A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.
7
votes
5answers
834 views
What do the various browser “private modes” do?
Recently there has been some disagreement as to what "private mode" means when it comes to various browsers.
Primarily I am referring to...
IE's "InPrivate Browsing"
Google Chrome's "Incognito ...
3
votes
4answers
177 views
Improving the privacy of a casual Web user
I am interested in improving the privacy available to me as a casual internet user with a default browser. I think that Tor is too slow and that the "Privacy Mode" in browsers isn't really practical. ...
3
votes
4answers
696 views
is using “HTTPS everywhere” extension secure?
I would like to know if one should use 'HTTPS everywhere' extension? is it secure to use it? Are there any better alternatives?
HTTPS Everywhere is a Firefox and Chrome extension that encrypts ...
3
votes
2answers
198 views
Risks of serving untrusted content under HTTP Content-Type: text/plain?
Am I gonna run into XSS attacks by doing this, or will a file download be prompted?
Are there security problems that would rise in a modern browser?
3
votes
2answers
464 views
How can end-users detect malicious attempts at SSL spoofing when the network already has an authorized SSL proxy?
I'm working on one client's network where they have enabled HTTPS authority spoofing on their proxy. This allows them to effectively perform a man-in-the-middle attack to decipher all outgoing ...
2
votes
1answer
2k views
Does Google Chrome protect against cross site scripting (XSS)?
In Firefox I've been using the NoScript extension to protect myself from certain malware attacks. NoScript is well known as it's a very powerful extension for Firefox and introduced protection from ...
1
vote
3answers
804 views
Could some one please explain - Remote Post SQL Injection
Would anyone be able to post a link to an article which explains how to do a Remote Post SQL Injection and how to prevent anything bad happening. Or even just explain on here.
Any help would be ...
0
votes
0answers
15 views
Internet records tracing [duplicate]
Possible Duplicate:
Closed Internet Explorer inprivate trace
If access to the logs of routers/switches is unavailable, how does one (e.g. police) trace the sites one visited if he used ...
1
vote
1answer
109 views
Closed Internet Explorer inprivate trace
Suppose that a user uses inprivate mode in Internet Explorer and browsed something.
Now, an administrator wants to search the user's activity in Internet Explorer using the user's PC without having ...
2
votes
4answers
302 views
Clients trust my custom CA
I'm sorry if this is a dumb question. I'm new to all this.
I have a large number of users. I need to be able to generate SSL certs for various internal domain names. All of these certs need to be ...
1
vote
1answer
117 views
Is the javascript browser tool at printfriendly.com secure for my browser
I use Win Xp Home with SP3 and am pretty aware of security problems. I use Palemoon 12.1, a version of Firefox optimized for windows.
I usually use printfriendly bookmarklet to create printable pages ...
7
votes
2answers
2k views
Worst case scenario, what can a Chrome extension do with “Your data on all websites” and “Your tabs and browsing activity”?
Chrome extensions, and just like other browsers, appear to often get quite some extensive access to your browser data. In fact, most extensions I've installed require access to:
Your data on all ...
1
vote
2answers
82 views
Preventing a socially-engineered transaction
Can you explain what this blog means when it says:
Something to think about when it comes to transaction signatures – demonstrating the need to keep the entire process off the PC (in this case) ...
3
votes
2answers
108 views
Vertical information portal security with a customized web browser
I am creating a SaaS that will be delivered through a Vertical Information Portal (VIP).
In my research I have found that by developing a custom lean web browser and installing it on the clients ...
8
votes
2answers
1k views
Using iframes to sandbox untrusted code
I'm trying to create an extensible platform, where my site will provide a model and some views (both client-side, in the browser) and third party sites may add their own views as well. The goal here ...
-1
votes
2answers
212 views
Restore session in Firefox
Restore session in Firefox
What does this mean, is it related to the session concept which is stored on the web server?
If I stop the computer with my web-app, and then start it again before the ...
1
vote
2answers
450 views
Are flash cookies still a threat and that persistent?
One year (or more) ago flash cookies were really a problem, because they could not be deleted from within a browser. They were not managed by the browser but by the flash player. Flash cookies were ...
0
votes
1answer
88 views
Implementation of a FREE web filter [closed]
I just want some advice for the implementation of a web filter for a school network. Just want to block some contents and url. A free tool should be fine I guess.
Any recommendations?
Thanks!
19
votes
4answers
7k views
Why is passing the session id as url parameter insecure?
I recently followed a discussion, where one person was stating that passing the session id as url parameter is insecure and that cookies should be used instead. The other person said the opposite and ...
2
votes
1answer
117 views
Browsers and export regs. Is SGC still valid?
I was reading a rather "dated" book on SSL/TLS, which mentions about International Step Up certificates and Microsoft's Server Gated Certificates which were the way arround the US export rules for ...
4
votes
4answers
2k views
Is WebGL a security concern?
Is WebGL a potential security problem due to the low level access it provides?
For example, a web page can attempt to compile and run any shader source it wants.
It seems that security would ...
4
votes
4answers
5k views
Security issues using iframes
We are looking to move to iframes due to technical challenges. By moving to iframes it will be easier to manage the technical issues. But we are not totally sure of security implications of iframes.
...
2
votes
2answers
337 views
What if a browser does not understand the secure flag of cookie
I have two questions related to the same:
1 - As 'Httponly' attribute is understood by a set of modern browsers (https://www.owasp.org/index.php/HttpOnly#Browsers_Supporting_HttpOnly), I was ...
4
votes
1answer
140 views
What countries have laws in place that respect Do Not Track HTTP headers or cookies?
Google offers a Chrome plugin that uses cookies to control privacy, while Firefox offers a HTTP Header to tell websites to not track the users and log the data anonymously.
This obviously extends a ...
5
votes
2answers
567 views
Considering that SRP is better than SSH and Basic Auth, how can it be implemented in a website?
SRP is short for Secure Remote Password protocol, and provides a better way for passwords to be sent over the internet.
I've read the information at it's Stanford University home page, the Wiki ...
2
votes
4answers
919 views
What web browsers support OCSP stapling? Are the privacy and performance features the same?
OCSP stapling decreases the load on a PKI infrastructure's OCSP server by attaching a signed OCSP response to the target in a TLS connection. In addition it creates a more secure/private session ...
2
votes
2answers
77 views
Does TLS-OBC only improve security of Web Browsers? Does it improve the security of SSH?
I'm studying the TLS-OBC extension and would like to know if it improves security of non Web-based protocols?
Specifically, would it be of any benefit to SSH clients? (version 1 or version 2.x/secsh)
...
11
votes
3answers
1k views
How can I prevent tracking by ETAGs?
An ETAG is a HTTP header that is sent-behind-the-scenes between a web browser and an web server. This value is intended to control how long a particular file is cached on the client side.
There is ...
4
votes
1answer
130 views
What issues might exist with TLS-OBC's emulation of Browser Certificates?
TLS-OBC is an RFC proposal that increases SSL/TLS security by using certificates on both ends of the TLS connection. What's special here is that the client is permitted to dynamically create a local, ...
7
votes
2answers
213 views
how do you visit a link without risking your computer
I got a link from: http //61.19.247./~naowit/dustin.html (removed the last digits so you don't accidentally click it! (they were 192)), which was masked as a youtube.com link via email. Now I'm not ...
4
votes
3answers
284 views
Are there security (esp. privacy) benefits to deleting cookies?
As the title says, I'm wondering if there are any security/privacy benefits to managing cookies - that is, managing by deleting cookies you don't want or need.
I deleted all my cookies about a week ...
3
votes
1answer
147 views
What servers or clients are immune to related-domain cookie attacks? (*.example.com)
In this question, I want to identify browsers, servers, or implementations that are immune from related domain cookie attacks (e.g. a.example.com vs b.example.com).
Lacking any tangible solution, ...
0
votes
0answers
70 views
When in the keys switching happens in RSA-rc4 [closed]
Assuming I want to surf securely on gmail, and I use SSL.
the RSA is RC4 and using key of 128 bits, my question is how can I make the my browser and google to generate a new key and when does it ...
3
votes
1answer
1k views
cookie path protection within same domain
The answer to this question about how cookies are potentially vulnerable between sub-domains sparked my curiosity.
As far as I know, if a cookie is set on a sub-path of the same domain ...
2
votes
4answers
644 views
Chrome Frame is an example of how browsers “merge together”. How can I unmerge all of them?
Chrome Frame is an add in that integrates with IE and Firefox. Firefox has a similar component, and I hear that the .NET runtime finds its way into all the other browsers.
Additional integration ...
4
votes
3answers
295 views
Are there any same origin issues (SOP) with TOR?
Are there any issues with Same Origin Policy (SOP) with TOR or *.onion addresses?
I'm thinking of
cookies
Plugins (Silverlight, Flash, Java, etc)
Javascript
0
votes
2answers
472 views
Issuing browser certificates to Chrome and Firefox with Microsoft CA
Most companies use IE with an ActiveX control to create a CSR and submit it to the CA for approval.
Since many browsers either block or don't support ActiveX controls, how can I enroll them using a ...
1
vote
1answer
304 views
Wireshark log analyzing
I have the following Wireshark log and I want to categorize the attack. I think it prints the user under apache runs and then prints the system information. From this log can we determine if the ...
3
votes
1answer
1k views
Why does Safari seem to be accepting an HTTPS connection every other browser rejects?
This question is inspired by a bug/issue in recent Linksys router firmware. Essentially, something has changed recently that's preventing HTTPS access to the web admin on current generation Linksys ...
5
votes
3answers
205 views
Is “untrusted code” reported by DOM Snitch a vulnerability?
One of the most frequent errors that DOM Snitch finds in sites is Untrusted code. He finds it in google.com for example. Here is an output of this tool:
Is it a vulnerability?
Edit: This report of ...
0
votes
0answers
31 views
Access Populated server [closed]
I don't know if this is the write forum to post this on... If it's not sorry to bother you!
I'm going to need to get into a server which can accept ~x users; however, ~2*x users will be trying to ...
1
vote
2answers
226 views
http blocked over very low ports in Opera web browser
Opera blocks the user from making http requests over very low ports (below 1024). Why does Opera not allow the user to override this setting?
What is wrong with running a web server on, say, port ...
4
votes
3answers
279 views
Is it harmful to redirect web bugs to localhost on hosts file?
I was checking the article hosts file on Wikipedia, and I found this:
Blocking access to servers of unwanted content by redirecting them to the local host (127.0.0.1) may have security ...
-2
votes
1answer
217 views
What can make my browser crash [closed]
I have tried the various sites whic do so.
but i am not getting a crash report.
all i get is that my browser gets hanged when i run the trivial loops and fork bombs.
im trying to run some test on a ...
3
votes
3answers
641 views
What are some recommended open source tools for web browser history analysis?
I'm looking at a series web browser histories from various browsers (IE, Chrome, Firefox, etc) and need to do some analysis. All of these browsers store data much differently, but I was wondering if ...
7
votes
2answers
310 views
Should user be allowed to save password in browser?
The auditing company found a bug "The Auto-complete form attribute is set in password field". They suggested to disable autocomplete for this field to prevent disclosure of it "when working on shared ...
0
votes
2answers
145 views
What is Greasemonkey / Userscripts and how does it relate to IT Security?
I came across http://userscripts.org/ and learned that it is popular among web-users to install something called "Greasemonkey" to allow client side scripts to run.
What are the benefits of ...
2
votes
4answers
302 views
Clickjacking: can't browsers just forbid/reject placing transparent elements over frames?
Why not? Seems like this is only used for clickjacking, the solution should be simple enough.
5
votes
2answers
3k views
How to thwart sslstrip attack?
I need help understanding the dynamics of an sslstrip attack. I'm using it to test the security of a site that I own. I can successfully sniff the victim (in this case, myself) credentials over the ...
4
votes
1answer
242 views
How do I check the code of a Chrome extension to make sure it's not stealing my info?
I've been reading more and more about just how much access browser extensions can have to your data. This is a little unsettling, so I'm curious if there is a way to Vet these extensions and make sure ...
