A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

learn more… | top users | synonyms (2)

6
votes
1answer
74 views

Is there any benefit in having CNNIC certificates installed, if you're not in China?

All modern browsers/OS come with root certificates from the China Internet Network Information Center. AFAIK these certificates are required for computers sitting behind the Great Firewall to function ...
2
votes
2answers
108 views

Java code signing vs. sandboxing

I'm trying to understand the rationale behind Java Applet development these past few years. Back in the old days, most Applets were unsigned, and the code for these was run in a sandbox where barring ...
2
votes
1answer
118 views

Why can't a self-made SSL certificate have a fake signature? [duplicate]

Let me explain what I mean. I've read Why is faking SSL certificate difficult, and my question is sort of a step beyond that. If some random person creates a certificate, what's stopping them from ...
0
votes
1answer
84 views

apis.google.com has an invalid security certificate. How do I overcome this problem?

This is a screenshot of my browser when I tried visiting my public calendar. It shows that apis.google.com has an invalid security certificate: This means that there is some problem with my DNS ...
2
votes
1answer
109 views

Should we trust online banks with our credit card information?

I'm thinking of buying a product for someone using the steam platform. Being in Germany, the best (least expensive) option would be to use a local bank. Logging in, choosing a product and checking out ...
1
vote
3answers
128 views

Why is it so difficult to stop Ad Blockers?

My understanding of how ad blockers work is essentially that they just look at the domains sending the information. Why has no one been able defeat ad blocking software in a general sense?
1
vote
2answers
74 views

Is the same browser equally safe on a different OS?

For example: is Chrome installed on Linux more prone to a hack (stealing logins/passwords, installing add-ons, changing something in browser...) than Chrome installed on Windows? (I do realize that ...
2
votes
2answers
385 views

Why does OWASP recommend “Disable Web Browser Cross-Tab Sessions”

I have been looking through the OWASP session management cheat sheet and I don't understand the reasoning behind the suggestion to "Disable Web Browser Cross-Tab Sessions". How does using the same ...
16
votes
2answers
800 views

Alternatives to HTML's deprecated <keygen> for client certs?

The keygen tag is used to make browsers generate private keys and POST the resulting CSR to the server, which can then issue a certificate. It's now been deprecated, for rather stupid reasons but that'...
0
votes
1answer
134 views

Can anyone access my computer if I use tor browser?

Today I was told that if I use tor browser, hackers may access my Computer and can delete or copy files from my Hard Drive. Is it really true? Can hackers access my computer If I use tor? Thanks ...
0
votes
1answer
58 views

Why only Google warn us about attackers?

There are so many search engines like ask.com, yahoo.com and many more, but only Google warn us about attackers. Why so?
2
votes
2answers
155 views

I delete cookies file in chrome but i'm still logged in after I restart Chrome

I'm using linux and google chrome as browser. I know that cookeis are stored at /home/my_name/.config/google-chrome/Default/Cookies. I deleted this file but it seems like when I restart Chrome and ...
0
votes
4answers
154 views

Is session expiration for all web applications possible?

In case someone visits an infected site his safety, if his cookies get stolen, may be compromised. Is there any abstract way to expire a session on the stolen session-id so that the id is practically ...
-6
votes
2answers
227 views

What does “;” mean in the link [closed]

In some links, I found ;. Example: https://example.com/index.php?action=pm;sa=send;u=1 What does that mean? Is it a web application firewall?
3
votes
1answer
60 views

OCSP responder servers and malicious site blocking

So I've been looking for an answer to this one but no one seemed to have asked this before. As far as I understand, when connecting to a website. The browser sends a query to an OCSP server to verify ...
5
votes
1answer
130 views

Browsers and HTTP Public Key Pinning

The strength of HTTP Public Key Pinning (HPKP) is that the browsers are saving the keys from the HTTP header and can check in the future if the certificate from the website is valid. I have two ...
1
vote
2answers
46 views

Access LAN services through malicious web page

Suppose that a user on a corporate network has access to a private FTP server, or intranet site, that's only available on the Local Area Network, available at http://internal.example.com. If an ...
27
votes
3answers
6k views

Firebug appears to be decrypting SSL traffic: is it the correct behaviour?

In my company we were writing a small web application which would be hosted and tested under HSTS protocol. One of my tester complained that the username and password can be seen in cleartext so it ...
1
vote
1answer
140 views

What browsing history exactly would police have under proposed UK law change? Plain english

It's very unclear what '12 months' browsing history being kept by network provider' actually means to an uninformed person. Thunderbird? VPN? Startpage searches? Bit-torrent downloads? Epic browser (...
2
votes
1answer
79 views

WebRTC attack surface area?

I'm building an app for browser-to-browser communication. What is the attack surface area for WebRTC in 2015? What kinds of attacks could be done? And more importantly, how do I craft something ...
4
votes
2answers
192 views

SSLStrip still HTTPS

I did all the configuration right. IPtables, port forwarding, ARPspoof, everything. However, in the browser websites like Facebook and Twitter are still HTTPS. What am I doing wrong?
-1
votes
2answers
105 views

Is it dangerous to interrupt session on a web-site?

For example if I just close page or browser or anything else (without clicking "log out" on a site) - can this somehow endanger my account (info leaking or illegal access to an account) ?
2
votes
0answers
26 views

Why has the “Origin” HTTP header not been universally adopted? [duplicate]

After running tests on a few browsers on browserscope.org, I noted that neither Firefox or IE have adopted the "Origin" HTTP header. This header is a useful and valid way of helping prevent CSRF ...
3
votes
3answers
34 views

What would be the valid approach while handling short links [duplicate]

In modern world people often use to send urls with url shortners from various webservices,Mostly we use url shortners to shorten the url But in terms of exploits,phishing attempts how could we avoid ...
4
votes
3answers
239 views

HOW is the malicious URL/payload is delivered to the user on a DOM based XSS attack?

Testing for DOM based XSS at OWASP reads: The first hypothetical example uses the following client side code: <script> document.write("Site is at: " + document.location.href + "."); </...
4
votes
1answer
460 views

Why does sslstrip+ fail to intercept the traffic from websites like facebook and gmail?

I have been reading an article about sslstrip and mitm. Before the introduction of HSTS it was possible to strip ssl and send an insecure http page to the victim. Anyway it was overcome by using HSTS ...
2
votes
2answers
108 views

which encryption is used in this JS Variables

Which encryption method is used for these variable names: var g_license_info var g_server_time_obj Respectfully encrypted to: var ago05b4e111efe149737a67a177f00ffad2 var ...
2
votes
2answers
116 views

Disabling downloads in the browser; are there any benefits?

I was playing around with the security settings in my browser (IE) after being attacked by malware. I noticed an option to disable downloads. If I were to disable downloads, and re-enable them when ...
1
vote
1answer
123 views

Where does the list of trusted content authorities come from when using a web browser?

I was asked "how do browsers know whether or not to trust the certificate from the server it's connecting to" and thought it was a pretty good question. After doing some googling I found two answers: ...
8
votes
2answers
1k views

How does BeEF work and how can it be persistent

BeEF - the browser exploitation framework. I think (thought) I had a basic working understanding of how it works. Recently, though, I was watching, this DEFCON talk, where a hacker used a man-in-the-...
2
votes
3answers
217 views

Spoofing random browser information to defend against fingerprinting

Tor goes the way of trying to make everyone look the same to defend against browser fingerprinting. Wouldn't a simple addon that changes/adds as much information as possible randomly in short time ...
1
vote
2answers
1k views

can web application disable browser's password manager's remember feature for that application?

Is there anything a website code do to prevent any browser from remembering your password? I am aware that from browser's options, users can change setting to ask to remember password or not. But can ...
0
votes
2answers
296 views

Chrome/ Opera continue to save & autofill passwords after installing LastPass? Good or bad? Enable/ Disable?

I started to use LastPass a few months ago and imported passwords from my browsers. Apparently, Google Chrome and Opera (based on Chromium) still pop-up the option to store passwords in my browser ...
2
votes
2answers
123 views

Custom browser based on Internet Explorer - Uniqueness questions

I have developed a custom web browser for Windows using C# (based on Internet Explorer 11) and I'm trying to understand & solve the next issues: 1. I adjusted the User Agent string and the ...
0
votes
1answer
263 views

Chrome + EMET= How Strong Realistic Protection Against Browser-Based Threats?

tl;dr: How secure is a combination of a sort-of hardened Google Chrome + Microsoft Enhanced Mitigation Experience Toolkit 5.1 against browser-based threats that I do not expect to be highly ...
1
vote
4answers
144 views

Redirection Malware Infection

I have AVG Antivirus installed on my PC. My PC is infected with some kind of bonjovi redirection malware. It randomly opens up a new tab in Chrome and loads porn sites. I have had this infection in ...
-2
votes
1answer
206 views

Online Password Storage: Is this safe and how can I implement this?

Hello there for an online Tool which offers the feature of storing passwords online I want to implement the following process: A user is generating a secure secret random key with Javascript This ...
3
votes
1answer
2k views

How to authenticate in a website with public/private keys?

I've been reading how the SSH public/private key works and realized how handy they are (taking the secure out of the equation). And started to wonder why websites do not implement the same thing? ...
0
votes
1answer
80 views

Warn on (plain, unencrypted) HTTP: in which prominent security talk was this advocated? [closed]

Some months ago, I watched online a video recording of a talk/presentation aimed at an audience interested in information security. The talk concerned UI/UX/usability, convenience, and security, and ...
0
votes
2answers
194 views

Many suspicious requests are going from my browser whenever open any site

Whenever I open any site there are so many suspicious request are shown in my network panel of browser. I scan my system with many antiviruses too, but still facing the same issue. And sometimes I ...
3
votes
1answer
186 views

Dangers of WAP billing?

Recently I clicked an ad by mistake on my phone and it routed me through different pages and popups automatically. On of the pages had my mobile phone provider in its URL and WAP-billing. So I ...
2
votes
2answers
120 views

Can BlackBerry keep us safe from network providers

I recently brought a BlackBerry mobile and the reason I have gone with BB was the security it ensures and now I have a doubt. That said in the Internet, Massage from BBM will first reach Canada via ...
3
votes
0answers
38 views

How to disable typed arrays in firefox as rowhammer mitigation

I am concerned about the potential attack surface exposed by JavaScript typed arrays as a means of performing rowhammer attacks. Is it possible to disable (via official means or otherwise) typed ...
15
votes
5answers
2k views

What is the difference between http and https with a self-signed SSL certificate?

A colleague of mine has told me he doesn't see why there is a warning when visiting a HTTPS website with a self-signed certificate saying that the security may be compromised, but there is no warning ...
4
votes
2answers
110 views

apple.com exploit attempt?

I recently browsed to apple.com; and the page crashed a few times, then after I reloaded I was given this alert after my browser attempted to redirect to res://ieframe.dll/acr_error.htm#apple.com,http:...
6
votes
3answers
339 views

Using Lynx on potentially malicious websites

After needing to refresh how to unpack an android ramdisk, the site I remember having good information comes up with something similar to this: Being cautious, but still wanting to get what was on ...
1
vote
3answers
492 views

Can a shim (a.k.a. polyfill) be installed in IE, FF, or Chrome without user knowledge, and can it read passwords entered by user on a login page?

The questions here are about shims in the 3 most commonly used browsers. A shim (also known as polyfill) is a piece of code (often JavaScript or Flash) implemented to augment the native API in a web ...
3
votes
2answers
233 views

Should I regularly erase cookies?

Cookies really do make for a better experience on the web but do they also create a vulnerability? How often should I clean them out and what benefits are gained by doing so?
3
votes
1answer
802 views

Does a Content-Type: text/plain header protect against XSS in browsers?

I'm creating a small web script that mostly redirects the browser but has some error conditions when input parameters cannot be validated. I'd like to display error messages like parameter XXX had ...
-1
votes
1answer
98 views

Why do browsers have no built-in features to verify the integrity of downloads? [closed]

I just started a download of a large file. Checksums were placed prominently on the download page. But I just realized that I actually never made use of any of the checksums provided for download ...