A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.

learn more… | top users | synonyms (2)

12
votes
5answers
2k views

Solution to allow JavaScript input but prevent XSS

We have a simple Blog system that allows users to input html and JavaScript to build a blog page. I'm aware that allowing javascript open up the door to xss attacks. We do however need to allow users ...
12
votes
4answers
8k views

Remove RC4 from SSL/TLS ciphers in Chromium

Recently I started to live without RC4 within my Firefox session. Discussion about it can be found here. While it is quite easy in Firefox (Enter about:config and then rc4), I found no possibility to ...
12
votes
5answers
1k views

Is clipboard secure?

Can a browser get the data on my clipboard? Data could be for example my temporary password? Any browser or operating system that allows this?
12
votes
7answers
1k views

How to browse the Internet safely?

What is the best way to browse the Internet safely? By safely I mean: anonymously having encrypted communication Extra bonus for: being able to do it with little or no performance impact cheaply ...
12
votes
2answers
286 views

Why do browsers allow public websites to attack intranet sites?

When I'm visiting a website on the public internet, the website can cause my browser to send requests to a local IP address (such as 10.0.0.1). This can be used to attack internal web sites, e.g., ...
12
votes
2answers
1k views

Is there a tool to verify browser TLS/SSL configuration

I am looking for a tool to verify the configuration of ssl/tls settings in the browser. I have found a few sites that enumerate supported ciphers and the preferences but none of them seem to provide ...
11
votes
5answers
3k views

Does HTTPS Everywhere defend me against sslsniff-like attacks?

http://www.thoughtcrime.org/software/sslsniff/ If I have a domain on my HTTPS Everywhere list, so that theoretically it could be only visited via an HTTPS connection in my Firefox, then could an ...
11
votes
6answers
447 views

Can a website determine what OS or webbrowser a visitor is using if the useragent is blanked/changed?

Assume that a visitor to a website has changed his useragent to something like the following, but he's using linux: Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0 Assume that the ...
11
votes
2answers
1k views

Could a malicious JS file pointed on URL/URI attack the browser/computer?

I found some website blacklisted on Google. I mean when you try to visit them, you get something like shown on this picture: After a small search, I found that some of them have a malicious ...
11
votes
4answers
2k views

What is the safest way to close a popup window?

The internet has many articles recommending ways to close a browser popup window without infecting your computer with malware. I've seen click the red X, use ALT-F4, go to the windows task bar, right ...
11
votes
2answers
383 views

What should I look for when auditing a Firefox extension / plugin?

I've been asked to do a security audit on a Firefox add-on developed by a third party. I am a web developer with a reasonable grasp of JavaScript but am not a browser security expert. What kinds of ...
11
votes
3answers
1k views

What bad coding practices makes a browser extension vulnerable?

I'm trying to scan JavaScript files for vulnerabilities using JSHint. Specifically, I'm scanning the JavaScript files of browser extensions. To look for possible vulnerabilities I'm looking for bad ...
11
votes
1answer
3k views

enable browser caching with HTTPS

I understand that sensitive data should not be cached (ie, you dont want to cache an HTML file with all of your bank account details in it), but there are some things that HTTPS protected sites should ...
11
votes
4answers
617 views

Vulnerabilities common only in mobile solutions?

I was wondering if there are any threats for web-applications used on mobile phones that haven't been known in the "full size" browsers earlier. I haven't heard of any serious or common problems that ...
11
votes
3answers
383 views

Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?

On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
11
votes
1answer
1k views

SSL TLS renegotiation vulnerability - current situation in clients

Reading about the SSL renegotiation problem CVE-2009-3555 one knows that servers supporting old type of renegotiation are vulnerable to data injection. We also have tools to test them (openssl ...
10
votes
4answers
4k views

Security measures against packet sniffing

I work in a environment where packet sniffing can be easily done . I was worried about my confidential data . Please suggest how is it done and precaution which i can take at client level.
10
votes
4answers
994 views

Why isn't OCSP required by default in browsers?

According to the following screenshot, taken from firefox-3.6.17-1.fc14.i686, Firefox has an option to fail closed when unable to connect to OCSP servers. Can someone please explain why this isn't ...
10
votes
4answers
1k views

Why do browsers warn about mixed content for images?

I'm dealing with a phpBB forum user who wants to set up SSL on their entire site to secure user credentials and "private" parts of the website. However, they want to preserve the traditional forum ...
10
votes
3answers
366 views

Should I ask a user to re-authenticate if the browser thumbprint changes? Is a server side library available?

Is there a security benefit to using the browser's thumbprint in addition to a session identifier to identify a unique session? Would it then be advisable to ask the user to reauthenticate (or simply ...
10
votes
3answers
300 views

How to test if a browser add-on is safe

I came across this plug-in that started some alarm bells ringing. The add-on would help submit a website to web directories. The first 100 submissions are free, then you need to pay $20 via pay-pal ...
10
votes
2answers
436 views

Risks of Using Google Native Client

I was wondering if there were any possible risks in using Google Native Client. I know it is sandboxed, but the idea still seems risky, and at least leaves another route open for compromising your ...
10
votes
3answers
205 views

Are bookmarklets safe with facebook data?

I usually play mafia wars and use bookmarklet like Spockholm, Arum, etc. Can these bookmarklet get my facebook data when I run them, they usually ask to unframe the facebook page. I was just ...
10
votes
2answers
876 views

Can a Firefox add-on or plug-in access the user's websites' saved passwords in decrypted mode?

Going deeper into the previous question on Firefox plugins and add-ons malware risks: Could a Firefox add-on potentially decode and capture the encrypted websites' passwords saved in the browser?
10
votes
2answers
476 views

Any tool for scanning vulnerabilities in browser extensions?

I am scanning browser extensions of Chrome and Firefox for vulnerabilities. Is there any tool which would help me do this?
10
votes
2answers
347 views

How do you visit a link without risking your computer?

I got a link from: http //61.19.247./~naowit/dustin.html (removed the last digits so you don't accidentally click it! (they were 192)), which was masked as a youtube.com link via email. Now I'm not ...
10
votes
1answer
644 views

How can I embed iframe securely without restricting its functionality?

I'd want to embed an iframe from untrusted site into web application. Iframe: should be able to run Javascript and browser plugins (Flash, etc.) should not be able to access my web application ...
9
votes
4answers
3k views

Tor and regular browser side by side. Does that make sense?

Can I use a Tor browser session and a regular Firefox session side by side without corrupting the security of the Tor session? E.g. when I download a new Eclipse version or when I'm searching for ...
9
votes
2answers
236 views

Why do some certificates specifically identify a corporation and most don't?

Looking at a handful of websites that allow for/require HTTPS, I realized that the certificate for a few of them specifically identifies the owning corporation, but some (most) don't. What's the ...
9
votes
5answers
8k views

Where does SSL encryption take place?

I checked the data transmission of an HTTPS website (gmail.com) using Firebug. But I can't see any encryption to my submitted data (username and password). Where does SSL encryption take place?
9
votes
4answers
480 views

Unknown malware, how to report it and whom to report it to?

I'm a professional Windows system administrator, but I've been caught off-guard (or maybe some malware writer has been very clever) and I caught some unknown malware on my home computer (Windows 7 x64 ...
9
votes
2answers
3k views

Are there any statistics about webservers and browsers TLS support?

From Hackers break SSL encryption used by millions of sites: The vulnerability resides in versions 1.0 and earlier of TLS, or transport layer security, the successor to the secure sockets layer ...
9
votes
3answers
1k views

localStorage for apps over https. What expectations are there?

I run an online gradebook. To keep student data private, I transfer all data over https. Now, I'd like to use localStorage to avoid redundant calculations and server requests. However, according to ...
9
votes
2answers
469 views

User-specific Subdomains : JavaScript security

If I provide a public-facing website for users on my website at their own subdomain (e.g. bob.myapp.com) under their own control, can I allow them to execute arbitrary JavaScript without putting my ...
9
votes
2answers
3k views

Using iframes to sandbox untrusted code

I'm trying to create an extensible platform, where my site will provide a model and some views (both client-side, in the browser) and third party sites may add their own views as well. The goal here ...
9
votes
1answer
490 views

Device fingerprinting & Mass Computer Surveillance

Device fingerprinting is one of the biggest privacy problems as explained because people think cleaning cookies, using proxy servers or blocking domains can protect them (when blacklisted trackers ...
8
votes
11answers
3k views

Besides IP addresses, how else could one be identified? [closed]

OP: I'm curious how else an actor seeking to identify someone online could accomplish this task besides just using an IP address. What methods would they employ? What knowledge must they have of the ...
8
votes
5answers
2k views

Is finding vulnerabilities in the major browsers easy or not?

If young hackers can detect them, why can't security analysts get and patch them? Also, I dream of finding a vulnerability in a major software, like IE or Chrome. Is it easy? Is it systematic or is ...
8
votes
9answers
378 views

What is the proper way to view the sourcecode of a website?

I recently heard that Firefox makes a second HTTP request when the sourcecode is requested. Is this true? Does this mean the webserver may issue alternate source from the original? Lastly, is ...
8
votes
6answers
4k views

Why are iframes allowed at all in modern browsers?

I read a number of IT security blogs (though I'm no security expert), and it seems a significant percentage of exploits in the wild are delivered through adding malicious iframes to a hacked website, ...
8
votes
4answers
2k views

Is using “HTTPS everywhere” extension secure?

I would like to know if one should use 'HTTPS everywhere' extension? Is it secure to use it? Are there any better alternatives? HTTPS Everywhere is a Firefox and Chrome extension that encrypts ...
8
votes
4answers
739 views

I've encountered JavaScript attack code - how do I search for information on the exploit's specifics?

So, I clicked on a reasonably-looking LinkedIn invite, not thinking about hovering overing the link first, since usually the e-mail client warns me about such things. Once I realized I landed on an ...
8
votes
2answers
2k views

Will disabling the Java add-on in IE protect you from Java exploits?

Concerning the recent Java vulnerability (Should I be disabling Java?), the most common advise seems to be to disable Java plug-ins in the browser. However, Heise Security suggests that, when it ...
8
votes
4answers
734 views

Preventing insecure webapp on subdomain compromise security of main webapp

I want your help on getting more concrete information on a type of vulnerability that I remember vaguely. I vaguely remember hearing about a year ago that if you set up a webapp on a subdomain, and ...
8
votes
5answers
299 views

Threat model for huge warnings on untrusted SSL certificates and no warnings for plain HTTP connections?

Why do untrusted/expired SSL certificates get such a huge warning in modern browsers even with "DO NOT VISIT THIS SITE!" messages, whereas a regular HTTP connection, which is more prone to ...
8
votes
5answers
1k views

Websites that interactively test browser security (XSS, CSRF, Javascript, etc)

I'm looking for a comprehensive list of browser test sites so that I can visually prove that the browser is patched and configured for safe web browsing. My intent is to know what risks may exist ...
8
votes
2answers
998 views

MIME sniffing protection

As it is known, older versions of MSIE (before 8) have a nasty habit of treating images as HTML if they "look like" HTML, which can lead to nasty vulnerabilities for sites that allow people to upload ...
8
votes
2answers
418 views

How to keep using Java 6 securely, despite its unpatch vulnerabilities

Given that Java 6 is now deprecated by Oracle and there recently has been notification of a 0day (that will exist forever now that Oracle is not patching JRE6), what can we do to prevent drive-by ...
8
votes
1answer
401 views

What steps do you take to keep both your computer and internet browsing secure?

I am thinking about your browser setup, antivirus protection, vpn, browsing best-practices and so on.
8
votes
2answers
161 views

Preventing user supplied javascript from posting to external server

I am writing an internal tool that will support plugins written by other developers. Ideally, these plugins would have a Javascript component to allow people to make widgets. Some of the pages these ...