A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.

learn more… | top users | synonyms (2)

5
votes
1answer
198 views

Is this a security flaw in Firefox 18.0?

I had a couple of .mht files which opened in IE, a browser I never use. I renamed their extension to .HTML to run it in Firefox. When I opened the file in Firefox, Firefox created new tabs endlessly. ...
5
votes
2answers
455 views

RC4 bias protection with padding in TLS

On the answer to my previous question about RC4 vulnerabilities in TLS, Thomas Pornin gave a great answer, in which he said: One way to "fix" RC4, which has been suggested many times, is to drop ...
5
votes
1answer
960 views

What are the benefits and drawbacks of the HTML5 Keygen element?

As of January 2013, what are the potential benefits and drawbacks of the HTML5 Keygen element?
5
votes
2answers
465 views

HTTPS Sensitive Information and Caching

I have a website where I need to share a sensitive key with the user. Of course, I'm using HTTPS on the page. The key is put into the HTML server-side in ASP.NET. My concern is, if the user's computer ...
5
votes
2answers
308 views

What protects cookies?

What protects cookies from being stolen? After all, they are just text files. A misbehaving browser can give up a lot more information that web masters would like. How do I know that a browser won't ...
5
votes
3answers
580 views

Any browser that supports script-nonce?

I was trying to include script-nonce on my html file, but seems like none of the current browsers support it. Is anyone aware of any version of any browser that supports this functionality? I'm ...
5
votes
2answers
463 views

Workarounds for :visited CSS History reconnaissance

Several years ago it was possible to use a:visited { background: url('/log.php'); } to figure out on what website user has been previously. But now it is restricted by browsers. Is there any ...
5
votes
7answers
343 views

Malicious Websites

Just wanted to get everyone's opinion on this. In Information Security, you get various alerts about particular machines on your network going to sites and/or IPs that have been flagged as ...
5
votes
1answer
195 views

Where does the responsibility lie for a XSS vulnerability

I am an avid user of Workflowy (online outliner/note taking tool) and I installed the Chrome extension 'Workflowy for Coders', which formats the text within notes. I discovered that one of my notes ...
5
votes
1answer
29k views

Chrome is telling me I am receiving a forged certificate for Gmail, is someone trying to hack me?

I went to log on to https://mail.google.com this morning and I got the following error. Is someone trying to attack me or is this just a bug? I'm on a WPA2 encrypted wireless connection using Chrome ...
5
votes
3answers
868 views

Are Web Views in android secure?

"Web Views" are views that display some online content, usually a webpage within an android app. Implemented "Web Views" usually don't seem to have any kind of status bar or an address bar to confirm ...
5
votes
1answer
634 views

When and Why does Chrome display malware detection warning?

Google Chrome contains malware detection feature. When user visits some site, browser may display warning that site contains malware. What does it mean that site contains malware? Does it mean that ...
5
votes
4answers
410 views

Is it harmful to redirect web bugs to localhost on hosts file?

I was checking the article hosts file on Wikipedia, and I found this: Blocking access to servers of unwanted content by redirecting them to the local host (127.0.0.1) may have security ...
5
votes
3answers
2k views

How can I protect my saved passwords in Chrome?

I'm currently using WIN+L, and sometimes Kid-Key-Lock, to prevent anyone from checking my storaged passwords but if I forget doing it only once, all of them are vulnerable of theft. How can I protect ...
5
votes
1answer
192 views

What issues might exist with TLS-OBC's emulation of Browser Certificates?

TLS-OBC is an RFC proposal that increases SSL/TLS security by using certificates on both ends of the TLS connection. What's special here is that the client is permitted to dynamically create a local, ...
5
votes
1answer
200 views

How much protection does the Kill-Bit provide for ActiveX controls?

I have some ActiveX controls that are not supposed to run in the browser but only in my particular Front-End. I know that by setting the Kill-Bit I disable their execution in Internet Explorer and MS ...
5
votes
3answers
238 views

Are there guidelines for application design of HIPAA compliant browser applications?

This is a different twist - I'm pushing dispatch information to first responders, such as fire, police, and EMS. But they all could, potentially, include medical information and PII together. My goal ...
5
votes
1answer
487 views

Child iFrame hash verification of parent iFrame content

Consider the following scenario: Alice wishes to browse Victor's website while on the job at Initech. Victor's website is hosted on an alternative domain name system to which Initech's DNS does not ...
4
votes
3answers
409 views

Is changing image's extension prone to error for browsers?

In my uploading user's avatar scenario, I change users picture extension to jpg. Is this making the browsers to act differently? Is it prone to error for browsers when they read users avatar? ...
4
votes
4answers
517 views

Is silverlight and Java running on the web browser capable of saving “state” into the user's local machines?

I am aware that even after we have cleared our cache and cookies, websites can still save files/information into our computer using Flash (Flash ever cookies), I was wondering does other plugins like ...
4
votes
5answers
8k views

Playing with Referrer Header

There are 2 sites: http://www.site1.com http://www.site2.com http://www.site1.com contains link to http://www.site2.com as <a href="http://www.site2.com/">link<a/> When user clicks ...
4
votes
2answers
452 views

Can one get infected through visiting a site with a PHP script on it and if yes, how?

I can imagine a clientside JavaScript that gets executed in a vulnerable browser to do some harm, but how can this be done with PHP? Since it's serverside it shouldn't have access to the visitor's ...
4
votes
3answers
411 views

Are there security (esp. privacy) benefits to deleting cookies?

As the title says, I'm wondering if there are any security/privacy benefits to managing cookies - that is, managing by deleting cookies you don't want or need. I deleted all my cookies about a week ...
4
votes
4answers
204 views

Attack where browser URL appears valid

I remember reading about an attack where the "location bar" in a user's browser displays a valid URL (e.g. https://www.paypal.com/), but the traffic is really being directed to or intercepted by an ...
4
votes
5answers
3k views

How to avoid leaving any local trace that I went to a website?

I want to visit a web site, but I want to ensure there is no trace left on my computer that I did so. How do I do that? This question is not concerned with anonymity or detection on the network ...
4
votes
1answer
566 views

SSL, SSH, OPENVPN, etc which one?

To start with I am not a security professional, in fact I am on the other end of the spectrum. In the opinion of people on this site what would you choose for secure internet browsing. I will be ...
4
votes
1answer
2k views

cookie path protection within same domain

The answer to this question about how cookies are potentially vulnerable between sub-domains sparked my curiosity. As far as I know, if a cookie is set on a sub-path of the same domain ...
4
votes
3answers
357 views

In what way is a partially encrypted webpage insecure?

What are the potential vulnerabilities that might arise if a webpage is only partially encrypted. I can think of 2 possibilities: You can change the non-encrypted parts of the page (HTML, CSS, ...
4
votes
2answers
2k views

Does Java applets reveal the real IP address, even when using proxy or vpn?

Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?
4
votes
4answers
1k views

Is online banking more secure on iOS than a desktop computer?

Does Apple's iOS provide a more secure environment for online commerce (banking or shopping) than Windows or Mac OS X? Since the only software that can run on iOS must be vetted by Apple, the ...
4
votes
1answer
370 views

How did my homepage get changed in IE?

I have rarely used IE in the past. I just use it to test how a website looks. Today all of a sudden when I went on to open IE, it opened with a homepage that wasn't set by me. It was an address of a ...
4
votes
2answers
174 views

Is using a “Red” and a “Green” browser to balance LOB requirements and security a good approach?

I currently work in a manufacturing company with round about 5000 computers and 6000 employees. We use a lot of web based line of business applications (all internal, non over the Internet) in order ...
4
votes
2answers
2k views

How is user authentication sent in a public wifi? Radius/802.1x/EAP etc

I visit the airport, I pull out my laptop and connect to a network (no password needed). I open up my browser and i am presented with a screen saying I need to pay to use the network. If I pay, I ...
4
votes
1answer
182 views

How will users know if their session is DNSSec protected or not?

There is definite security value in having DNSSec-verified connections, however I have yet to see software indicate if the connection is secure. Ultimately I would like my users to recognize that ...
4
votes
4answers
3k views

Browser hijacked - how to fix and prevent?

For the second time in a month, my work PC has been infected with malware that is hijacking my Google search results in Firefox. A search for the URL hijacked searches end up at turns up nothing on ...
4
votes
3answers
296 views

Strategy against browser exploits on Windows?

On a friend's computer is some kind of spam bot installed. It sends messages like Hello: I received my apple iPad 32GB ordered on an online shop (www.elevalley.com ) today. So exciting ...
4
votes
2answers
190 views

Security of viewing a website containing Java applets offline

I've been wondering whether viewing a website offline increases the security risk. The reason why I'm asking is that having been a short time java applet developer (for a small task) I've come to ...
4
votes
2answers
689 views

JInitiator is obsolete and I should reject it on grounds of security, right?

I'm getting a lot of flack and resistance from developers for not allowing a large (200+ users) roll-out of Oracle's JInitiator (http://www.oracle.com/technetwork/testcontent/jinit-084453.html) as ...
4
votes
1answer
295 views

Do iframes maintain the security of the nested website?

I am planning to add iframes to my webpage to sites such as www.dropbox.com and was wondering if the security of the site would be impaired if i did this. As in, could peoples account be hacked if ...
4
votes
3answers
488 views

Web Certificate invalidation - You might be connecting to a website that is pretending to be [Site name]

Recently while trying to log-in to Facebook this notification starts to appear: At first I ignored it (by pressing Continue), but it started to popup every time I navigate through the website! I ...
4
votes
1answer
110 views

Security consequence of Javascript hole in an online chat?

For an online chat that allows basic HTML, what happens if they leave an open way for a potential hacker to execute javascript on everyone who is in the chat? What is the worst thing they could do?
4
votes
1answer
144 views

Resources/materials for implementing secure web services?

I'm implementing a REST-style (note: it needs to be more pragmatic than canonical) web API and I would like to secure it. The language I'm using is rather fresh and doesn't have a lot of high quality ...
4
votes
1answer
771 views

Same-origin policy for file: URLs in Android browser?

When you load a file:// URL in an Android WebView or in the Android browser, what does it treat as the origin? What can the Javascript on that page access? Can it access other files in the same ...
4
votes
1answer
153 views

How can browser select suggestions for my private searches?

I use a VPN service that provides a pool of IP addresses, I clean history/cookies/etc - all the browsing data before a session. Regardless, when I type in the search of one particular search engine, ...
4
votes
1answer
888 views

How to detect cookie stuffing attacks?

So the question is how to detect cookie stuffing attacks and how to protect against them? In case of image-based cookie stuffing I can detect that related resources are not loaded and therefore ...
4
votes
4answers
569 views

Clients trust my custom CA

I'm sorry if this is a dumb question. I'm new to all this. I have a large number of users. I need to be able to generate SSL certs for various internal domain names. All of these certs need to be ...
4
votes
3answers
940 views

Is there any way I can block (or conditionally approve of) iFrames on the client side?

Given that iFrames are used in many common exploits, I'd like to conditionally disable iFrames except for sites that require it such as GMail, or MasterCard SecureCode. I also suspect the ...
4
votes
1answer
402 views

How to disable caching of form data?

A web page accepts user name and password data within an HTTP POST request. This POST request actually shows up as an entry in the browsers history. After user logout from the application and ...
4
votes
1answer
308 views

Need help on understanding obfuscated code in CVE-2012-4969 exploit

As you may know this vulnerability was found a while ago in the wild and the exploit is available too, btw I'm having problem on understanding the obfuscated code. Is it necessary to use obfuscation ...
4
votes
1answer
247 views

How secure is a https website? [duplicate]

Possible Duplicate: Does an established ssl connection mean a line is really secure When I visit a website -- say, https://ebanking.pick-your-bank.com -- my browser (fully patched version ...