Tagged Questions

A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.

learn more… | top users | synonyms (2)

0
votes
2answers
1k views

Which browsers are using openssl

It is asked in stackoverflow, but I suppose maybe it is more suitable to ask here. It is said that openssl are widely used, however, as far as I know, the most popular browsers seem not use openssl, ...
1
vote
1answer
202 views

Can a website download malicious content to my Windows computer without my permission or awarness? [duplicate]

Question Standard security advice is: Only download files from websites that you trust. http://windows.microsoft.com/en-ca/windows/downloading-files-internet-faq This implies that 1. we are ...
1
vote
1answer
72 views

Why are certain languages chosen for security application development over others?

Specifically, why are the most popular attack proxies written in java? Is there any particular security posture to the design of the java language that makes writing tools like these simpler? Easier ...
1
vote
1answer
65 views

Are there other ways for a CA to have their certificates included in a browser?

From what I understand, the certificate authorities (CAs) have to get their root certificate included in the browser. What if the root certificate of a particular CA is not included in the web ...
1
vote
1answer
427 views

How to handle private key encryption/decryption for web application

In the process of designing a web app that handles public/private key pairs - a Bitcoin web app, specifically - I've had a lot of thought on how to securely handle the storage of the private key, ...
1
vote
2answers
111 views

Are web browser able to use camera without permission? [duplicate]

Is it possible to be recorded via our camera/micro via web browser without asking our permission ?
0
votes
1answer
110 views

Access-Control-Allow-Origin possible threats on static JS file

As I am working on a research, I need allow users to read my JavaScript file using Ajax. However, I want to make sure about consequences of adding Access-Control-Allow-Origin header for just this ...
5
votes
4answers
845 views

Suggestions to avoid cookie-hijacking in a web application

I've been developing web-apps for quite some time now. While making websites, the "remember me" feature is one of the most trivial(read as must-have-for-clients) feature to be implemented. Until ...
2
votes
2answers
145 views

On an “uncritical” site, is there any reason to NOT trust a self-signed certificate?

There are many sites that have self-signed ("untrusted" in Firefox) certificates. I then have the option to trust them or not. If I not trust them I can either leave the site or only visit the site ...
0
votes
1answer
71 views

Corporate IT support for client-side cross domain requests

I have an API and a web application that exist in different domains. I can activate CORS on the API to allow for the web application to interface with the API cross-domain. However it has been ...
3
votes
1answer
161 views

XSS via PDF when Content-Disposition: Inline?

There are kind of two questions here: Is it possible to have XSS in a PDF file when the Content-Disposition: is "inline"? If it is possible, does the pdf get access to the cookies for that domain ...
-3
votes
1answer
142 views

Vulnerability in Internet Explorer [closed]

An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website. This here being remote code ...
0
votes
1answer
219 views

Can I use crypto.getRandomValues to create a private key?

In the window.crypto spec: http://www.w3.org/TR/WebCryptoAPI/#RandomSource-interface It says explicitly: "Do not generate keys using the getRandomValues method. Use the generateKey method ...
6
votes
2answers
262 views

Zero-Day Exploit targeting Internet Explorer Versions 9 through 11

Few days ago, FireEye has found a vulnerability, which affects all versions of IE (even the latest 11). Microsoft has official statement regarding this issue. FireEye wrote a technical article on ...
1
vote
1answer
111 views

Securing Javascript plugin

My company offers a Javascript plugin that is meant to be embedded with websites. It works in a similar fashion to Google Analytics, in which you add a bit of Javascript and then it does some magic on ...
3
votes
1answer
97 views

Force user to download a file to their hard drive via hyperlink?

I want to design a scenario in which I have a web site which contains a link. If the user clicks on this link, it will save a file in a specific pat in his hard disk without his consent. Is this ...
2
votes
8answers
501 views

How can I allow only authorized browsers to access a website?

I have a website and I want it to be accessible only by authorized clients/browsers (ex. with a certficate). The idea is that the users can only access the webpage in their office's computers ...
2
votes
0answers
267 views

Content-Security-Policy & Facebook login

This question seems to be related to http://stackoverflow.com/questions/15913200/facebook-js-sdk-not-executed-in-my-chrome-extension , but I am not developing a chrome extension. I am developing a ...
1
vote
1answer
74 views

Simple protection against reflected XSS

I was going through some CLIENT side defenses against reflected XSS e.g. XSS auditor(chrome), IE8 XSS Filters, Noscript. They use regular expression and other sophisticated techniques. My question ...
22
votes
1answer
2k views

Why would the BBC web site always ask for a personal certificate, and how do I avoid giving it away?

After installing a CAcert personal certificate, every time I land on the BBC weather site it asks me to identify myself with a certificate. Why would any non-malicious web site do that unless I've ...
1
vote
1answer
605 views

IE11 on windows 8.1 and ssl fallback

I'm having problems with SSL certs and my SSL accelerator. I have a Sonicwall SSL-R and it only supports SSLv2, SSLv3, and TLS1.0. I have it configured to decode SSL with SSLv3 as the TLS1.0 ...
0
votes
2answers
104 views

Can malware cause firefox to send GET requests?

Is it possible for a site to host malware such that if a certain page is accessed, Firefox is made to send additional GET requests? I'm seeing traffic for attacks coming from me that I haven't done. ...
1
vote
0answers
467 views

Is Google Chrome Extension access to SSL certificate validation output possible?

I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My ...
-1
votes
1answer
102 views

Heart Bleeding Bus [duplicate]

This may be a unwise question, but I'll ask anyhow. I have been analysis relatively a bit about the Heart Bleed vulnerability, and I'm curious as to whether it only affects web applications or could ...
1
vote
0answers
35 views

What part of the browser is typically attacked? [closed]

Pretty sure that browsers are compromised most often through their plugins, at least, that's what I keep reading. So, then, does that mean the browser itself has vulnerabilities, and the plugins are ...
1
vote
1answer
34 views

Which is safer as a URL storage, favorites or browsing history?

Somewhere on this site I read that I should connect to websites by entering the URL myself or using a bookmark when security is critical. I started wondering why that didn't include browsing history. ...
2
votes
1answer
111 views

user data accessible through javascript in browser

There are websites which display user information, such as browser version and operating system This website goes even further, and displays some additional information, such as desktop resolution, ...
2
votes
1answer
96 views

Which Browsers support TACK?

TACK is an IETF draft that allows certificate pinning for a TLS web server, provided the clients' bowsers support it. Unlike the certificate pinning feature available with HSTS preloading, the ...
2
votes
3answers
168 views

How to prevent popping up a login dialogue using a malicious hotlinked image and HTTP Basic Auth header?

While using Firefox to browse my forums, I noticed that a malicious user posted an image (via hotlinking, not by uploading to my server) with the extension .png which complies with the forum rules ...
3
votes
2answers
286 views

Security of a Windows XP system after April 8th when running the latest Firefox or Chrome

As we all know, Microsoft stops developing security patches for Windows XP very soon. If a bug in the kernel was to be found that would allow an attacker to take control by, say, sending a specially ...
2
votes
2answers
1k views

IIS Host Header Attacks

Is IIS and ASP vulnerable to the same Host Header Attacks we have seen on Apache and Nginx? Specifically the attacks that use the HTTP Host Header to reset a password or implement web-cache poisoning. ...
2
votes
5answers
341 views

running firefox as unprivileged user on Linux

On a typical desktop (with no listening services such as Apache, SSH, ...) it seems to me, the browser is the most exposed application and a potential security compromise (and even more so with Java ...
-4
votes
4answers
133 views

How to check the safety of a link? [duplicate]

Someone gave me a link and asked me to open it, but I don't trust that guy. I'm not sure the link whether safe to open or not. I want to know if there a way to check the safety of the link? I have not ...
0
votes
1answer
85 views

Good reason to continue using fraudulent certificate?

A relative of mine used a favorites link to login to yahoo. The favorite link is https://de.mg40.mail.yahoo.com/neo/launch? However, this link uses a fraudulent certificate. Visiting the Yahoo ...
41
votes
12answers
6k views

Why should I care if a site uses encryption or not if I'm not exchanging any sensitive data? [duplicate]

Lots of sites these days, that don't deal with sensitive data, enable encryption. I think it's mostly to make (paranoid?) users feel safer. In cases where there is a user's account being logged in, ...
0
votes
2answers
337 views

How to hide real IP from browsers while using VPN?

You probably know that even when you use a VPN service, browsers like Chrome and Safari can still somehow provide your real location to Google Maps etc (if you give it a permission). My question is: ...
0
votes
1answer
111 views

Prevent Page from appearing in history

I have inherited an ASP site where sensitive data was passed in the query string as part of the URL. Something like this: www.example.Com/Test?details=Username&moreDetails=blahblah If we chnage ...
0
votes
1answer
90 views

Are there software solutions take encrypted credit card data taken straight off a square credit card reader and insert them into a standard web form? [closed]

Does anyone know how you can take the encrypted output of a square card reader and insert it directly into a standard web form?
1
vote
3answers
2k views

What version of TLS does any web browser use when connecting to server where all SSL Protocols are enabled?

All (almost all) web browsers have TLSv1.0 enabled by default, moreover TLSv1.1 and even TLSv1.2 can also be enabled by default. What version of TLS will be used to connect to web server (e.g. ...
0
votes
1answer
233 views

False Positives- Server side protection against XSS

I read about XSS attacks and its prevention mechanism on server-side. It seems only protection is to sanitize the input by escaping special characters on server side (Using some PHP functions such as ...
22
votes
1answer
2k views

Why does Firefox not trust this US government SSL certificate?

Shouldn't this be a trusted certificate considering it's a wildcard SSL certificate? That is, shouldn't *.delaware.gov cover www.corp.delaware.gov?
1
vote
2answers
324 views

Do Chrome/browser extensions break the tab sandbox?

So, as far as I know, Chrome and possibly other browsers have a very low privilege process spawned for every tab. How do browser extensions interact in regard to this sandboxing? I'm not talking ...
3
votes
2answers
155 views

How can users be sure the browser's URL bar is not faked?

For a user to defend against something like Don't understand how my mum's Gmail account was hacked , they should pay attention to URL bar before typing their credentials. But how can you make ...
126
votes
9answers
33k views

Is Adblock (Plus) a security risk?

My email-provider's website (http://www.gmx.de) recently started linking to the (German) site http://www.browsersicherheit.info/ which basically claims that due to its capabilities to modify a site's ...
0
votes
2answers
59 views

Displaying a video through the web whilst hiding the location

I felt this fit more here than SO, if not, please vote to migrate. We've been approached by a company who would like to use our platform to host their videos. The issue is that right now, we use the ...
1
vote
1answer
102 views

How can I be sure that my browser does not exfiltrate my passwords to some server?

This is my first question and I dont even know if it is the right place. If this is an off-topic just mark it as off-topic, don't go crazy and downvote. :P But how can I detect if my browser is not ...
1
vote
2answers
77 views

Mechanisms to offer inexpensive https to all second level .wiki domains

I'm working with the registry for .wiki, a new generic top level domain set for public availability in June 2014. We're going to be giving away hosted wikis to registrants of .wiki domains and I'd ...
1
vote
2answers
2k views

Why is my browsing history visible outside my network?

Whatever I and my family members do at 'Home PC' is visible in the history in Google chrome in my 'Office PC'. The two networks are entirely different! I saw all websites visited on our home PC by my ...
2
votes
3answers
420 views

Is it secure to access web with Xubuntu in VirtualBox running in Windows XP?

Support for Windows XP is ending soon. Therefore, I am seeking a secure solution to continue with Windows XP. When I access the web from Xubuntu in VirtualBox running in Windows XP, is the Windows ...
2
votes
2answers
483 views

Can cookies reveal my email address?

When I visit livescore.com, ten seconds later I receive marketing emails from gambling companies. If I don't visit this site, I don't receive these emails. Similar things happen when I visit Twitter ...