A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.
4
votes
1answer
142 views
What countries have laws in place that respect Do Not Track HTTP headers or cookies?
Google offers a Chrome plugin that uses cookies to control privacy, while Firefox offers a HTTP Header to tell websites to not track the users and log the data anonymously.
This obviously extends a ...
3
votes
5answers
302 views
Does the padlock on my browser really indicate a reasonable assurance against eavesdropping?
I know that there have been broken or weak SSL implementations. Do browsers actually have decent standards for what they'll accept and display "the padlock"?
Furthermore, are there any practical ...
3
votes
3answers
348 views
What is the actual security of this login page?
Please visit https://devforums.apple.com
If I visit this site using my Safari 6 web browser, this page does not show the normal security indicator that secure sites normally show.
Does this ...
3
votes
3answers
384 views
cookies “secure” flag
How does cookies "secure" attr work to determines whether cookie itself should be included?
e.g.
[HTTP(unencrypted) connection]
1. user has no cookie yet and tries to log in;
2. user logs in ...
3
votes
2answers
348 views
Can one get infected through visiting a site with a PHP script on it and if yes, how?
I can imagine a clientside JavaScript that gets executed in a vulnerable browser to do some harm, but how can this be done with PHP?
Since it's serverside it shouldn't have access to the visitor's ...
3
votes
4answers
710 views
is using “HTTPS everywhere” extension secure?
I would like to know if one should use 'HTTPS everywhere' extension? is it secure to use it? Are there any better alternatives?
HTTPS Everywhere is a Firefox and Chrome extension that encrypts ...
3
votes
4answers
170 views
Attack where browser URL appears valid
I remember reading about an attack where the "location bar" in a user's browser displays a valid URL (e.g. https://www.paypal.com/), but the traffic is really being directed to or intercepted by an ...
3
votes
4answers
286 views
how can you inject malicious code into an innocent-looking URL?
I am learning about XSS attacks. Wikipedia says that in a non-persistent attack an attacker may provide an innocent-looking URL that "points to a trusted site but actually has an XSS vector." What ...
3
votes
4answers
213 views
FireFox's restore previous session restores logins authenticated by server's sessions
In a website I'm building when I login, close FireFox, open FireFox and try to go to the website again I must login again (as expected) BUT if I select "Restore Previous Session" I am logged in again. ...
3
votes
2answers
1k views
Do most browsers handle mixed encrypted and unencrypted content correctly?
In Google Chrome, when I go to an encrypted page that contains unencrypted content, I get the following pop-down, which allows me to either load or not load the insecure content, making a clear ...
3
votes
4answers
178 views
Improving the privacy of a casual Web user
I am interested in improving the privacy available to me as a casual internet user with a default browser. I think that Tor is too slow and that the "Privacy Mode" in browsers isn't really practical. ...
3
votes
1answer
467 views
SSL, SSH, OPENVPN, etc which one?
To start with I am not a security professional, in fact I am on the other end of the spectrum. In the opinion of people on this site what would you choose for secure internet browsing. I will be ...
3
votes
3answers
289 views
Is Content Security Policy an approach that is worth to support?
Mozilla Firefox 4.0 supports something called Content Security Policy that disables the interpretation of embedded Java Script. Only external Java Script files that are referenced using a script tag ...
3
votes
2answers
466 views
Why do I get AV alerts when browsing a web page?
I'm using the latest version of Firefox and Windows is up to date. When I was browsing a webpage and clicked a link the browser displayed "connection has been reset" and AVAST poped-up saying "Alert!" ...
3
votes
3answers
902 views
sslstrip vs. privoxy redirect rule on clients
I watched this video: http://www.securitytube.net/video/193 Now I'm thinking about an example.
Suppose I have a privoxy proxy on my PC:
user.action file (just part of it):
{ ...
3
votes
1answer
1k views
cookie path protection within same domain
The answer to this question about how cookies are potentially vulnerable between sub-domains sparked my curiosity.
As far as I know, if a cookie is set on a sub-path of the same domain ...
3
votes
2answers
64 views
What precaustions should be taken when the file displayed by a webpage is specified by the GET value
My website shows some files based on the get value in the URL. For example http://www.mysit.com/navigate.php?d=firstpage.html The thing is navigate.php knows which folder to look in and it's not in ...
3
votes
3answers
745 views
Do browsers allows pages loaded on one tab to access/intercept/inject data in other tabs?
I was surprised to hear from this Reuters video that it was possible for a page loaded on one tab to access and/or inject data onto another page loaded on a different tab.
TL;DW (too lazy; didn't ...
3
votes
3answers
211 views
Where's the security when a payment gateway let website handle Credit Card detail
Has anyone worked with eWay payment gateway before?
Basically, there's a service endpoint where you post the customer's detail and credit card details from the web application after the browser sends ...
3
votes
1answer
149 views
How will users know if their session is DNSSec protected or not?
There is definite security value in having DNSSec-verified connections, however I have yet to see software indicate if the connection is secure.
Ultimately I would like my users to recognize that ...
3
votes
3answers
139 views
Warn about specific CA in Firefox
Consider a setup where all HTTP/HTTPS traffic goes through a proxy. The certificate of this proxy must be trusted by all browsers (in this case, Firefox). This certificate replaces the original ...
3
votes
1answer
152 views
How can Bank of America tell that I'm logging in on a computer I haven't used with them before?
When you sign into Bank of America for the first time on a computer that you haven't used with them before, they detect this and force you to answer one of your security questions. I think I've seen ...
3
votes
2answers
204 views
Any browser that supports script-nonce?
I was trying to include script-nonce on my html file, but seems like none of the current browsers support it.
Is anyone aware of any version of any browser that supports this functionality?
I'm ...
3
votes
1answer
96 views
How safe is “trust this computer” option for websites?
Many sites have a "trust this computer" option that allows one to bypass some security measures (ex.: with Google's 2-step authentication enabled, one does not need to enter the phone's code if the ...
3
votes
2answers
202 views
Risks of serving untrusted content under HTTP Content-Type: text/plain?
Am I gonna run into XSS attacks by doing this, or will a file download be prompted?
Are there security problems that would rise in a modern browser?
3
votes
2answers
108 views
Vertical information portal security with a customized web browser
I am creating a SaaS that will be delivered through a Vertical Information Portal (VIP).
In my research I have found that by developing a custom lean web browser and installing it on the clients ...
3
votes
1answer
150 views
What servers or clients are immune to related-domain cookie attacks? (*.example.com)
In this question, I want to identify browsers, servers, or implementations that are immune from related domain cookie attacks (e.g. a.example.com vs b.example.com).
Lacking any tangible solution, ...
3
votes
2answers
2k views
Can Cookies Without the Secure Flag be Stolen, even when only accessed via HTTPS?
Is it possible to capture the cookies used by HTTPS site when cookies don't have secure flag set.
Suppose the site is https://www.example.com.
http://www.example.com does not show up, also ...
3
votes
1answer
258 views
What does it mean when a webpage says refresh is disabled?
https://www.grc.com/x/ne.dll?rh1dkyd2:
To safeguard your privacy we have disabled the browser's "reload" or "refresh" facility while you are in sensitive areas of our web site. Reloading pages ...
3
votes
2answers
247 views
Web Certificate invalidation - You might be connecting to a website that is pretending to be [Site name]
Recently while trying to log-in to facebook this notification starts to appear
at first I ignored it (by pressing Continue), but it started to popup every time I navigate through the website!
I ...
3
votes
1answer
158 views
How can I assess the trust worthiness of a browser add-on?
Having learned a bit more about what add-ons/extensions can do in Firefox, I want to minimize my risk and use some safer mechanism to download videos (FLV in particular) for later viewing.
...
3
votes
3answers
269 views
Protecting websites from outdated browsers and plugins via a whitelist/blacklist combination?
Aside from using browser headers, I want to blacklist/whitelist browser and plugins from my site so that I can prevent these older unpatched systems from (1) being a general user of my site (2) ...
3
votes
1answer
1k views
DOM Based XSS attacks: what is the most dangerous example?
I knew that XSS attacks (“non-persistent” and “persistent”) can hijack user session, deface websites, conduct phishing attack, etc.
However, I can't understand what is dangerous of DOM Based XSS if ...
3
votes
1answer
69 views
Possible to redact information in the clipboard, or to auto-redact when it hits a webpage?
Sometimes when I paste information to a website I realize after I post the information that I inadvertently included an IP address, username, email address, or other information I'd like to consider ...
3
votes
2answers
472 views
How can end-users detect malicious attempts at SSL spoofing when the network already has an authorized SSL proxy?
I'm working on one client's network where they have enabled HTTPS authority spoofing on their proxy. This allows them to effectively perform a man-in-the-middle attack to decipher all outgoing ...
3
votes
1answer
299 views
Apple Developer Account Hacked?
I just did a fresh install of Snow Leopard on a newly-formatted hard drive.
Logged into the iPhone Developer Page with Google Chrome (latest build) here:
...
3
votes
1answer
135 views
Client-side cross-site access in SSL environment - when it's still possible to do?
I'm trying to imagine an secure sandboxed environment for an application which is big and unexplored, and may contain backdoors. It would live under chroot/virtual environment with no outgoing ...
3
votes
3answers
648 views
What are some recommended open source tools for web browser history analysis?
I'm looking at a series web browser histories from various browsers (IE, Chrome, Firefox, etc) and need to do some analysis. All of these browsers store data much differently, but I was wondering if ...
3
votes
1answer
160 views
How secure is a https website? [duplicate]
Possible Duplicate:
Does an established ssl connection mean a line is really secure
When I visit a website -- say, https://ebanking.pick-your-bank.com -- my browser (fully patched version ...
3
votes
1answer
178 views
How dangerous is a virus introduced to a malicious website in chrome?
I am using Google's Chrome browser under Linux (Ubuntu) 64 bit for web browsing.
If I a virus uses for example a leak in the flash player, the virus will get the privileges of the user who started ...
3
votes
1answer
107 views
How can I use certificates to secure my webservices? What is available to javascript?
I have a few web services that are accessed over public wifi connections and I think it would be a good idea to issue certificates to encrypt data, prevent MITM, and invalid impersonation (beyond what ...
3
votes
1answer
1k views
Why does Safari seem to be accepting an HTTPS connection every other browser rejects?
This question is inspired by a bug/issue in recent Linksys router firmware. Essentially, something has changed recently that's preventing HTTPS access to the web admin on current generation Linksys ...
3
votes
2answers
84 views
Automated browser-level countermeasures to look-alike login pages
For example, say an unsuspecting visitor gets a link security.stackexchange.com/.... Then it re-opens the login page, with or without an explanation as to why they have to log in again. (this is more ...
2
votes
7answers
588 views
Chrome vs Explorer - how to explain in plain words that open-source is better?
Why open-source is better in plain words?
Yesterday I had a talk at a DIY bicycle workshop. There is a PC (running XP) that main application is checking emails (nothing really serious).
I found it ...
2
votes
4answers
303 views
Clickjacking: can't browsers just forbid/reject placing transparent elements over frames?
Why not? Seems like this is only used for clickjacking, the solution should be simple enough.
2
votes
3answers
211 views
How prevent Javascript from obtaining my location
I usually use a proxy server to browse anonymously. Now I realize that it is possible to find the location of a user using the Geolocation API. How to anonymously browse without disabling Javascript?
2
votes
6answers
216 views
Can one reliably show HTTPS status in browser (not just the lock in the URL bar)?
I'm almost certain this isn't possible, as it would probably be too exploitable, but I wanted to ask the community just in case.
Is there a way to determine and display the state of HTTPS on a page ...
2
votes
2answers
368 views
How does the Yahoo webmail exploit work?
I got an email (referring to me by name) from somebody I knew a while ago and the email itself was just two/three lines containing a bit-ly link. Although it seemed like it actually could be ...
2
votes
3answers
200 views
How hard it would be to infect a system with malware through a portable web browser
If I use a portable web browser on a USB device like
Google Chrome Portable how hard it would be to get infected by a malware/virus in the system to which the USB device is connected?
Google Chrome ...
2
votes
4answers
933 views
What web browsers support OCSP stapling? Are the privacy and performance features the same?
OCSP stapling decreases the load on a PKI infrastructure's OCSP server by attaching a signed OCSP response to the target in a TLS connection. In addition it creates a more secure/private session ...
