A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.
5
votes
2answers
567 views
Considering that SRP is better than SSH and Basic Auth, how can it be implemented in a website?
SRP is short for Secure Remote Password protocol, and provides a better way for passwords to be sent over the internet.
I've read the information at it's Stanford University home page, the Wiki ...
5
votes
5answers
444 views
Can I improve website security by storing SSL Keys in DNS? Is DNSSec required? Are threat models available?
In light of recent attacks on SSL/TLS communication, people have been asking about ways to improve the security of SSL webserver communication. Several great solutions have been mentioned in the ...
5
votes
2answers
258 views
What protects cookies?
What protects cookies from being stolen? After all, they are just text files. A misbehaving browser can give up a lot more information that web masters would like. How do I know that a browser won't ...
5
votes
1answer
138 views
Where does the responsibility lie for a XSS vulnerability
I am an avid user of Workflowy (online outliner/note taking tool) and I installed the Chrome extension 'Workflowy for Coders', which formats the text within notes.
I discovered that one of my notes ...
5
votes
1answer
3k views
Chrome is telling me I am receiving a forged certificate for Gmail, is someone trying to hack me?
I went to log on to https://mail.google.com this morning and I got the following error. Is someone trying to attack me or is this just a bug?
I'm on a WPA2 encrypted wireless connection using Chrome ...
5
votes
3answers
661 views
What are potential security risks when using an insecure wireless connection?
If someone is using an insecure wireless connection (for example a hot spot in a coffee shop) does it posse a threat even if the person is using a secure application layer protocol? What I mean by ...
5
votes
2answers
3k views
How to thwart sslstrip attack?
I need help understanding the dynamics of an sslstrip attack. I'm using it to test the security of a site that I own. I can successfully sniff the victim (in this case, myself) credentials over the ...
5
votes
1answer
243 views
Same-origin policy for file: URLs in Android browser?
When you load a file:// URL in an Android WebView or in the Android browser, what does it treat as the origin? What can the Javascript on that page access? Can it access other files in the same ...
5
votes
1answer
413 views
When and Why does Chrome display malware detection warning?
Google Chrome contains malware detection feature. When user visits some site, browser may display warning that site contains malware.
What does it mean that site contains malware? Does it mean that ...
5
votes
4answers
3k views
Advanced techniques for detecting a proxy/getting original IP
In what manner can a website detect my original IP address, even though I'm using a proxy server? I've noticed this with a few sites. There are four proxy methods I've used:
Firefox with a proxy ...
5
votes
2answers
4k views
Is BEAST really fixed in all modern browsers?
BEAST is said to be fixed in all modern browsers:
Chrome and Firefox
IE in Jan 2012
Opera in Dec 2011.
It's also fixed in OpenSSL since 2002.
Do these fixes mean that it's safe to use ciphers in ...
5
votes
1answer
185 views
How much protection does the Kill-Bit provide for ActiveX controls?
I have some ActiveX controls that are not supposed to run in the browser but only in my particular Front-End. I know that by setting the Kill-Bit I disable their execution in Internet Explorer and MS ...
4
votes
3answers
304 views
Is changing image's extension prone to error for browsers?
In my uploading user's avatar scenario, I change users picture extension to jpg.
Is this making the browsers to act differently? Is it prone to error for browsers when they read users avatar?
...
4
votes
4answers
2k views
Benefits of identifying clients based upon the “X-Forwarded-For” or similar HTTP header in addition to Client IP
The X-Forwarded-For header is used by some HTTP proxies to identify the IP address of the client. The wiki page (linked above) mentions that ISPs may use this header as well.
In addition there are a ...
4
votes
4answers
413 views
Is silverlight and Java running on the web browser capable of saving “state” into the user's local machines?
I am aware that even after we have cleared our cache and cookies, websites can still save files/information into our computer using Flash (Flash ever cookies),
I was wondering does other plugins like ...
4
votes
4answers
2k views
Is WebGL a security concern?
Is WebGL a potential security problem due to the low level access it provides?
For example, a web page can attempt to compile and run any shader source it wants.
It seems that security would ...
4
votes
3answers
324 views
What are methods for preventing browser hooking / drive-by downloads?
This question may be a bit too broad and open ended, however I'm hoping to get some good advice on this.
With the advent of BeEF and more and more of the computers in networks being infected just by ...
4
votes
3answers
185 views
Could browsers improve security of stored passwords by using setuid?
On Unix-esque systems, Mozilla Firefox stores a users' preferences, web history and stored passwords in a set of files that are readible and writeable by that particular user.
This makes sense: when ...
4
votes
2answers
7k views
How to determine if a browser is using an SSL or TLS connection?
I want to know whether my browser is using SSL or TLS connection if I see HTTPS.
I want to know for IE, Firefox, Chrome and Safari. I want to know the protocol version.
4
votes
3answers
284 views
Are there security (esp. privacy) benefits to deleting cookies?
As the title says, I'm wondering if there are any security/privacy benefits to managing cookies - that is, managing by deleting cookies you don't want or need.
I deleted all my cookies about a week ...
4
votes
1answer
200 views
Do I have to harden IE if I'm only using FF?
Assume a Windows 7 system (probably whatever home version comes with the machine), with the latest OS patches, latest IE and latest Firefox.
The user uses only FF for browsing, never IE.
I'm ...
4
votes
3answers
214 views
Are secret URLs secure over HTTPS?
Imagine a service that makes sensitive information available under a secret URL via HTTPS only, without requiring any other authentication. In fact, these are already widespread.
What level of ...
4
votes
3answers
1k views
Any additional security with large blacklisting hosts file?
I run Windows with a pretty hefty c:/windows/system32/drivers/etc/hosts file obtained from http://winhelp2002.mvps.org/hosts.htm. I update this file as regularly as I remember and layer it with ...
4
votes
1answer
69 views
Signing a browser extension
I want to make a browser extension available to users. Can I sign my extension so that users can verify it is authentic, without needing to trust the web site where they got the extension from nor ...
4
votes
4answers
318 views
Is online banking more secure on iOS than a desktop computer?
Does Apple's iOS provide a more secure environment for online commerce (banking or shopping) than Windows or Mac OS X? Since the only software that can run on iOS must be vetted by Apple, the ...
4
votes
2answers
837 views
Does Java applets reveal the real IP address, even when using proxy or vpn?
Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?
4
votes
3answers
394 views
SQL Injection How to inject Clean/Rest URLS
I have a question I'm hoping you could help me with?
Unclean url's:
http://example.com/index.php?page=foo
http://example.com/products?category=2&pid=25
...
4
votes
2answers
137 views
Is using a “Red” and a “Green” browser to balance LOB requirements and security a good approach?
I currently work in a manufacturing company with round about 5000 computers and 6000 employees.
We use a lot of web based line of business applications (all internal, non over the Internet) in order ...
4
votes
2answers
249 views
Workarounds for :visited CSS History reconnaissance
Several years ago it was possible to use
a:visited {
background: url('/log.php');
}
to figure out on what website user has been previously. But now it is restricted by browsers. Is there any ...
4
votes
2answers
733 views
How is user authentication sent in a public wifi? Radius/802.1x/EAP etc
I visit the airport, I pull out my laptop and connect to a network (no password needed).
I open up my browser and i am presented with a screen saying I need to pay to use the network. If I pay, I ...
4
votes
4answers
2k views
Browser hijacked - how to fix and prevent?
For the second time in a month, my work PC has been infected with malware that is hijacking my Google search results in Firefox. A search for the URL hijacked searches end up at turns up nothing on ...
4
votes
7answers
274 views
Malicious Websites
Just wanted to get everyone's opinion on this. In Information Security, you get various alerts about particular machines on your network going to sites and/or IPs that have been flagged as ...
4
votes
3answers
283 views
Strategy against browser exploits on Windows?
On a friend's computer is some kind of spam bot installed. It sends messages like
Hello:
I received my apple iPad 32GB ordered on an online shop
(www.elevalley.com ) today. So
exciting ...
4
votes
2answers
111 views
JInitiator is obsolete and I should reject it on grounds of security, right?
I'm getting a lot of flack and resistance from developers for not allowing a large (200+ users) roll-out of Oracle's JInitiator (http://www.oracle.com/technetwork/testcontent/jinit-084453.html) as ...
4
votes
1answer
161 views
Do iframes maintain the security of the nested website?
I am planning to add iframes to my webpage to sites such as www.dropbox.com and was wondering if the security of the site would be impaired if i did this. As in, could peoples account be hacked if ...
4
votes
4answers
5k views
Security issues using iframes
We are looking to move to iframes due to technical challenges. By moving to iframes it will be easier to manage the technical issues. But we are not totally sure of security implications of iframes.
...
4
votes
1answer
95 views
Resources/materials for implementing secure web services?
I'm implementing a REST-style (note: it needs to be more pragmatic than canonical) web API and I would like to secure it. The language I'm using is rather fresh and doesn't have a lot of high quality ...
4
votes
3answers
279 views
Is it harmful to redirect web bugs to localhost on hosts file?
I was checking the article hosts file on Wikipedia, and I found this:
Blocking access to servers of unwanted content by redirecting them to the local host (127.0.0.1) may have security ...
4
votes
3answers
2k views
How can I protect my saved passwords in Chrome?
I'm currently using WIN+L, and sometimes Kid-Key-Lock, to prevent anyone from checking my storaged passwords but if I forget doing it only once, all of them are vulnerable of theft.
How can I protect ...
4
votes
3answers
143 views
Is there any way I can block (or conditionally approve of) iFrames on the client side?
Given that iFrames are used in many common exploits, I'd like to conditionally disable iFrames except for sites that require it such as GMail, or MasterCard SecureCode.
I also suspect the ...
4
votes
1answer
587 views
How to detect cookie stuffing attacks?
So the question is how to detect cookie stuffing attacks and how to protect against them?
In case of image-based cookie stuffing I can detect that related resources are not loaded and therefore ...
4
votes
1answer
242 views
How do I check the code of a Chrome extension to make sure it's not stealing my info?
I've been reading more and more about just how much access browser extensions can have to your data. This is a little unsettling, so I'm curious if there is a way to Vet these extensions and make sure ...
4
votes
1answer
121 views
How can browser select suggestions for my private searches?
I use a VPN service that provides a pool of IP addresses, I clean history/cookies/etc - all the browsing data before a session.
Regardless, when I type in the search of one particular search engine, ...
4
votes
3answers
160 views
Are there guidelines for application design of HIPAA compliant browser applications?
This is a different twist - I'm pushing dispatch information to first responders, such as fire, police, and EMS. But they all could, potentially, include medical information and PII together.
My goal ...
4
votes
1answer
277 views
Need help on understanding obfuscated code in CVE-2012-4969 exploit
As you may know this vulnerability was found a while ago in the wild and the exploit is available too, btw I'm having problem on understanding the obfuscated code.
Is it necessary to use obfuscation ...
4
votes
1answer
130 views
What issues might exist with TLS-OBC's emulation of Browser Certificates?
TLS-OBC is an RFC proposal that increases SSL/TLS security by using certificates on both ends of the TLS connection. What's special here is that the client is permitted to dynamically create a local, ...
4
votes
3answers
295 views
Are there any same origin issues (SOP) with TOR?
Are there any issues with Same Origin Policy (SOP) with TOR or *.onion addresses?
I'm thinking of
cookies
Plugins (Silverlight, Flash, Java, etc)
Javascript
4
votes
1answer
140 views
What countries have laws in place that respect Do Not Track HTTP headers or cookies?
Google offers a Chrome plugin that uses cookies to control privacy, while Firefox offers a HTTP Header to tell websites to not track the users and log the data anonymously.
This obviously extends a ...
3
votes
5answers
298 views
Does the padlock on my browser really indicate a reasonable assurance against eavesdropping?
I know that there have been broken or weak SSL implementations. Do browsers actually have decent standards for what they'll accept and display "the padlock"?
Furthermore, are there any practical ...
3
votes
3answers
340 views
What is the actual security of this login page?
Please visit https://devforums.apple.com
If I visit this site using my Safari 6 web browser, this page does not show the normal security indicator that secure sites normally show.
Does this ...
