A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.
3
votes
2answers
344 views
Can one get infected through visiting a site with a PHP script on it and if yes, how?
I can imagine a clientside JavaScript that gets executed in a vulnerable browser to do some harm, but how can this be done with PHP?
Since it's serverside it shouldn't have access to the visitor's ...
3
votes
1answer
296 views
Apple Developer Account Hacked?
I just did a fresh install of Snow Leopard on a newly-formatted hard drive.
Logged into the iPhone Developer Page with Google Chrome (latest build) here:
...
3
votes
2answers
2k views
Can Cookies Without the Secure Flag be Stolen, even when only accessed via HTTPS?
Is it possible to capture the cookies used by HTTPS site when cookies don't have secure flag set.
Suppose the site is https://www.example.com.
http://www.example.com does not show up, also ...
1
vote
3answers
371 views
Is it possible for a virus or unknown program to automatically start up a webcam
How can I secure my computer more, knowing these days that there are many websites, especially ones where you don't have to even click before a virus is downloaded straight to your hard-drive.
I ...
4
votes
2answers
737 views
How is user authentication sent in a public wifi? Radius/802.1x/EAP etc
I visit the airport, I pull out my laptop and connect to a network (no password needed).
I open up my browser and i am presented with a screen saying I need to pay to use the network. If I pay, I ...
1
vote
2answers
425 views
Why websense not allowing homepage url(youtube) but a video page?
My company uses Websense, when someone goes to youtube by directly hitting url from browser
it says it's blocked due to category :Entertainment.
When someone searches for a video in google and ...
2
votes
7answers
583 views
Chrome vs Explorer - how to explain in plain words that open-source is better?
Why open-source is better in plain words?
Yesterday I had a talk at a DIY bicycle workshop. There is a PC (running XP) that main application is checking emails (nothing really serious).
I found it ...
4
votes
3answers
304 views
Is changing image's extension prone to error for browsers?
In my uploading user's avatar scenario, I change users picture extension to jpg.
Is this making the browsers to act differently? Is it prone to error for browsers when they read users avatar?
...
3
votes
2answers
84 views
Automated browser-level countermeasures to look-alike login pages
For example, say an unsuspecting visitor gets a link security.stackexchange.com/.... Then it re-opens the login page, with or without an explanation as to why they have to log in again. (this is more ...
7
votes
5answers
2k views
Does HTTPS Everywhere defend me against sslsniff-like attacks?
http://www.thoughtcrime.org/software/sslsniff/
If I have a domain on my HTTPS Everywhere list, so that theoretically it could be only visited via an HTTPS connection in my Firefox, then could an ...
4
votes
3answers
1k views
Any additional security with large blacklisting hosts file?
I run Windows with a pretty hefty c:/windows/system32/drivers/etc/hosts file obtained from http://winhelp2002.mvps.org/hosts.htm. I update this file as regularly as I remember and layer it with ...
4
votes
1answer
200 views
Do I have to harden IE if I'm only using FF?
Assume a Windows 7 system (probably whatever home version comes with the machine), with the latest OS patches, latest IE and latest Firefox.
The user uses only FF for browsing, never IE.
I'm ...
13
votes
5answers
514 views
Are address bars unphishable?
I've taken, out of curiosity, the Phishing Quiz by OpenDNS that tries to teach the general public about detecting phishing:
Ever wonder how good you are at telling the difference between a ...
9
votes
3answers
736 views
localStorage for apps over https. What expectations are there?
I run an online gradebook. To keep student data private, I transfer all data over https.
Now, I'd like to use localStorage to avoid redundant calculations and server requests. However, according to ...
18
votes
2answers
3k views
Can web sites detect whether you are using private browsing mode?
Most modern browsers support "private browsing mode" (also known in Chrome as "Incognito mode"), where the browser does not save any information to disk about your browsing while in this mode.
In ...
2
votes
2answers
717 views
Secure SSL Session from losing itself into unsecure http
I've seen some implementations of HTTPS SSL and, as a visitor, forced to rely to a lot of those. What would a secure implementation look like and where can one expect problems? I expect the installer ...
9
votes
3answers
241 views
How to test if a browser add-on is safe
I came across this plug-in that started some alarm bells ringing. The add-on would help submit a website to web directories. The first 100 submissions are free, then you need to pay $20 via pay-pal ...
7
votes
3answers
235 views
How do I secure my advertisement space against ad overlay browser attachments?
I don't really have an issue with advertisements simply being blocked by individual users who are visiting a customers site or my own site. As an individual you have the freedom to choose not to look ...
7
votes
4answers
4k views
Is it possible to easily retrieve Thunderbird's passwords with access to HDD?
I know Firefox 8 stores it's passwords in a SQLite database, which can easily be stolen with access to the HDD!
What about Thunderbird 8? How does it store the passwords and how can one retieve them?
...
10
votes
3answers
294 views
Should I ask a user to re-authenticate if the browser thumbprint changes? Is a server side library available?
Is there a security benefit to using the browser's thumbprint in addition to a session identifier to identify a unique session?
Would it then be advisable to ask the user to reauthenticate (or simply ...
4
votes
4answers
2k views
Benefits of identifying clients based upon the “X-Forwarded-For” or similar HTTP header in addition to Client IP
The X-Forwarded-For header is used by some HTTP proxies to identify the IP address of the client. The wiki page (linked above) mentions that ISPs may use this header as well.
In addition there are a ...
3
votes
3answers
211 views
Where's the security when a payment gateway let website handle Credit Card detail
Has anyone worked with eWay payment gateway before?
Basically, there's a service endpoint where you post the customer's detail and credit card details from the web application after the browser sends ...
8
votes
2answers
641 views
Why do Chrome plugins need access to 'all my data' and 'browsing activity'?
Often I install simple add-ons for Google Chrome. However, they almost all need what appears to me as excessive access to my data. For instance, I install a plugin that allows me to click on any part ...
7
votes
5answers
776 views
Websites that interactively test browser security (XSS, CSRF, Javascript, etc)
I'm looking for a comprehensive list of browser test sites so that I can visually prove that the browser is patched and configured for safe web browsing. My intent is to know what risks may exist ...
1
vote
2answers
550 views
Are Google Chrome Extensions vulnerable?
I've just discovered this:
You can create IFRAME pointing to "chrome-extension://" protocol
You can access IFRAME content with jQuery
Does this mean, I'm able to use badly written Chrome ...
13
votes
5answers
2k views
Preventing information disclosure from browser back button/history?
I have sensitive data that will be hosted on a website, and I would like to prevent the data from being exposed in this scenario:
The primary user logs off the application, but does not close the ...
18
votes
2answers
3k views
Why is the same origin policy so important?
I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
4
votes
4answers
413 views
Is silverlight and Java running on the web browser capable of saving “state” into the user's local machines?
I am aware that even after we have cleared our cache and cookies, websites can still save files/information into our computer using Flash (Flash ever cookies),
I was wondering does other plugins like ...
3
votes
1answer
257 views
What does it mean when a webpage says refresh is disabled?
https://www.grc.com/x/ne.dll?rh1dkyd2:
To safeguard your privacy we have disabled the browser's "reload" or "refresh" facility while you are in sensitive areas of our web site. Reloading pages ...
2
votes
1answer
415 views
What browsers support encryption or decryption using local certificates, or smartcard readers?
I am working on a cloud-based solution and I would like to encrypt / decrypt the data locally using either a SmartCard or local Machine certificate. I'm hoping to do this in Javascript, but may ...
1
vote
2answers
82 views
How can I force certain the webclient to honor or remember certain parameters from the webserver?
HTTPS is subject to several MITM attacks, that is clear. However I think it would be helpful to the ITSec crowd if there was a way to force a certain browser behaviour when accessing known-trusted ...
8
votes
9answers
340 views
What is the proper way to view the sourcecode of a website?
I recently heard that Firefox makes a second HTTP request when the sourcecode is requested. Is this true?
Does this mean the webserver may issue alternate source from the original?
Lastly, is ...
3
votes
1answer
159 views
How secure is a https website? [duplicate]
Possible Duplicate:
Does an established ssl connection mean a line is really secure
When I visit a website -- say, https://ebanking.pick-your-bank.com -- my browser (fully patched version ...
3
votes
1answer
149 views
How will users know if their session is DNSSec protected or not?
There is definite security value in having DNSSec-verified connections, however I have yet to see software indicate if the connection is secure.
Ultimately I would like my users to recognize that ...
12
votes
4answers
2k views
TLS 1.0 JavaScript injection vulnerability (BEAST): what to do client-side?
With the alleged SSL/TLS vulnerabilities used by the BEAST exploit, there seems to be a security gap between TLS versions; TLS 1.0 being the problematic one but still the only option for many sites.
...
9
votes
2answers
2k views
Are there any statistics about webservers and browsers TLS support?
From Hackers break SSL encryption used by millions of sites:
The vulnerability resides in versions 1.0 and earlier of TLS, or transport layer security, the successor to the secure sockets layer ...
4
votes
3answers
2k views
How can I protect my saved passwords in Chrome?
I'm currently using WIN+L, and sometimes Kid-Key-Lock, to prevent anyone from checking my storaged passwords but if I forget doing it only once, all of them are vulnerable of theft.
How can I protect ...
6
votes
1answer
423 views
Do I really need all these Certificate Authorities in my browser or in my keychain?
There are lots of strange looking Certificate Authorities in my keychain as well as Firefox. I am sure they are legitimate CAs (as they are the same on my Mac and PC and other computers I checked). ...
9
votes
1answer
1k views
enable browser caching with HTTPS
I understand that sensitive data should not be cached (ie, you dont want to cache an HTML file with all of your bank account details in it), but there are some things that HTTPS protected sites should ...
5
votes
3answers
200 views
How safe are copies of Firefox that are on various Mozilla mirror sites?
If I end up downloading a .dmg or .exe (depending on OS) installer from some mirror site, how can I be sure that a virus or trojan or spyware has not been added?
I don't see any mechanism for ...
5
votes
5answers
444 views
Can I improve website security by storing SSL Keys in DNS? Is DNSSec required? Are threat models available?
In light of recent attacks on SSL/TLS communication, people have been asking about ways to improve the security of SSL webserver communication. Several great solutions have been mentioned in the ...
3
votes
2answers
244 views
Web Certificate invalidation - You might be connecting to a website that is pretending to be [Site name]
Recently while trying to log-in to facebook this notification starts to appear
at first I ignored it (by pressing Continue), but it started to popup every time I navigate through the website!
I ...
13
votes
4answers
1k views
Why does Facebook serve several SSL certificates?
Facebook seems to be alternately serving two SSL certificates, one from DigiCert and one from VeriSign. There are only two reasons for this that I can think of:
They're in the middle of a ...
10
votes
7answers
792 views
How to browse the Internet safely?
What is the best way to browse the Internet safely? By safely I mean:
anonymously
having encrypted communication
Extra bonus for:
being able to do it with little or no performance impact
cheaply ...
3
votes
1answer
465 views
SSL, SSH, OPENVPN, etc which one?
To start with I am not a security professional, in fact I am on the other end of the spectrum. In the opinion of people on this site what would you choose for secure internet browsing. I will be ...
15
votes
2answers
3k views
Google Chrome Browser - Privacy Concerns
After i saw many people using Chrome i wanted to inform myself on this browser and everything concerning it as i am a Firefox user since it existed. However i am always afraid of Google being a "data ...
6
votes
3answers
161 views
Detecting OAuth malicious Implementation
I am wondering how can an end-user detect a maliciously implemented OAuth whether 2-legged or 3-legged. Particularly I am interested in those cases where the consumer requester is maliciously ...
7
votes
5answers
926 views
Is finding vulnerabilities in the major browsers easy or not?
If young hackers can detect them, why can't security analysts get and patch them?
Also, I dream of finding a vulnerability in a major software, like IE or Chrome. Is it easy? Is it systematic or is ...
3
votes
1answer
156 views
How can I assess the trust worthiness of a browser add-on?
Having learned a bit more about what add-ons/extensions can do in Firefox, I want to minimize my risk and use some safer mechanism to download videos (FLV in particular) for later viewing.
...
6
votes
4answers
1k views
Web browser password management security [duplicate]
Possible Duplicate:
How are browser saved passwords vulnerable?
How secure are the password managers that are built into modern web browsers?
Currently I use lastpass plugin as I believed ...
