A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.

learn more… | top users | synonyms (2)

-3
votes
1answer
104 views

Clarification on a website security [closed]

I am new to work on website handling and here are my questions. 1) How can I ensure that the pages accessing is secure enough for data transmission , sql injection and several other attacks. 2) How ...
4
votes
1answer
113 views

Secure Flash with Click to Play Plugins in the Enterprise

In the recent light of repeating critical Flash vulnerabilities there are recomendations to use browserplugins like click-to-play to prevent unnecessary flash content to automatically load with every ...
1
vote
1answer
74 views

Can a Certificate Authority associated with Active Directory publish a client certificate to a browser?

Can I use some integration of Windows Active Directory and a Certificate Authority to embed a client certificate in a browser that will be trusted by a server? I have a private domain and control ...
-2
votes
2answers
104 views

How would I start becoming knowledgable about hacking and able to do it? [closed]

Is there a site I can start reading tutorials to simpler stuff to build up my skills??? Or is someone willing to give me a task (easy one) to do?
0
votes
1answer
47 views

Secure keyboard entry with JavaScript or Flash?

Is it possible to perform secure keyboard entry (similar to what is offered in the OS X Terminal app) using only web technologies and/or Flash? If not, is there any way to more broadly guarantee ...
11
votes
2answers
1k views

How can I hide my logged in sessions from other websites?

Most people go on browsing the web while connected to their facebook/gmail/etc. accounts. Other websites somehow know what accounts you're logged in. For example, if you go to hide.me's torrent page, ...
1
vote
2answers
159 views

Can Professor See Open Tabs Or History? [closed]

I have a professor that has online quizzes. They mentioned on the first day that they can see the other tabs open in the browser so don't try to cheat by looking up answers. Is this possible? If not ...
2
votes
3answers
77 views

Are auto complete forms a security concern?

I know when I fill out forms with address and email it will attempt to auto complete the rest of the information. Is it possible to include more hidden fields on the page in order to get more ...
0
votes
1answer
59 views

From a security perspective, why not a screenshot api for browser? [closed]

I mean a javascript api for capturing a renderered html page, or current viewport, and dump content onto an image. While there are obvious attacks, such as taking screenshot of sensitive information, ...
6
votes
3answers
202 views

find if 0-day flash bug was exploited (on a particular machine)

There have been several critical 0-day exploits in the past days/weeks in Flash alone. Nobody knows how long the 0-days have been exploited, and it is reasonable to expect that there are 0-days being ...
3
votes
1answer
108 views

How is this web resource hidden from the user? [closed]

Motivation: I've been interested in how various agencies hide data, either through incompetence or willful intent, that is required to be "open". Specifically I've seen oil companies use images to ...
3
votes
1answer
230 views

How does the same-origin policy apply between browser tabs? [duplicate]

Let's assume that we have 2 open tabs in a browser containing page A (A.html, A.js) into the first tab and page B (B.html, B.js) into the second tab and that page A and B have the same origin (scheme, ...
9
votes
2answers
881 views

How to improve the security and privacy of Firefox

What would be a sensible approach to enhance the security and privacy of Firefox? I did not find a question about this and I feel that some guidelines for casual web users would be handy. Currently ...
3
votes
1answer
298 views

Login to one site using other site's credentials

I am frequently seeing websites that allows a user to log-in to their site using other websites log-on credentials. If there is a page that allows me to log-in using my google account or facebook ...
5
votes
1answer
235 views

Why is a child window allowed to change the location of its parent?

Maybe a silly question. When opening a new tab via target="_blank", the page that loads in that tab is allowed to set a new location in the parent tab using: ...
0
votes
1answer
150 views

Can HTTPS be compromised by first contact?

Let's say I am behind my PC and want to go to any secured website (HTTPS). I have the direct IP address so any possible hack on DNS level is not possible (because I am not using it ;) ). The packet ...
0
votes
1answer
277 views

Chromium Sandbox on Mac OSX: Is it enabled by default?

I have decided to finally replace the closed source and privately owned Google Chrome with the open-source Chromium on my Mac OSX 10.9.2 (Mavericks). I have read the differences between both here: ...
2
votes
1answer
847 views

Are my passwords saved in Google Chrome safe when I'm logged out?

I understand that Chrome uses the OS's password storage mechanism to protect passwords on your computer. 1 I also understand that these passwords can be (in my case, are) protected with a passphrase ...
3
votes
1answer
104 views

PKI - Why Root CA is in intermediate CA section?

I can't understand why, when I accept to "install" a custom self signed Root CA on IE browser, the root certificate ends up in the "intermediate CA" section, rather than in "Root CA" section in the ...
2
votes
1answer
58 views

Spoofing of Server Sent Events

In the spec for Server Sent Events, it says Authors should check the origin attribute to ensure that messages are only accepted from domains that they expect to receive messages from. Otherwise, ...
2
votes
2answers
136 views

How does infection through web surfing work?

Often I read about compromise due to visit a malicious site which download some exploit to your computer. I've never seen a detailed process, all books/tutorials I read just say sentences like "once ...
1
vote
5answers
105 views

Beyond patching, how can I reduce the risk of browser exploits?

Keeping web browsers on the most up to date version and also the plugins that are used is pretty much all we do. Is there anything I else I can do to reduce the risk of browser exploits? The only ...
-5
votes
2answers
92 views

Large web application security challenges [closed]

What are the biggest challenges of security in web applications? I want to do a search in the area but I'm not sure what I want to look, I want something that people think it is impossible to serve ...
1
vote
1answer
114 views

How does Yandex Alpha sign me in automatically?

I downloaded the new Yandex Alpha browser. When installing, I chose not to make it the default browser and not to send anonymous usage statistics. I never got a prompt whether I wanted to import ...
4
votes
2answers
5k views

How to display friendly notification about no TLS 1.0 support in browser [closed]

A browser that only has TLS 1.0 support won't be able to establish an HTTPS session with a server that has only TLS 1.1 and TLS 1.2 support. This typically results in a cryptic (to a normal user) ...
1
vote
2answers
355 views

How to avoid referer information leakage during password reset

Most password reset systems involve emailing the user a one-time link that lets them reset their password. The token needs to be in the URL, as most email clients do not allow HTML emails to perform ...
11
votes
2answers
934 views

How safe is it to use developer's version of the browsers [closed]

I have heard that the developer versions of browsers (chrome and firefox) are less secure than stable versions of them. Is it true? Is there any sense in using developer editions of browsers for ...
-5
votes
1answer
150 views

How to avoid DDoS Attack [closed]

I buy my train ticket from our railway local web site. When ticket open for sale on web site then web site original traffic remain 50 (Just an example). Our railway web site is attacked by DDoS for ...
6
votes
2answers
148 views

Information Transfer Between Browsers and Tabs

Is it possible for a webpage to detect or otherwise be aware of what other tabs in the same browser, or even other open webpages in other browsers are doing or transmitting? I am well aware of ...
5
votes
1answer
105 views

How can two clicks lead to better security in the context of, e.g., Twitter and Facebook share buttons?

The sharing section of Jedox's webpage has the Facebook, Twitter, Google+ and Linkedin share options in default inactive state. You need to first click it to activate and click again to get the share ...
1
vote
2answers
94 views

Is it considered a CSRF if it requires a unique identifier which is not a CSRF token - not tied to the user session?

Consider an end point such as below. Let's imagine that this endpoint updates an address of the signed in user, changing the zip code. The address to update is identified by the address ID ...
4
votes
1answer
736 views

How does firefox sync password recovery work?

According to Mozilla Sync-new-security-model, Firefox servers are not able to decrypt your sync data without your password. So I figured that, the browser generates a key from your password, encrypts ...
2
votes
1answer
99 views

What happens if a page with an invalid SSL cert responds with a 302 redirect to a page with a valid cert? Do you still get the warning?

Alice navigates to https://example.com. https://example.com delivers an invalid certificate. https://example.com 302 redirects to https://www.example.com https://www.example.com delivers a valid ...
0
votes
1answer
199 views

Open source alternatives to tamper data

I'm developing a browser(firefox) plug-in which essentially checks for malicious input. My current approach is to store all input fields sent in GET/POST requests, try to heuristically determine ...
0
votes
1answer
62 views

Add certificate authority to one browser only

For testing purposes, I'd like to add a "CA" to the list of trusted-CA's of one browser - and use it only for testing. I want to make sure that it won't get added to the computer's trusted CA list. ...
19
votes
3answers
17k views

Why is 'avast! Web/Mail Shield Root' listed as CA for google.com?

I just noticed something weird in my browser: the certificate for www.google.com has been issued by avast! Web/Mail Shield Root. Should I be worried? I am using avast! Antivirus so it's probably a ...
-1
votes
1answer
110 views

Tools or scripts to scrape browser credentials and data?

I'm exploiting machines in a network and I'm currently trying to scrape data to further my testing from the compromised machines. There's no SOE build so i've got a variety of different environments. ...
1
vote
1answer
214 views

How does a browser choose which certificate to use if my web server has multiple certificates?

I'm using Apache 2.4, with two certificates, one RSA signed by CACert, and one ECC self-signed. Neither of these certificates provide a path to a broswer-trusted root certificate. My question is ...
0
votes
2answers
134 views

Browser page “Not resolved” page hijacked by yandex [closed]

Any domain that cannot be resolved defaults to yandex right now, on any browser on my system. Helper objects or extensions are not installed. It turns out that the ISP (Turk Telekom) is employing ...
1
vote
1answer
146 views

Reflected file download Scenario

I'm making a Java-based web application that is intentionally vulnerable to Reflected File Download (RDF). White paper is here I read the requirements of reflected file download vulnerability as ...
8
votes
1answer
1k views

Browser password manager vs third party password manager

How usable and secure are 3rd-party password managers like Roboform, Lastpass, and 1password from the built-in Chrome and Mozilla password managers? What are the advantages of using 3rd-party password ...
4
votes
1answer
297 views

Regarding Windows password and Chromes Remember password Feature

Google Chrome browser helps in password management by prompting users to remember their passwords for the websites. These saved passwords can be accessed from the browsers "settings" menu, and to do ...
2
votes
1answer
122 views

While logged in to Google etc., can a malicious site discover my ID?

If I visited a malicious site while being logged in to Google, Hotmail, Facebook, or Twitter in the same browser window, how hard is it for the site to discover my account IDs without my explicit ...
2
votes
1answer
910 views

Questions on reflected file download (RFD) attack

I read this article, and the whitepaper by security researcher Oren Hafif which mentions the following salient points: RFD, like many other Web attacks, begins by sending a malicious link to a ...
-4
votes
1answer
277 views

How does https check md5, sha-1 and sha-2 fingerprints?

When a https site shows multiple finger prints, i.e.: md5 and sha1, or sha256 and sha1, how does the browser check? is it both just the "strongest" or whatever is convenient? This question arose ...
1
vote
1answer
205 views

Browser gives access to root directory through “/” [closed]

If I put a '/' on my browser I have full access of my root directory. I have tried the same thing on another computer and it didn't work. So, I'm trying not to be paranoid but this is too strange. I ...
1
vote
1answer
160 views

Is it dangerous to allow clients to run JavaScript on a Server

On a webpage I have been working on, we can archive certain webpages for a user. The user can give an address and this webpage is than visited on the server and archived. Lately, I noticed that ...
5
votes
1answer
723 views

Google Chrome browser warning for goo.gl

I am getting the solid red screen Chrome browser malware warning for Google's own URL shortening website, goo.gl as well as other sites such as bit.ly and delicious.com when I try to navigate there ...
3
votes
2answers
100 views

Why browsers implement stricter policy for local files

I have a problem viewing HTML/JS/CSS files generated on disk. Specifically, several calls in javascript are blocked by Google Chrome. I googled and found an answer here: ...
-5
votes
3answers
382 views

Why doesn't Google Safe Browsing block the IP addresses of malicious websites?

If you visit a blocked domain name like www.thelotbet.cn from Google Chrome, Opera or Firefox, you will get a warning from Google Safe Browsing that this is a malicious website. But if you visit the ...