A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

learn more… | top users | synonyms (2)

1
vote
1answer
134 views

What browsing history exactly would police have under proposed UK law change? Plain english

It's very unclear what '12 months' browsing history being kept by network provider' actually means to an uninformed person. Thunderbird? VPN? Startpage searches? Bit-torrent downloads? Epic browser (...
2
votes
1answer
75 views

WebRTC attack surface area?

I'm building an app for browser-to-browser communication. What is the attack surface area for WebRTC in 2015? What kinds of attacks could be done? And more importantly, how do I craft something ...
4
votes
2answers
180 views

SSLStrip still HTTPS

I did all the configuration right. IPtables, port forwarding, ARPspoof, everything. However, in the browser websites like Facebook and Twitter are still HTTPS. What am I doing wrong?
-1
votes
2answers
104 views

Is it dangerous to interrupt session on a web-site?

For example if I just close page or browser or anything else (without clicking "log out" on a site) - can this somehow endanger my account (info leaking or illegal access to an account) ?
2
votes
0answers
24 views

Why has the “Origin” HTTP header not been universally adopted? [duplicate]

After running tests on a few browsers on browserscope.org, I noted that neither Firefox or IE have adopted the "Origin" HTTP header. This header is a useful and valid way of helping prevent CSRF ...
3
votes
3answers
32 views

What would be the valid approach while handling short links [duplicate]

In modern world people often use to send urls with url shortners from various webservices,Mostly we use url shortners to shorten the url But in terms of exploits,phishing attempts how could we avoid ...
4
votes
3answers
229 views

HOW is the malicious URL/payload is delivered to the user on a DOM based XSS attack?

Testing for DOM based XSS at OWASP reads: The first hypothetical example uses the following client side code: <script> document.write("Site is at: " + document.location.href + "."); </...
4
votes
1answer
437 views

Why does sslstrip+ fail to intercept the traffic from websites like facebook and gmail?

I have been reading an article about sslstrip and mitm. Before the introduction of HSTS it was possible to strip ssl and send an insecure http page to the victim. Anyway it was overcome by using HSTS ...
2
votes
2answers
104 views

which encryption is used in this JS Variables

Which encryption method is used for these variable names: var g_license_info var g_server_time_obj Respectfully encrypted to: var ago05b4e111efe149737a67a177f00ffad2 var ...
2
votes
2answers
110 views

Disabling downloads in the browser; are there any benefits?

I was playing around with the security settings in my browser (IE) after being attacked by malware. I noticed an option to disable downloads. If I were to disable downloads, and re-enable them when ...
1
vote
1answer
112 views

Where does the list of trusted content authorities come from when using a web browser?

I was asked "how do browsers know whether or not to trust the certificate from the server it's connecting to" and thought it was a pretty good question. After doing some googling I found two answers: ...
8
votes
2answers
999 views

How does BeEF work and how can it be persistent

BeEF - the browser exploitation framework. I think (thought) I had a basic working understanding of how it works. Recently, though, I was watching, this DEFCON talk, where a hacker used a man-in-the-...
2
votes
3answers
202 views

Spoofing random browser information to defend against fingerprinting

Tor goes the way of trying to make everyone look the same to defend against browser fingerprinting. Wouldn't a simple addon that changes/adds as much information as possible randomly in short time ...
1
vote
2answers
1k views

can web application disable browser's password manager's remember feature for that application?

Is there anything a website code do to prevent any browser from remembering your password? I am aware that from browser's options, users can change setting to ask to remember password or not. But can ...
0
votes
2answers
250 views

Chrome/ Opera continue to save & autofill passwords after installing LastPass? Good or bad? Enable/ Disable?

I moved to lastpass a few months back and imported passwords from all Browsers. Apparently, Chrome & Opera {based on Chromium} still pop-up the option to save passwords and are probably ...
2
votes
2answers
120 views

Custom browser based on Internet Explorer - Uniqueness questions

I have developed a custom web browser for Windows using C# (based on Internet Explorer 11) and I'm trying to understand & solve the next issues: 1. I adjusted the User Agent string and the ...
0
votes
1answer
238 views

Chrome + EMET= How Strong Realistic Protection Against Browser-Based Threats?

tl;dr: How secure is a combination of a sort-of hardened Google Chrome + Microsoft Enhanced Mitigation Experience Toolkit 5.1 against browser-based threats that I do not expect to be highly ...
1
vote
4answers
143 views

Redirection Malware Infection

I have AVG Antivirus installed on my PC. My PC is infected with some kind of bonjovi redirection malware. It randomly opens up a new tab in Chrome and loads porn sites. I have had this infection in ...
-2
votes
1answer
199 views

Online Password Storage: Is this safe and how can I implement this?

Hello there for an online Tool which offers the feature of storing passwords online I want to implement the following process: A user is generating a secure secret random key with Javascript This ...
3
votes
1answer
2k views

How to authenticate in a website with public/private keys?

I've been reading how the SSH public/private key works and realized how handy they are (taking the secure out of the equation). And started to wonder why websites do not implement the same thing? ...
0
votes
1answer
80 views

Warn on (plain, unencrypted) HTTP: in which prominent security talk was this advocated? [closed]

Some months ago, I watched online a video recording of a talk/presentation aimed at an audience interested in information security. The talk concerned UI/UX/usability, convenience, and security, and ...
0
votes
2answers
190 views

Many suspicious requests are going from my browser whenever open any site

Whenever I open any site there are so many suspicious request are shown in my network panel of browser. I scan my system with many antiviruses too, but still facing the same issue. And sometimes I ...
3
votes
1answer
180 views

Dangers of WAP billing?

Recently I clicked an ad by mistake on my phone and it routed me through different pages and popups automatically. On of the pages had my mobile phone provider in its URL and WAP-billing. So I ...
2
votes
2answers
119 views

Can BlackBerry keep us safe from network providers

I recently brought a BlackBerry mobile and the reason I have gone with BB was the security it ensures and now I have a doubt. That said in the Internet, Massage from BBM will first reach Canada via ...
3
votes
0answers
36 views

How to disable typed arrays in firefox as rowhammer mitigation

I am concerned about the potential attack surface exposed by JavaScript typed arrays as a means of performing rowhammer attacks. Is it possible to disable (via official means or otherwise) typed ...
15
votes
5answers
2k views

What is the difference between http and https with a self-signed SSL certificate?

A colleague of mine has told me he doesn't see why there is a warning when visiting a HTTPS website with a self-signed certificate saying that the security may be compromised, but there is no warning ...
4
votes
2answers
109 views

apple.com exploit attempt?

I recently browsed to apple.com; and the page crashed a few times, then after I reloaded I was given this alert after my browser attempted to redirect to res://ieframe.dll/acr_error.htm#apple.com,http:...
6
votes
3answers
317 views

Using Lynx on potentially malicious websites

After needing to refresh how to unpack an android ramdisk, the site I remember having good information comes up with something similar to this: Being cautious, but still wanting to get what was on ...
1
vote
3answers
467 views

Can a shim (a.k.a. polyfill) be installed in IE, FF, or Chrome without user knowledge, and can it read passwords entered by user on a login page?

The questions here are about shims in the 3 most commonly used browsers. A shim (also known as polyfill) is a piece of code (often JavaScript or Flash) implemented to augment the native API in a web ...
3
votes
2answers
220 views

Should I regularly erase cookies?

Cookies really do make for a better experience on the web but do they also create a vulnerability? How often should I clean them out and what benefits are gained by doing so?
3
votes
1answer
729 views

Does a Content-Type: text/plain header protect against XSS in browsers?

I'm creating a small web script that mostly redirects the browser but has some error conditions when input parameters cannot be validated. I'd like to display error messages like parameter XXX had ...
-1
votes
1answer
96 views

Why do browsers have no built-in features to verify the integrity of downloads? [closed]

I just started a download of a large file. Checksums were placed prominently on the download page. But I just realized that I actually never made use of any of the checksums provided for download ...
2
votes
0answers
83 views

Do any specific steps need to be taken into account for the user's browser and browser caching for a HIPAA compliant web application?

I'm currently writing a web application that will need to be HIPAA compliant. It is very JavaScript heavy, and ePHI will be sent over an encrypted connection in the form of JSON. The transmission ...
2
votes
2answers
198 views

Why do popular sites like Google, Dropbox, etc. have a “trust this computer” checkbox when it weakens security?

Let's say someone is logging onto Dropbox in the library, but the computer has a keylogger on it that steals their password. Fortunately, they are using two factor authentication, which could have ...
40
votes
4answers
6k views

Have computer criminals been known to exploit easily-edited websites like Wikipedia to embed malicious scripts?

When I was reading a page on Wikipedia several months ago (December 2014) I saw what looked like a pop-up window from BT, but I soon realized that when I closed the page the pop-up disappeared. I then ...
5
votes
1answer
156 views

Are there cases where malicious scripts on websites breached the sandbox of a browser so that files on the user's computer could be accessed?

Whenever a hosted script on a website tries to access a file on a user's computer the sandbox prevents it, but has there been any documented case where this sandbox obstacle was somehow overcome by ...
6
votes
1answer
568 views

Point several HTTPS domains to the same web server

We are currently running a SaaS over HTTPS(abc.net) and one of our clients(xyz.com) wants to do some custom branding. The client xyz.com will have their own subdomain xyz.abc.net which looks like its ...
5
votes
1answer
142 views

Is it safe to reuse a tab in a browser for different websites?

A friend of mine recently asserted that it is unsafe to reuse the same tab in a browser for different websites. In other words, if the user: Visits a sensitive website (for example logs in his bank ...
7
votes
1answer
208 views

Protection against clickjacking in Firefox without installing addons?

On some of my workstations I never allow Javascript in Firefox. The NoScript addon is installed on these machines, but I would like to remove it and disable Javascript via about:config instead. ...
10
votes
2answers
195 views

Disable HTML5 battery features

HTML5 has a feature set relating to client battery status. It has been described as a privacy hole, as it can be used to track and identify web users. Research suggests the features can be used even ...
2
votes
1answer
83 views

Selective JavaScript commands - Avoiding vulnerabilities exploitation

I remember the times when Javascript usage was so innocent; a small pop-up here, a dialog message there. Nowadays Javascript "steals" data by exploiting vulnerabilities on "mature" browsers such as ...
1
vote
2answers
161 views

Can a “client-initiated” session cookie provide more privacy and security than existing session alternatives?

There are several uses for a cookie, and I would like to offer some kind of guarantee that a cookie is being used for a specific, limited purpose and scope. In my case, I want to prove that a cookie ...
2
votes
2answers
135 views

Browser fingerprints, theory or reality?

As you may or may not be aware, even when browsing "incognito", you can theoretically be tracked. Browsers have unique fingerprints, just like people do. Check this link to learn more. While I ...
3
votes
3answers
296 views

Cipher used for request data encryption used by browser

Please note that this is not about how SSL communication happens between browser (I researched and understood it) and client but other aspects. Using Digicert's SSL mechanism explanation I have ...
2
votes
1answer
5k views

This site uses a weak security configuration - SHA-1 signatures [duplicate]

One of our users just sent us a screenshot of them browsing our site using Chrome for OS X, version 44.0.2403.130. This came as a surprise because I thought that our certificates were up to date (via ...
2
votes
1answer
229 views

How secure/private is the browsing history on browsers?

I've been using Aviator secure browser for a while which insists that you run private mode by default (cookies and history wiped after every session), which makes me wonder how secure the history is ...
2
votes
1answer
226 views

Encrypting data before sending to SaaS tool and decrypting on browser view

I'd like to send data to a SaaS tool, where the data is stored in the cloud. I'll use Google Analytics as an example, but it applies to any similar service. Google Analytics does not allow you to ...
5
votes
2answers
439 views

Questions on true anonymity

I am going to use Tails to connect to Tor through VPN which has AES-256 data encryption, SHA-256 data authentication and RSA-4096 handshake encryption on my Mac on my school's WiFi (as public as I can ...
2
votes
1answer
175 views

Scam caller claimed to have elderly friend's “Windows unique identifier”

An elderly friend received a telephone call similar to this Information Security SE post and this one. The caller claimed that my friend's computer had a problem that needed to be fixed. My friend ...
0
votes
0answers
1k views

Does Microsoft Edge (Spartan) share Cookies, Cache, Passwords, or TLS Certificates with Internet Explorer?

Windows 10 was released with a new browser called Microsoft Edge. Interestingly, Internet Explorer is also installed on the same default install. Given that Chrome and Firefox tend to separate their ...