
103 views
How can I use certificates to secure my webservices? What is available to javascript?
I have a few web services that are accessed over public wifi connections and I think it would be a good idea to issue certificates to encrypt data, prevent MITM, and invalid impersonation (beyond what ...
-5
votes
2answers
136 views
What technologies are recommended for E-banking? [closed]
If a Linux user need use his bank account from Internet, then what technologies and procedures should use?
Is better to use the Guest Account (if exist) of the OS, or an Administrator Account?
What ...
7
votes
1answer
401 views
Have any viruses leveraging the GPU been discovered in the wild? What is the mitigation?
This news article from 2010 discusses how a GPU can be used by a virus to avoid detection by common anti-malware/anti-virus software. The idea is to obfuscate the virus payload and leverage the GPU's ...
4
votes
3answers
162 views
Are there guidelines for application design of HIPAA compliant browser applications?
This is a different twist - I'm pushing dispatch information to first responders, such as fire, police, and EMS. But they all could, potentially, include medical information and PII together.
My goal ...
3
votes
1answer
68 views
Possible to redact information in the clipboard, or to auto-redact when it hits a webpage?
Sometimes when I paste information to a website I realize after I post the information that I inadvertently included an IP address, username, email address, or other information I'd like to consider ...
5
votes
1answer
245 views
Same-origin policy for file: URLs in Android browser?
When you load a file:// URL in an Android WebView or in the Android browser, what does it treat as the origin? What can the Javascript on that page access? Can it access other files in the same ...
2
votes
3answers
209 views
How prevent Javascript from obtaining my location
I usually use a proxy server to browse anonymously. Now I realize that it is possible to find the location of a user using the Geolocation API. How to anonymously browse without disabling Javascript?
3
votes
3answers
365 views
cookies “secure” flag
How does cookies "secure" attr work to determines whether cookie itself should be included?
e.g.
[HTTP(unencrypted) connection]
1. user has no cookie yet and tries to log in;
2. user logs in ...
0
votes
3answers
88 views
Does AV software protect web applications (Twitter, Facebook, etc) from attacks? (CSRF, etc)
Is it correct to say that AV software focuses on downloaded executables and locally malicious activity, and it doesn't actively scan HTTP/S content for web based attacks such as CSRF, XSS, phishing ...
2
votes
1answer
157 views
Updated version of Browser Security Handbook
Google's Browser Security Handbook is a brilliant resource for web application security, and in particular, for understanding how browsers behave. It discusses many issues, and contains tables ...
2
votes
4answers
790 views
What XSS attacks doesn't “Reflective XSS Protection” defeat?
Its been quite a while since I have played with cross site scripting vulnerabilities but today I came across a website today that was crying out to be tested for a basic XSS vulnerability.
So ...
2
votes
1answer
323 views
Is autocomplete=“off” compatible with all modern browsers?
There are a lot of answers on the subject (including some on StackOverflow), but none of them have recent or updated answers: I can't seem to find any documentation indicating which browsers support ...
8
votes
2answers
184 views
User-specific Subdomains : JavaScript security
If I provide a public-facing website for users on my website at their own subdomain (e.g. bob.myapp.com) under their own control, can I allow them to execute arbitrary JavaScript without putting my ...
0
votes
0answers
78 views
Put trusted site in registry [closed]
Group policy prevents users from adding a site in Internet Explorer's 'trusted sites'. Somehow a user (with elevated privlages - that is OK) adds the site via regedit.
Any idea how (where) that was ...
9
votes
2answers
413 views
How to fight browser fingerprinting?
https://panopticlick.eff.org/ , aka "How unique and trackable is your browser". For example it usually gives me a unique score. The biggest entropy values come from navigator.plugins and fonts via ...
1
vote
1answer
134 views
Is truecrypt a good choice to work with file that are generated and manipulated via browser
i'd like to know if Truecrypt is a reliable software for filesystem encryption, at the level of pgp as security level, and if it suitable to work with files that are generate via web browser, so ...
4
votes
3answers
325 views
What are methods for preventing browser hooking / drive-by downloads?
This question may be a bit too broad and open ended, however I'm hoping to get some good advice on this.
With the advent of BeEF and more and more of the computers in networks being infected just by ...
5
votes
1answer
415 views
When and Why does Chrome display malware detection warning?
Google Chrome contains malware detection feature. When user visits some site, browser may display warning that site contains malware.
What does it mean that site contains malware? Does it mean that ...
4
votes
1answer
277 views
Need help on understanding obfuscated code in CVE-2012-4969 exploit
As you may know this vulnerability was found a while ago in the wild and the exploit is available too, btw I'm having problem on understanding the obfuscated code.
Is it necessary to use obfuscation ...
1
vote
2answers
150 views
Can I encrypt the packets that are sent to my router?
Is there a way to encrypt traffic to avoid MITM attacks?
I use Google Chrome. Thank you in advance.
2
votes
1answer
196 views
How did my homepage get changed in IE?
I have rarely used IE in the past. I just use it to test how a website looks. Today all of a sudden when I went on to open IE, it opened with a homepage that wasn't set by me. It was an address of a ...
