A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

learn more… | top users | synonyms (2)

-2
votes
1answer
55 views

Is Tor Browser vulnerable to WebRTC leak?

If so, which are all the possible solutions to the problem? Are there similar issues to be aware of? Thank you in advance.
5
votes
1answer
89 views

Does prefetching/preloading in web browsers pose a security risk?

Today I googled the name of a domain that was reportedly serving up malware. My search results came up (with the compromised domain at the top of the list) and within seconds my AV gave an alert ...
1
vote
3answers
51 views

Security implications of FileExists() from javascript in browser

What would the security implications be if JavaScript, in a browser, could perform a typical FileExists() operation with normal file paths (win and/or mac)? Something like Node's fs.existsSync(path) ...
0
votes
1answer
92 views

How to prevent hotlinking on binary content served through PHP?

I am trying to secure a byte serving script, written in PHP, mostly taken from http://www.tuxxin.com/php-mp4-streaming/ to protect against linking the video directly and easy downloading. I therefore ...
0
votes
1answer
74 views

Virus: Images get replaced on website [closed]

I have installed Windows 7 again on my laptop with Chrome as browser. The problem is that on different websites I visit, the actual images of the website get replaced with out of context images. It ...
0
votes
1answer
96 views

Why would a website want to know what operating system you are using?

As per this question, websites can learn what operating system a client is running by examining the HTTP headers. There are some addons that prevent this from working. What is a legitimate use of ...
1
vote
1answer
70 views

How do websites recognize visitors? [duplicate]

Being more specific, I would like to know which are the possibilities for a webbsite owner to detect whether the same user logs with different accounts, and how to bypass each of them. For example, I ...
1
vote
3answers
131 views

Can Google Chrome read/scan my ProtonMail inbox page?

If I used Google Chrome to visit ProtonMail website, it would not be difficult for Google to read my emails since it would just need to scan/read the content of the page. Messages are encrypted just ...
4
votes
3answers
182 views

Why are root certificate authorites allowed to issue certficates for any domain?

Why are certificate authorites allowed to issue certificates trusted by browsers for any domain name? Doesn't that imply that one highjacked root certificate authority can issue trusted fake ...
0
votes
1answer
79 views

Is firefox disabling of insecure TLS fallback part of the HSTS spec?

I've been looking into HSTS, and I can see that Firefox has supported it since version 4, but I can also see that you could click through untrusted cert browser warnings until Firefox 37. Is the ...
0
votes
0answers
30 views

Since yesterday, NoScript has asked twice whether to “allow scripts from example.com”. What gives?

Since yesterday 2015-01-19, I have had two occasions where NoScript has apparently blocked scripts from "example.com", the actual domain, not the meta-level foo variable. According to this Wikipedia ...
1
vote
0answers
26 views

Where should I store sensitive data within an Apache Cordova application?

I have to implement a 2 factor authentication (2FA) feature within an Apache Cordova application so that the user is able to login into the desktop application using the generated token. Common 2FA ...
0
votes
0answers
41 views

Is keeping business data in browser database websql secure?

Knowing that Server always validates the data before saving it. Browser app is generating the data based on user input and some business logic and is storing it locally. Browser app then synchronize ...
0
votes
1answer
130 views

What are the exact security risks of having JavaScript enabled?

There are a lot of websites out there that state that you should disable JavaScript because of the possible security risks. There's also a reason that an AddOn like NoScript has been developed and is ...
11
votes
5answers
2k views

Why do most browsers store browsing history by default?

Why do most browsers store browsing history by default? It seems like people often have to go to the hassle of manually deleting their history or using incognito mode. Are there some major advantages ...
39
votes
3answers
5k views

Why do some internet banks force logout on back button?

A design pattern I've noticed on internet banking sites is that you get automatically logged out and sent to a warning page if/when you hit the back button on your browser, ending your session and ...
1
vote
3answers
124 views

Why limit internet access while connected to a remote desktop?

I work in the nuclear industry, and sometimes we have some strange (but understandable) standards for information security. I have encountered one which seems odd and would like to know the potential ...
0
votes
2answers
50 views

Are third party authentification provider included via iframe by default considered (in)secure?

Authentification provider X is used by many non-related websites like A, B and C as (sole) authentification provider. X therefor provides a framework for athentification which includes a login form ...
0
votes
1answer
101 views

How might my browser session be hijacked on iOS Safari?

I'm currently on iOS using Safari, and my browser session was just hijacked. Ive never seen any hint of malware on iOS, so I'm going to assume the hijacking occured (consistently happens when visiting ...
3
votes
1answer
422 views

How to read the key3.db file?

The file key3.db contains the key that is used to encrypt the Firefox passwords stored in logins.json file. I don't use master password in Firefox, but according to this article, my passwords are ...
5
votes
2answers
123 views

Why do so many browsers show sites with revoked certificates?

Everyone seems to agree that it is REALLY important to protect private keys so the encrypted Internet can remain just that (see for example at How do certification authorities store their private root ...
22
votes
1answer
1k views

How does Firefox encrypt passwords without selecting Master Password?

I know that the file logins.json contains all my encrypted passwords in Firefox browser. How does Firefox encrypt these passwords if I don't use the 'Master Password' option? Does this mean key3.db ...
2
votes
1answer
85 views

Panopticlick performance for Tor Browser not great. Why?

These are the results for the Panopticlick test on Tor Browser that I just performed: Is your browser blocking tracking ads? Partial protection Is your browser blocking invisible trackers? ...
-2
votes
1answer
90 views

Storing Data Without Knowing Anything About the User

Let me start by stating that this is really my first foray into encryption. I have written username/password systems, and such, and am familiar with salting and hashing passwords... but I have never ...
2
votes
1answer
56 views

Crypto in browser

It's almost 2016 and javascript encryption libraries have been around for a while. My question is, have they improved? Or should we still abandon the idea of having encryption done in our browsers? ...
-4
votes
1answer
59 views

Can I disable corporate monitoring by disabling my network connection? [closed]

Can my activities be traced if the Ethernet cable is not connected? If I disconnect the company's Ethernet cable & connect my PC to tethering, will the browser history be still captured once I ...
3
votes
2answers
134 views

WebCrypto algorithms and differences with other crypto libraries

I was looking at the WebCrypto crypto libraries coming form the W3C. Looks like only a few cryptosystems are supported, including AES-CBC, AES-CTR, AES-GCM, and RSA-OAEP. ...
5
votes
1answer
666 views

How make Firefox ignore X-XSS-Protection header from server?

I have two questions: 1)How can I make Firefox ignore X-XSS-Protection header? I have a website which sends X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it destroys ...
-3
votes
3answers
68 views

How important are my cookies from a security perspective?

If a hacker makes a copy of all my browsing cookies, what could he/she do with that? What are the worst case scenarios?
3
votes
4answers
104 views

What are the mostly used and known or less known web tracking techniques? [closed]

I know about HTTP cookies, flash cookies, ETag when dealing with user tracking on the web. Are there other technologies, known or less known? Thanks.
3
votes
1answer
71 views

Tor browser further anonymity requirements [duplicate]

Tor and Tor Browser do a good job of providing anonymity, but we cannot rely on them alone. The development of newer techniques for identifying web users (such as canvas fingerprinting) mean that ...
0
votes
1answer
47 views

What's the best practice for MitM'ing https traffic to distinguish self-signed certs?

My organisation is concerned about viruses and attacks coming into our network. Since http traffic has been declared persona non grata by some browser makers and other parties, it becomes ...
1
vote
1answer
34 views

HTTPS everywhere rulesets confusion

When using HTTPS everywhere I frequently notice the ruleset counter next to the search bar. I understand the counter represents the number of rulesets for each page, which can be seen by clicking next ...
0
votes
1answer
81 views

Does the server administrator see what sites I visit

I have seen a lot of answers but here is the peculiarity of mine. In the office we all have a login to the WiFi, First with that login, if I use Tor will my visited sites still be logged by the ...
1
vote
0answers
41 views

Few sites are shown as Certificate is obsolete in Chrome(https is struck off). But they're marked as green in IE [duplicate]

For example, for few sites the 'https' part of website is when loaded through Chrome (installed in workplace) states that the connection is certified but it also states that the resources in the page ...
0
votes
1answer
59 views

Security concerns about Web browser [closed]

It seems that its like a black point in my mind that I think about browser when I research information security. Its clear that its the browser applies security rules while we navigate websites. In ...
8
votes
3answers
636 views

Why do Firefox and Chrome “leak” critical security information out of the browser and how can I stop it?

In studying SSL / TLS handshakes and encryption, I found a method that describes how to export the SSL / TLS session keys from Firefox to an user or environmental variable outside the browser, and ...
2
votes
1answer
118 views

Why do Browsers warn about self-signed certificates but not about plain HTTP (which is not even encrypted)? [duplicate]

Let's keep it short: On HTTP everyone can listen easily. MITM attacks are no problem. On HTTPS (self-signed) everything is at least encrypted, it's much harder to MITM-attack and only private key ...
0
votes
0answers
26 views

Different chanels for BeEF UI and Communication Server

I am working with BeEF tool and I want to access the UI interface using https (I don't want to communicate via VPN to access the control panel), while at the same time, I need to serve the http hooks ...
6
votes
1answer
73 views

Is there any benefit in having CNNIC certificates installed, if you're not in China?

All modern browsers/OS come with root certificates from the China Internet Network Information Center. AFAIK these certificates are required for computers sitting behind the Great Firewall to function ...
2
votes
2answers
84 views

Java code signing vs. sandboxing

I'm trying to understand the rationale behind Java Applet development these past few years. Back in the old days, most Applets were unsigned, and the code for these was run in a sandbox where barring ...
2
votes
1answer
87 views

Why can't a self-made SSL certificate have a fake signature? [duplicate]

Let me explain what I mean. I've read Why is faking SSL certificate difficult, and my question is sort of a step beyond that. If some random person creates a certificate, what's stopping them from ...
0
votes
1answer
69 views

apis.google.com has an invalid security certificate. How do I overcome this problem?

This is a screenshot of my browser when I tried visiting my public calendar. It shows that apis.google.com has an invalid security certificate: This means that there is some problem with my DNS ...
2
votes
1answer
104 views

Should we trust online banks with our credit card information?

I'm thinking of buying a product for someone using the steam platform. Being in Germany, the best (least expensive) option would be to use a local bank. Logging in, choosing a product and checking out ...
1
vote
3answers
124 views

Why is it so difficult to stop Ad Blockers?

My understanding of how ad blockers work is essentially that they just look at the domains sending the information. Why has no one been able defeat ad blocking software in a general sense?
1
vote
2answers
74 views

Is the same browser equally safe on a different OS?

For example: is Chrome installed on Linux more prone to a hack (stealing logins/passwords, installing add-ons, changing something in browser...) than Chrome installed on Windows? (I do realize that ...
2
votes
2answers
284 views

Why does OWASP recommend “Disable Web Browser Cross-Tab Sessions”

I have been looking through the OWASP session management cheat sheet and I don't understand the reasoning behind the suggestion to "Disable Web Browser Cross-Tab Sessions". How does using the same ...
15
votes
2answers
534 views

Alternatives to HTML's deprecated <keygen> for client certs?

The keygen tag is used to make browsers generate private keys and POST the resulting CSR to the server, which can then issue a certificate. It's now been deprecated, for rather stupid reasons but ...
0
votes
1answer
114 views

Can anyone access my computer if I use tor browser?

Today I was told that if I use tor browser, hackers may access my Computer and can delete or copy files from my Hard Drive. Is it really true? Can hackers access my computer If I use tor? Thanks ...
0
votes
1answer
51 views

Why only Google warn us about attackers?

There are so many search engines like ask.com, yahoo.com and many more, but only Google warn us about attackers. Why so?