A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

learn more… | top users | synonyms (2)

8
votes
1answer
845 views

Device fingerprinting & Mass Computer Surveillance

Device fingerprinting is one of the biggest privacy problems as explained because people think cleaning cookies, using proxy servers or blocking domains can protect them (when blacklisted trackers ...
8
votes
2answers
349 views

How will SHA1 deprecation affect internal CA's?

I am hearing that the SHA1 Deprecation notices from MS/CHROME only apply to certs that are a part of a public trusted root program. This makes one believe that IE will have new logic built in to allow ...
7
votes
4answers
640 views

What abuses can an infected webpage do to me if I'm using Chrome and Flash is disabled

as a follow-up to this question Can you get virus just by visiting a website in chrome., I've read these pages: http://www.straightsectalk.com/?p=47 ...
7
votes
4answers
823 views

How big is the risk, to enable scripting in the Web browser?

While browsing the web, many websites executes scripts (mainly javascript) that are executed without the user noticing. How big is the risk, to get Malware unnoticed while surfing with scripting ...
7
votes
5answers
3k views

What are potential security risks when using an insecure wireless connection?

If someone is using an insecure wireless connection (for example a hot spot in a coffee shop) does it pose a threat even if the person is using a secure application layer protocol? What I mean by ...
7
votes
3answers
519 views

How secure is HTTPS with weak ciphersuites?

Today I came across the website https://mtgox.com/, which claimed to be secure because of the Verisign certificate. I checked the certificate out of curiosity (it's the first thing they claim, let's ...
7
votes
4answers
4k views

What web browsers support OCSP stapling? Are the privacy and performance features the same?

OCSP stapling decreases the load on a PKI infrastructure's OCSP server by attaching a signed OCSP response to the target in a TLS connection. In addition it creates a more secure/private session ...
7
votes
2answers
612 views

Firefox Add-ons not using HTTPS? Security bug. (?)

If I add a rule in Privoxy: echo '{ +redirect{s@http://@https://@} } .mozilla.org' >> /etc/privoxy/user.action then I can't install Firefox Add-ons. Why? I though the Firefox Add-ons ...
7
votes
1answer
2k views

What are the benefits and drawbacks of the HTML5 Keygen element?

As of January 2013, what are the potential benefits and drawbacks of the HTML5 Keygen element?
7
votes
3answers
3k views

Any additional security with large blacklisting hosts file?

I run Windows with a pretty hefty c:/windows/system32/drivers/etc/hosts file obtained from http://winhelp2002.mvps.org/hosts.htm. I update this file as regularly as I remember and layer it with ...
7
votes
3answers
282 views

Detecting OAuth malicious Implementation

I am wondering how can an end-user detect a maliciously implemented OAuth whether 2-legged or 3-legged. Particularly I am interested in those cases where the consumer requester is maliciously ...
7
votes
3answers
4k views

SQL Injection How to inject Clean/Rest URLS

I have a question I'm hoping you could help me with? Unclean url's: http://example.com/index.php?page=foo http://example.com/products?category=2&pid=25 ...
7
votes
3answers
2k views

Web Browsers and Cross Origin Resource Sharing

The CORS spec states that if a request method and headers are not simple (http://www.w3.org/TR/cors/#simple-cross-origin-request) then a preflight HTTP OPTIONS request is sent to see if the request is ...
7
votes
1answer
880 views

Access to other local files from a local HTML file

I tried this question on programmers site with no luck Do you see any reason to block a local html file from accessing another local files located in the same folder? I mean, if a user downloaded an ...
7
votes
3answers
529 views

Why do Firefox and Chrome “leak” critical security information out of the browser and how can I stop it?

In studying SSL / TLS handshakes and encryption, I found a method that describes how to export the SSL / TLS session keys from Firefox to an user or environmental variable outside the browser, and ...
7
votes
5answers
4k views

Browser hijacked - how to fix and prevent?

For the second time in a month, my work PC has been infected with malware that is hijacking my Google search results in Firefox. A search for the URL hijacked searches end up at turns up nothing on ...
7
votes
3answers
4k views

Any browser that supports script-nonce?

I was trying to include script-nonce on my html file, but seems like none of the current browsers support it. Is anyone aware of any version of any browser that supports this functionality? I'm ...
7
votes
3answers
475 views

Is it advisable to have a web browser remember login credentials?

I have a really long random password for my cellphone account and have it written down in a safe place. I only use it once a month and am considering having my browser remember it. Would there be any ...
7
votes
3answers
222 views

Using Lynx on potentially malicious websites

After needing to refresh how to unpack an android ramdisk, the site I remember having good information comes up with something similar to this: Being cautious, but still wanting to get what was on ...
7
votes
3answers
4k views

Exactly how secure is VM browsing?

I generally do all of my web browsing in a VM. I have one "safe" VM running Ubuntu that has guest services installed. I generally only go to sites I deem are trustworthy here. I also have an "unsafe" ...
7
votes
2answers
979 views

Browser based virtual machines

How would applying hypervisor (e.g. xen) principles in the development of a web browser offering isolated browser tabs (virtual machines) improve or reduce security of existing web applications (good ...
7
votes
2answers
224 views

What security measures does Chrome have in place to sandbox different user accounts?

Google Chrome has a feature that allows different users to use Chrome on the same computer in a completely separate space. The support page is quite light on information. Is there information ...
7
votes
3answers
2k views

Are Web Views in android secure?

"Web Views" are views that display some online content, usually a webpage within an android app. Implemented "Web Views" usually don't seem to have any kind of status bar or an address bar to confirm ...
7
votes
1answer
968 views

Have any viruses leveraging the GPU been discovered in the wild? What is the mitigation?

This news article from 2010 discusses how a GPU can be used by a virus to avoid detection by common anti-malware/anti-virus software. The idea is to obfuscate the virus payload and leverage the GPU's ...
7
votes
3answers
294 views

Same Origin Policy - XHR response

I know that Same Origin Policy (SOP) prevents a page/script from one origin to read response from another origin, but it does not prevents the page/script from making a XMLHttpRequest (XHR) request to ...
7
votes
3answers
3k views

How to sandbox Iceweasel (Firefox) on Debian? [closed]

Are there any tools for sandboxing Iceweasel (Firefox) on Debian systems? I'm mostly interested in tools distributed by Debian. (An equally trustworthy source would be second best.) (I suppose that ...
7
votes
1answer
527 views

How do I check the code of a Chrome extension to make sure it's not stealing my info?

I've been reading more and more about just how much access browser extensions can have to your data. This is a little unsettling, so I'm curious if there is a way to Vet these extensions and make sure ...
7
votes
4answers
2k views

Web browser password management security [duplicate]

Possible Duplicate: How are browser saved passwords vulnerable? How secure are the password managers that are built into modern web browsers? Currently I use lastpass plugin as I believed ...
7
votes
1answer
138 views

Protection against clickjacking in Firefox without installing addons?

On some of my workstations I never allow Javascript in Firefox. The NoScript addon is installed on these machines, but I would like to remove it and disable Javascript via about:config instead. ...
7
votes
1answer
133 views

Disable HTML5 battery features

HTML5 has a feature set relating to client battery status. It has been described as a privacy hole, as it can be used to track and identify web users. Research suggests the features can be used even ...
7
votes
2answers
116 views

What are the security benefits to block all http referer header requests for web browser?

I would like to know also if you lose site functionality. Is this a security benefit that is beneficial than compromising functionality (if compromising at all)? What I mean by this is one a ...
7
votes
1answer
770 views

Child iFrame hash verification of parent iFrame content

Consider the following scenario: Alice wishes to browse Victor's website while on the job at Initech. Victor's website is hosted on an alternative domain name system to which Initech's DNS does not ...
7
votes
5answers
283 views

Can a website detect my local WIFI network I am in?

I have two computers, both of them locate at the same local WIFI network ( ie: connected to the same router). I use VPN on a computer to visit a website, and don't use VPN on another to visit the ...
6
votes
5answers
346 views

What's the real reason behind blocking the social sites? Even legitimate sites like Twitter which acts as a knowledge repository?

I see some sites are blocked for IT security at schools, colleges and offices. But, why are some obvious good sites blocked too?
6
votes
4answers
4k views

What is a good browser for web application pen testing? [closed]

I am getting started in testing web applications, and I am having trouble verifying vulnerabilities. It seems all modern browsers have protections against things like XSS. When something like Burp ...
6
votes
3answers
23k views

Can a website still detect my real MAC address even if I use different virtual machine each time I visit the website?

Suppose I use a proxy and a different virtual machine each time I visit a particular website, will a website still be able to detect my MAC address and/or uniquely identify me? Assume that the website ...
6
votes
3answers
406 views

How safe are copies of Firefox that are on various Mozilla mirror sites?

If I end up downloading a .dmg or .exe (depending on OS) installer from some mirror site, how can I be sure that a virus or trojan or spyware has not been added? I don't see any mechanism for ...
6
votes
3answers
3k views

How can a “server” know that what browser i'm using besides the user-agent?

How can a "webserver" know (or a sniffer between the srv<->and the client) that what browser i'm using besides the user-agent? Are there any "magic tricks"? javascript? java? How can I securely, ...
6
votes
2answers
265 views

plugins to lengthen short urls for security purposes

Came across this question What browser plugins can help us to see the actual destination of such shortened URLs?
6
votes
3answers
1k views

In what way is a partially encrypted webpage insecure?

What are the potential vulnerabilities that might arise if a webpage is only partially encrypted. I can think of 2 possibilities: You can change the non-encrypted parts of the page (HTML, CSS, ...
6
votes
2answers
9k views

DOM Based XSS attacks: what is the most dangerous example?

I knew that XSS attacks (“non-persistent” and “persistent”) can hijack user session, deface websites, conduct phishing attack, etc. However, I can't understand what is dangerous of DOM Based XSS if ...
6
votes
4answers
6k views

How to avoid leaving any local trace that I went to a website?

I want to visit a web site, but I want to ensure there is no trace left on my computer that I did so. How do I do that? This question is not concerned with anonymity or detection on the network ...
6
votes
3answers
2k views

Is it possible to use Greasemonkey to hack a website?

Yesterday my WordPress website got hacked. I thought I had done all necessary things to make it secure. One of my colleagues said that with Greasemonkey we can easily hack sites. Is it true? How can I ...
6
votes
2answers
783 views

Workarounds for :visited CSS History reconnaissance

Several years ago it was possible to use a:visited { background: url('/log.php'); } to figure out on what website user has been previously. But now it is restricted by browsers. Is there any ...
6
votes
2answers
2k views

Considering that SRP is better than SSH and Basic Auth, how can it be implemented in a website?

SRP is short for Secure Remote Password protocol, and provides a better way for passwords to be sent over the internet. I've read the information at it's Stanford University home page, the Wiki ...
6
votes
3answers
55k views

HTTPS icon red and crossed out - Chrome browser

What does it actually mean when the HTTPS icon is red and crossed out in Chrome? Does this mean that the site is vulnerable to a Man in the Middle Attack? Is it safe or not?
6
votes
4answers
2k views

Suggestions to avoid cookie-hijacking in a web application

I've been developing web-apps for quite some time now. While making websites, the "remember me" feature is one of the most trivial(read as must-have-for-clients) feature to be implemented. Until ...
6
votes
2answers
411 views

What protects cookies?

What protects cookies from being stolen? After all, they are just text files. A misbehaving browser can give up a lot more information that web masters would like. How do I know that a browser won't ...
6
votes
3answers
237 views

How to add certificate pinning for a certain domain to my web browser?

There is HPKP (HTTP Public Key Pinning) which servers use to tell the client's web browser which certificates to trust (in the future) for the domain that is being contacted. Google's Chrome and ...
6
votes
3answers
384 views

Are there guidelines for application design of HIPAA compliant browser applications?

This is a different twist - I'm pushing dispatch information to first responders, such as fire, police, and EMS. But they all could, potentially, include medical information and PII together. My goal ...