A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

learn more… | top users | synonyms (2)

3
votes
0answers
65 views

Secure a server on `localhost` such that only the authorized users can connect

Consider an application (such as an IPython notebook) that runs an HTTP server, and that (by design!) allows arbitrary code execution by authenticated users (this is the entire point of IPython, ...
0
votes
1answer
102 views

Why does Safari still support SSL 3?

The "POODLE" attack was made public in October, 2014. Why does Safari still support SSL 3.0 after POODLE showed it to be insecure?
0
votes
1answer
51 views

Alternative to Avast Safezone for banking

Apparently low level keyloggers etc can intercept typed details before Safezone keylogging protection kicks in. Would BD Safepay avoid this problem with its enforced virtual keyboard ? Or perhaps ...
2
votes
1answer
30 views

Security Protocols for a Blog [closed]

What are some security protocols that I should be aware of when starting and running a personal blog? I am steering away from WordPress and will another hosting service. The blog will mainly just be ...
0
votes
1answer
93 views

Is WebRTC safe for connecting random clients to each other?

I am trying to implement a chatroulette-sque app, and WebRTC seems to be the best choice as far implementing something that doesn't take a vast amount of server resources. My current scheme is to ...
-2
votes
1answer
81 views

Clicking a lot of website links in Google Maps, then sent through multiple URL redirects, and lastly to a page that made my laptop start beeping?

I was in Google maps clicking on all the website links listed in the side panel, looking at every website really fast. Note, they were all tattoo parlors. One of the links I clicked bounced me through ...
2
votes
2answers
127 views

Security feature: Preventing javascript from closing the window

The latest versions of most web browsers have implemented a feature to prevent javascript from closing current window or tab. Firefox window.close() method This method is only allowed to be ...
4
votes
2answers
246 views

How do I protect my passwords from WebBrowserPassView?

I just got shocked with what can be achieved with WebBrowserPassView. It basically shows every password I've saved in my browser (Chrome). I guess other users on my PC could get my passwords that ...
1
vote
0answers
48 views

Have there been any known “in the wild” exploits of any Google Chrome (Android) 40.0.2214.89 vulnerabilities?

https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-15031/version_id-179594/Google-Chrome-40.0.2214.89.html I looked for any news about them and couldn't find anything. Anyone ...
0
votes
2answers
104 views

Malware or viruses by browser redirects?

Recently was browsing and clicked on a link to the following address: (In code blocks so you cant accidently click it) http://paycheck-calculator.org/ Clicking on this quickly loaded 2-3 different ...
2
votes
1answer
79 views

Is JavaScript needed for browser code execution vulnerabilities?

Does JavaScript VM have to enabled in a vulnerable browser to exploit an arbitrary code execution bug? There is a number of bugs in borwsers that don't seem to involve JavaScript. For example, CVE-...
4
votes
2answers
188 views

Certificate Chain - intermediate and root certificate - installed required?

Recently I bought a SSL cert from comodo for my domain - orakoha.com After submitting the CSR etc, domain control verification etc, I am issued with a zip file containing 4 document which I believe ...
1
vote
1answer
51 views

Rightscorp Scaleable Copyright - How would they avoid making this a massive security risk?

I recently read an article about a new copyright protection system that RightsCorp America is trying to get ISPs to help implement. From the Article: “Single notices can be read and bypassed ...
3
votes
0answers
62 views

How safe is WebCryptoAPI these days?

The 1Password Tool (software) introduced the 1Password for Teams. Now I thought this is a great peace of Software. But now they can show Passwords in the Browser. They do say: We encrypt ...
2
votes
1answer
42 views

Malicious link? Apache?

I've got a link from spammer, the link is very strange, but after redirects I got the web page full of ads. Here is the link(doesn't require "http://"): /0xD805A9E4///RLI=590-UI=273411771-OI=6313-...
21
votes
2answers
3k views

Can javascript execution from address bar cause any harm to client's machine?

Given the fact that modern browsers these days prohibit JavaScript from having access to any resources on the client's machine, does JavaScript execution from the address bar pose any threat at all to ...
0
votes
2answers
96 views

Is it possible to hide malicious code within/behind an image? [closed]

Is it possible to hide malicious code either within an image, or behind it as it is displayed on a webpage and then if the user saves this image, they actually are downloading the malicious code? ...
1
vote
1answer
60 views

How to distinguish malware from system crash?

Recently, I browsed to a website, which appeared to consume all the computer's resources. Although the mouse cursor continued to move, the browser (and other applications) slowed down fast and soon ...
213
votes
5answers
14k views

Is the save button delay in a Firefox download dialog a security feature? What does it protect?

When I click to download a file through Firefox, a dialog window appears asking me whether I want to save the file somewhere or open it immediately once downloaded. The OK button in the dialog ...
2
votes
0answers
140 views

How to enable ECDHE in openjdk-1.8.0 in CentOS 6.7?

I have seen many posts that hinted ECDHE is available in the SunEC provider way back in openjdk-1.6.0. My environment: CentOS 6.7 with openjdk 1.8.0.71-1.b15.el6_7. No ECDHE. Made 2 changes in jre/...
3
votes
2answers
78 views

Internet browsing confidentiality [duplicate]

I wonder how easy or difficult it is to find out who I am, using information security's most advanced techniques. And what can I do that will not affect my browsing experience too much, as a lambda ...
0
votes
1answer
35 views

security in the browsers - broad questions [closed]

I'm working on security project in the browsing field but I am confused about some points. What does "security in browsers" mean? Is it all about secure connections or there are other aspects? How ...
3
votes
1answer
84 views

How can I test a domain that I don't own for unencrypted communication vulnerabilities?

I am suspecting a website of passing clear text login information and so far as I can tell the connection is unencrypted. Are there web-based tools to validate/test a website for basic security ...
-1
votes
1answer
63 views

Does this website contain a drive-by download? [closed]

Like others, I am not really sure if drive by downloads can actually happen. I was given a website with a bit.ly link today. I visited it and then immediately closed it. These are what I have done so ...
2
votes
3answers
143 views

Is it possible for a virus to be downloaded unknowingly and run when a website is opened?

Usually, the only time I see viruses happen is when someone mistakenly runs an infected file. But could one also be infected by just visiting a website?
0
votes
2answers
53 views

chrome invisible flash document

I have it so flash doesn't start on page load for security and performance. Lately I have been noticing That some pages will load with a flash document that takes up the full screen. I can see it as ...
-5
votes
1answer
60 views

Adblock browsing history security [closed]

A lot of people use adblock. From a security aspect, ad blocking would involve intercepting and parsing HTML contents and URL's. Hackers attacking adblock servers could gain access to that valuable ...
3
votes
2answers
77 views

How do I tell the difference between a fake “problem loading page” and a real one?

We know that due to numerous reasons, a browser will display a page like "Problem loading page" or "This page can’t be displayed." But there's one huge problem: browsers seem to show this error page ...
1
vote
0answers
70 views

Force Browser to not URL encode specific chars [duplicate]

I try to get a XSS to work but the problem is, that the XSS is only working within BURP because there I can send for example '>' as an not URL encoded String. As soon as I try it in the browser, it is ...
5
votes
4answers
79 views

Would an official <disablescripts> HTML (6?) element/wrapper combat XSS effectively?

Would it not be possible to use such a method to wrap areas where user input/output is expected (eg. comment boxes), so that even if a script is successfully injected through regex evasion, the script ...
1
vote
1answer
157 views

What does browser do when it queries xxx.example.com and it gets a certificate for yyy.example.com(top level domain is same)?

The question is actually about what level of validations browser does when it gets certificates of some other domains like case 1: Accessing abc.google.com and got def.google.com case 2: Accessing *....
2
votes
1answer
72 views

Differences between Burp request and Browser - Has different responses

So I was put on an engagement over the last week and I found a potential XSS when using Burp's intruder/repeater. However, the strange thing that I noticed was that the response in Burp is different ...
41
votes
5answers
5k views

What's the danger of having some random, out of my control, JavaScript code running on my pages?

My website pages reference some JavaScript code from a third-party CDN (analytics, etc). So I don't control what code is there - the third party may change those scripts at any moment and introduce ...
0
votes
1answer
124 views

Safari not showing GREEN lettering for EV SSL

I've recently installed an EV SSL cert on my server, Chrome and Firefox show a green banner and padlock denoting the EV cert is installed, but in Safari, it just shows a gray padlock... is there ...
4
votes
1answer
88 views

What techniques do advertisement companies use to get my browsing information, and how can I stop them?

In the past year, I've noticed a strangely increasing incidence of advertisements on various web sites being for products that I was browsing for elsewhere. This makes me extremely uncomfortable. It ...
6
votes
2answers
142 views

Malicious user inflicting XSS attacks appears to be on my own network

I have a live Django project where I'm using nginx as a reverse proxy with gunicorn as the application server. It's a fairly new project and isn't SSL enabled yet. There's a user on this project who's ...
1
vote
1answer
91 views

Benefits of injecting antivirus inside browser

Some antiviruses propose you to use their browser plug-ins. For instance, Avast SafeZone propose you reactive defend by checking signatures of keylogers/malware/spyware etc. But, what's the benefit ...
1
vote
2answers
182 views

SafeZone: keyloggers/malware/spyware protection

As part of Avast free updates you have a chance to use SafeZone browser. Among features of SafeZone browser I found that SafeZone protects you from keyloggers/malware/spyware. I'm interesting ...
2
votes
1answer
224 views

Web browser security comparison analysis

Secunia publishes an annual vulnerability review that covers web browsers and surprisingly Google Chrome leads the number of known vulnerabilities in comparison to the likes of Microsoft Internet ...
4
votes
1answer
99 views

Should my company change the internal Root CA hash method from SHA-1 to SHA-2?

My company have a Root Certificate Authority which is installed on a Windows Server 2003 and uses SHA-1 as hash method. We will migrate to Windows Server 2012. Checking the root certificates of my ...
1
vote
3answers
318 views

How can I find an unauthorized/unknown proxy on my home network?

I recently started receiving an error while trying to stream netflix that I'm using a proxy. Exactly this error code here: https://help.netflix.com/en/node/277?ba=GSButtonClick&q= My problem is ...
3
votes
1answer
76 views

Is same origin policy for web only useful because of cookies?

There is a same origin policy in the browser to ensure that e.g. bad site won't read your data from Facebook. But it seems that the only problem that it tries to solve is that cookies are ...
3
votes
0answers
35 views

How to check if redirected site like OAuth is genuine?

One common security advise is to open sites only from bookmarks (see also Explain to non tech savvy person how to check that your connection to mybank.com is safe? ). This approach fails if a site ...
-2
votes
1answer
58 views

Is Tor Browser vulnerable to WebRTC leak?

If so, which are all the possible solutions to the problem? Are there similar issues to be aware of? Thank you in advance.
5
votes
1answer
129 views

Does prefetching/preloading in web browsers pose a security risk?

Today I googled the name of a domain that was reportedly serving up malware. My search results came up (with the compromised domain at the top of the list) and within seconds my AV gave an alert ...
1
vote
3answers
54 views

Security implications of FileExists() from javascript in browser

What would the security implications be if JavaScript, in a browser, could perform a typical FileExists() operation with normal file paths (win and/or mac)? Something like Node's fs.existsSync(path) ...
0
votes
1answer
117 views

How to prevent hotlinking on binary content served through PHP?

I am trying to secure a byte serving script, written in PHP, mostly taken from http://www.tuxxin.com/php-mp4-streaming/ to protect against linking the video directly and easy downloading. I therefore ...
0
votes
1answer
94 views

Virus: Images get replaced on website [closed]

I have installed Windows 7 again on my laptop with Chrome as browser. The problem is that on different websites I visit, the actual images of the website get replaced with out of context images. It ...
0
votes
1answer
99 views

Why would a website want to know what operating system you are using?

As per this question, websites can learn what operating system a client is running by examining the HTTP headers. There are some addons that prevent this from working. What is a legitimate use of this,...
1
vote
1answer
75 views

How do websites recognize visitors? [duplicate]

Being more specific, I would like to know which are the possibilities for a webbsite owner to detect whether the same user logs with different accounts, and how to bypass each of them. For example, I ...