A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.

learn more… | top users | synonyms (2)

8
votes
2answers
4k views

Worst case scenario, what can a Chrome extension do with “Your data on all websites” and “Your tabs and browsing activity”?

Chrome extensions, and just like other browsers, appear to often get quite some extensive access to your browser data. In fact, most extensions I've installed require access to: Your data on all ...
8
votes
5answers
307 views

Is it a risk to highlight text while reading a webpage?

Whenever a user selects or highlights text on a webpage, an OnClick() event is generated. Some of the web browser security models depends on explicit end user interaction, such as OnClick(), before a ...
8
votes
2answers
6k views

Is BEAST really fixed in all modern browsers?

BEAST is said to be fixed in all modern browsers: Chrome and Firefox IE in Jan 2012 Opera in Dec 2011. It's also fixed in OpenSSL since 2002. Do these fixes mean that it's safe to use ciphers in ...
8
votes
1answer
525 views

Are browser still vulnerable to Cross-Site Cooking?

The latest article that I have been able to find about Cross-Site cooking was stating that it was possible to set cookie on 2 dots top level domain such as .co.uk. The mechanism for preventing ...
8
votes
2answers
2k views

How to protect against clickjacking attack but allow legit iframes?

I'm aware of modern anti-clickjacking approaches, such as X-Frame-Options header or framekiller scripts. But all these tactics prevent content to be inside iframe. But what if there is a requirement ...
7
votes
2answers
561 views

Should user be allowed to save password in browser?

The auditing company found a bug "The Auto-complete form attribute is set in password field". They suggested to disable autocomplete for this field to prevent disclosure of it "when working on shared ...
7
votes
5answers
7k views

Benefits of identifying clients based upon the “X-Forwarded-For” or similar HTTP header in addition to Client IP

The X-Forwarded-For header is used by some HTTP proxies to identify the IP address of the client. The wiki page (linked above) mentions that ISPs may use this header as well. In addition there are a ...
7
votes
5answers
2k views

What do the various browser “private modes” do?

Recently there has been some disagreement as to what "private mode" means when it comes to various browsers. Primarily I am referring to... IE's "InPrivate Browsing" Google Chrome's "Incognito ...
7
votes
4answers
353 views

How big is the risk, to enable scripting in the Web browser?

While browsing the web, many websites executes scripts (mainly javascript) that are executed without the user noticing. How big is the risk, to get Malware unnoticed while surfing with scripting ...
7
votes
3answers
432 views

How secure is HTTPS with weak ciphersuites?

Today I came across the website https://mtgox.com/, which claimed to be secure because of the Verisign certificate. I checked the certificate out of curiosity (it's the first thing they claim, let's ...
7
votes
4answers
2k views

What web browsers support OCSP stapling? Are the privacy and performance features the same?

OCSP stapling decreases the load on a PKI infrastructure's OCSP server by attaching a signed OCSP response to the target in a TLS connection. In addition it creates a more secure/private session ...
7
votes
2answers
288 views

Do I have to harden IE if I'm only using Firefox?

Assume a Windows 7 system (probably whatever home version comes with the machine), with the latest OS patches, latest IE and latest Firefox. Also assume that the user uses only Firefox for browsing, ...
7
votes
2answers
30k views

How to determine if a browser is using an SSL or TLS connection?

I want to know whether my browser is using SSL or TLS connection if I see HTTPS. I want to know for IE, Firefox, Chrome and Safari. I want to know the protocol version.
7
votes
3answers
3k views

How does BeEF work? (working understanding)

I have recently come across the BeEF- a browser exploitation tool. In most of the articles, it is said time and again that it is developed for research and pen test purposes! Has anyone worked with ...
7
votes
3answers
2k views

SQL Injection How to inject Clean/Rest URLS

I have a question I'm hoping you could help me with? Unclean url's: http://example.com/index.php?page=foo http://example.com/products?category=2&pid=25 ...
7
votes
3answers
384 views

Is it advisable to have a web browser remember login credentials?

I have a really long random password for my cellphone account and have it written down in a safe place. I only use it once a month and am considering having my browser remember it. Would there be any ...
7
votes
2answers
6k views

How to thwart sslstrip attack?

I need help understanding the dynamics of an sslstrip attack. I'm using it to test the security of a site that I own. I can successfully sniff the victim (in this case, myself) credentials over the ...
7
votes
3answers
4k views

CSRF cookie vs session based tokens

I will generate a CSRF token and include it in a hidden form field. When receiving the request, I will check the form value against the value either stored in the user's session or in a cookie. Is it ...
7
votes
1answer
5k views

Does Google Chrome protect against cross site scripting (XSS)?

In Firefox I've been using the NoScript extension to protect myself from certain kinds of malware attacks. NoScript is well known as a very powerful extension for Firefox and introduced protection ...
7
votes
5answers
737 views

Can I improve website security by storing SSL Keys in DNS? Is DNSSec required? Are threat models available?

In light of recent attacks on SSL/TLS communication, people have been asking about ways to improve the security of SSL webserver communication. Several great solutions have been mentioned in the ...
7
votes
2answers
625 views

Browser based virtual machines

How would applying hypervisor (e.g. xen) principles in the development of a web browser offering isolated browser tabs (virtual machines) improve or reduce security of existing web applications (good ...
7
votes
2answers
164 views

What security measures does Chrome have in place to sandbox different user accounts?

Google Chrome has a feature that allows different users to use Chrome on the same computer in a completely separate space. The support page is quite light on information. Is there information ...
7
votes
3answers
1k views

Are Web Views in android secure?

"Web Views" are views that display some online content, usually a webpage within an android app. Implemented "Web Views" usually don't seem to have any kind of status bar or an address bar to confirm ...
7
votes
1answer
763 views

Have any viruses leveraging the GPU been discovered in the wild? What is the mitigation?

This news article from 2010 discusses how a GPU can be used by a virus to avoid detection by common anti-malware/anti-virus software. The idea is to obfuscate the virus payload and leverage the GPU's ...
7
votes
1answer
2k views

Do I really need all these Certificate Authorities in my browser or in my keychain?

There are lots of strange looking Certificate Authorities in my keychain as well as Firefox. I am sure they are legitimate CAs (as they are the same on my Mac and PC and other computers I checked). ...
7
votes
1answer
216 views

Are there any reasons why browsers should block mixed passive content by default?

Most browsers block "active" content that's being loaded over HTTP on HTTPS pages. This includes stuff like javascript which can be modified with an MITM and compromise the security of the entire ...
6
votes
5answers
305 views

What's the real reason behind blocking the social sites? Even legitimate sites like twitter which acts as a knowledge repository?

I see some sites are blocked for IT security at schools, colleges and offices. But, why do some obvious good sites are blocked too?
6
votes
4answers
414 views

What abuses can an infected webpage do to me if I'm using Chrome and Flash is disabled

as a follow-up to this question Can you get virus just by visiting a website in chrome., I've read these pages: http://www.straightsectalk.com/?p=47 ...
6
votes
3answers
271 views

How safe are copies of Firefox that are on various Mozilla mirror sites?

If I end up downloading a .dmg or .exe (depending on OS) installer from some mirror site, how can I be sure that a virus or trojan or spyware has not been added? I don't see any mechanism for ...
6
votes
4answers
5k views

Is WebGL a security concern?

Is WebGL a potential security problem due to the low level access it provides? For example, a web page can attempt to compile and run any shader source it wants. It seems that security would ...
6
votes
2answers
230 views

plugins to lengthen short urls for security purposes

Came across this question What browser plugins can help us to see the actual destination of such shortened URLs?
6
votes
3answers
2k views

How can a “server” know that what browser i'm using besides the user-agent?

How can a "webserver" know (or a sniffer between the srv<->and the client) that what browser i'm using besides the user-agent? Are there any "magic tricks"? javascript? java? How can I securely, ...
6
votes
3answers
202 views

Detecting OAuth malicious Implementation

I am wondering how can an end-user detect a maliciously implemented OAuth whether 2-legged or 3-legged. Particularly I am interested in those cases where the consumer requester is maliciously ...
6
votes
2answers
521 views

Firefox Add-ons not using HTTPS? Security bug. (?)

If I add a rule in Privoxy: echo '{ +redirect{s@http://@https://@} } .mozilla.org' >> /etc/privoxy/user.action then I can't install Firefox Add-ons. Why? I though the Firefox Add-ons ...
6
votes
3answers
2k views

Any additional security with large blacklisting hosts file?

I run Windows with a pretty hefty c:/windows/system32/drivers/etc/hosts file obtained from http://winhelp2002.mvps.org/hosts.htm. I update this file as regularly as I remember and layer it with ...
6
votes
1answer
618 views

Access to other local files from a local HTML file

I tried this question on programmers site with no luck Do you see any reason to block a local html file from accessing another local files located in the same folder? I mean, if a user downloaded an ...
6
votes
3answers
896 views

Is it possible to use Greasemonkey to hack a website?

Yesterday my WordPress website got hacked. I thought I had done all necessary things to make it secure. One of my colleagues said that with Greasemonkey we can easily hack sites. Is it true? How can I ...
6
votes
3answers
1k views

Web Browsers and Cross Origin Resource Sharing

The CORS spec states that if a request method and headers are not simple (http://www.w3.org/TR/cors/#simple-cross-origin-request) then a preflight HTTP OPTIONS request is sent to see if the request is ...
6
votes
4answers
368 views

Is flash or javascript a bigger security concern?

Many flash website whitelisting extensions for chrome (such as flashblock and flashcontrol) use javascript in order to selectively block Adobe Flash from functioning. Thus, In order to get this ...
6
votes
2answers
1k views

Considering that SRP is better than SSH and Basic Auth, how can it be implemented in a website?

SRP is short for Secure Remote Password protocol, and provides a better way for passwords to be sent over the internet. I've read the information at it's Stanford University home page, the Wiki ...
6
votes
4answers
15k views

Advanced techniques for detecting a proxy/getting original IP

In what manner can a website detect my original IP address, even though I'm using a proxy server? I've noticed this with a few sites. There are four proxy methods I've used: Firefox with a proxy ...
6
votes
3answers
1k views

What are potential security risks when using an insecure wireless connection?

If someone is using an insecure wireless connection (for example a hot spot in a coffee shop) does it posse a threat even if the person is using a secure application layer protocol? What I mean by ...
6
votes
1answer
378 views

How do I check the code of a Chrome extension to make sure it's not stealing my info?

I've been reading more and more about just how much access browser extensions can have to your data. This is a little unsettling, so I'm curious if there is a way to Vet these extensions and make sure ...
6
votes
4answers
1k views

Web browser password management security [duplicate]

Possible Duplicate: How are browser saved passwords vulnerable? How secure are the password managers that are built into modern web browsers? Currently I use lastpass plugin as I believed ...
6
votes
3answers
163 views

How to sandbox Iceweasel (Firefox) on Debian? [closed]

Are there any tools for sandboxing Iceweasel (Firefox) on Debian systems? I'm mostly interested in tools distributed by Debian. (An equally trustworthy source would be second best.) (I suppose that ...
6
votes
2answers
1k views

How can end-users detect malicious attempts at SSL spoofing when the network already has an authorized SSL proxy?

I'm working on one client's network where they have enabled HTTPS authority spoofing on their proxy. This allows them to effectively perform a man-in-the-middle attack to decipher all outgoing ...
6
votes
1answer
435 views

Browsers silently adding trusted root certificates in Windows

When accessing https://internetbanking.caixa.gov.br (site of a well known bank in Brazil), the server returns a certificate signed by "Autoridade Certificadora Raiz Brasileira" (Brazilian Root ...
6
votes
2answers
246 views

Zero-Day Exploit targeting Internet Explorer Versions 9 through 11

Few days ago, FireEye has found a vulnerability, which affects all versions of IE (even the latest 11). Microsoft has official statement regarding this issue. FireEye wrote a technical article on ...
6
votes
3answers
276 views

How do I secure my advertisement space against ad overlay browser attachments?

I don't really have an issue with advertisements simply being blocked by individual users who are visiting a customers site or my own site. As an individual you have the freedom to choose not to look ...
5
votes
6answers
9k views

Using Private Browsing mode while connected to organization's network

At the workplace I use the organization's network for accessing internet (well that's the only option). I am not sure if the network administrators monitor what I browse, how frequently I access ...