A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.
2
votes
3answers
373 views
Is it possible for a virus or unknown program to automatically start up a webcam
How can I secure my computer more, knowing these days that there are many websites, especially ones where you don't have to even click before a virus is downloaded straight to your hard-drive.
I ...
2
votes
4answers
811 views
What XSS attacks doesn't “Reflective XSS Protection” defeat?
Its been quite a while since I have played with cross site scripting vulnerabilities but today I came across a website today that was crying out to be tested for a basic XSS vulnerability.
So ...
2
votes
3answers
424 views
How to block the websites on client machines
In our office we are blocking sites like facebook, twitter etc.The problem is that some of the users bypass the proxy and firewalls through external sites which allow us to bypass proxy, like:
...
2
votes
2answers
193 views
HTTPS Sensitive Information and Caching
I have a website where I need to share a sensitive key with the user. Of course, I'm using HTTPS on the page. The key is put into the HTML server-side in ASP.NET. My concern is, if the user's computer ...
2
votes
2answers
341 views
What if a browser does not understand the secure flag of cookie
I have two questions related to the same:
1 - As 'Httponly' attribute is understood by a set of modern browsers (https://www.owasp.org/index.php/HttpOnly#Browsers_Supporting_HttpOnly), I was ...
2
votes
4answers
234 views
Is it safe to allow users multiple login at different browsers & computers?
We are currently developing a web application. The developers have allowed multiple login. e.g an user can log-in to multiple computers at the same time. They are quoting Gmail account as an example ...
2
votes
3answers
3k views
Browser security - Firefox + NoScript is better than Google Chrome?
I saw that NoScript + Firefox combination blocks all "dynamic content" (especially those spammy ads). I really like that. It reduces the chances of being exploited.
But, chrome only asks me to allow ...
2
votes
3answers
216 views
Can I tell which applications embed Internet Explorer at a command prompt?
A recently discovered vulnerability affects Internet Explorer versions up to version 9, running on Windows XP, Vista, and Windows 7.
This arstechnica article quotes HD Moore as saying,
Just keep ...
2
votes
2answers
732 views
Secure SSL Session from losing itself into unsecure http
I've seen some implementations of HTTPS SSL and, as a visitor, forced to rely to a lot of those. What would a secure implementation look like and where can one expect problems? I expect the installer ...
2
votes
2answers
83 views
Security of viewing a website containing Java applets offline
I've been wondering whether viewing a website offline increases the security risk.
The reason why I'm asking is that having been a short time java applet developer (for a small task) I've come to ...
2
votes
4answers
298 views
If someone steals my laptop while I'm logged in, how can I protect my browser?
My question has its roots in an xkcd from this week:
http://xkcd.com/1200/
Isn't this true and ironic? We place so much emphasis on browser security and OS security -- and rightly so -- yet if I ...
2
votes
1answer
106 views
What is the “derive” key usage?
Google Chrome gives a lot of SSL information. Here is a screenshot:
Under "Key Usage", what does "Derive" mean?
2
votes
3answers
234 views
How can I protect my browser from being compromised?
In enterprise environments, I have found great benefit to use binary white-listing, web security gateway and end-point AV to help protect the end-user/system. Unfortunately, I still see the browsers ...
2
votes
1answer
158 views
Updated version of Browser Security Handbook
Google's Browser Security Handbook is a brilliant resource for web application security, and in particular, for understanding how browsers behave. It discusses many issues, and contains tables ...
2
votes
3answers
1k views
Javascript Malware: How does it work, and how can it be mitigated?
I am wondering how malware gets served through Javascript. I've noticed a few illegitimate pop-ups while visiting some financial websites. I wonder how malware exploits work against the application ...
2
votes
4answers
652 views
Chrome Frame is an example of how browsers “merge together”. How can I unmerge all of them?
Chrome Frame is an add in that integrates with IE and Firefox. Firefox has a similar component, and I hear that the .NET runtime finds its way into all the other browsers.
Additional integration ...
2
votes
2answers
89 views
Identify code being run on website
I do not normally deal with internet security problems but this one has got me interested.
The issue is with a specific site, lets say test.com, and how it it visited.
If the address is typed ...
2
votes
1answer
258 views
Are there any know browsers that support file URL redirection?
I've been addressing an open-redirect issue and in experimenting with the latest fix, I noticed that updating the redirect's protocol to file resulted in a blank page on the browser.
That is, ...
2
votes
2answers
77 views
Does TLS-OBC only improve security of Web Browsers? Does it improve the security of SSH?
I'm studying the TLS-OBC extension and would like to know if it improves security of non Web-based protocols?
Specifically, would it be of any benefit to SSH clients? (version 1 or version 2.x/secsh)
...
2
votes
1answer
390 views
Zone elevation protection in Google Chrome
Internet Explorer has a security feature called "Zone Elevation Protection", in which sites outside a list of trusted sites (which can be configured) are not allowed to navigate to the ones on the ...
2
votes
1answer
443 views
How does DHE-RSA-AES256-SHA compare to RC4 as the Cipher for SSL?
I read a lot of issue [1] currently stating that RC4 is broken and is at risk.
I just checked my web server (nginx) and it is using the default settings, which is
DHE-RSA-AES256-SHA
How does this ...
2
votes
1answer
335 views
Is autocomplete=“off” compatible with all modern browsers?
There are a lot of answers on the subject (including some on StackOverflow), but none of them have recent or updated answers: I can't seem to find any documentation indicating which browsers support ...
2
votes
1answer
164 views
Can JavaScript defeat source port randomization?
Can malicious JavaScript defeat source-port randomization in browsers?
I am reading a research paper which seems to claim that the answer is yes:
many browsers seem to always assign a random ...
2
votes
1answer
2k views
does Avast SafeZone actually make a difference?
SafeZone is a feature in Avast Anti-Virus which is like a virtual machine that only has a web broswer. The benifit of this is that it can't be infected with spyware and isn't suseptible to keylogers. ...
2
votes
1answer
46 views
Does SGC Support reduce HTTPS security?
Server Gated Cryptography is a legacy technology (implemented by obsolete laws) that allows older browsers to establish a SSL session at a higher encryption.
This article says SGC should never be ...
2
votes
1answer
117 views
Browsers and export regs. Is SGC still valid?
I was reading a rather "dated" book on SSL/TLS, which mentions about International Step Up certificates and Microsoft's Server Gated Certificates which were the way arround the US export rules for ...
2
votes
1answer
420 views
What browsers support encryption or decryption using local certificates, or smartcard readers?
I am working on a cloud-based solution and I would like to encrypt / decrypt the data locally using either a SmartCard or local Machine certificate. I'm hoping to do this in Javascript, but may ...
2
votes
1answer
251 views
How to tell if Firefox Home (iOS) is using Data Protection API?
The source code is here: http://mxr.mozilla.org/services-central/source/fx-home/ What should I be looking/search for? Or even how to extract /ffhomeDB.sq3 and see what it contains.
2
votes
1answer
87 views
Detecting Virtualization from web browser
is that possible active adversaries who injecting malicious iframes (root kits), without Flash, Java or any other plugin detect that we using virtualization by javascript or timing differentials and ...
2
votes
1answer
69 views
Return AWS signature over HTTP
I am performing multipart upload to S3 straight from the browser, i.e. bypassing my back-end.
My JS code sends a hand-shake request to S3 (a POST), then uploads the file in chunks of 5MB (a PUT for ...
2
votes
1answer
243 views
What OID Issuance Policies are appropriate for SmartCard and Browser Certificates?
I'm investigating issuance policies for SMIME and Browser certificates with different levels of assurance.
For the purposes of S/MIME and Browser certificates, should I even use an assurance policy? ...
2
votes
3answers
318 views
Are there any addons that disable only some functionality of scripts?
Tor comes bundled with NoScript. Correct me if I'm wrong but that's because client sided scripts can determine the originating IP address regardless of who the traffic is passed through. But NoScript ...
2
votes
1answer
2k views
Does Google Chrome protect against cross site scripting (XSS)?
In Firefox I've been using the NoScript extension to protect myself from certain malware attacks. NoScript is well known as it's a very powerful extension for Firefox and introduced protection from ...
2
votes
4answers
312 views
Clients trust my custom CA
I'm sorry if this is a dumb question. I'm new to all this.
I have a large number of users. I need to be able to generate SSL certs for various internal domain names. All of these certs need to be ...
1
vote
4answers
140 views
how to identify whether my page is phished or normal page?
Usually I differentiate phished page and normal web pages by seeing https before the address of the web page, as the lock symbol will help us to identify.
Are there any other methods to differentiate ...
1
vote
4answers
961 views
Playing with Referrer Header
There are 2 sites:
http://www.site1.com
http://www.site2.com
http://www.site1.com contains link to http://www.site2.com as
<a href="http://www.site2.com/">link<a/>
When user clicks ...
1
vote
3answers
212 views
Why can I read the response to this CSRF attack?
I have a website www.foo.com:8002 that I have resolve to 127.0.0.1:8002 in my hosts file. I have another (the main site) running at localhost:80
In www.foo.com:8002 the page looks like
<form ...
1
vote
2answers
217 views
How is it possible that a virus can infect the system if the browser is started with non-admin rights
If I open my web browser (for example firefox) in Windows 7 with activated UAC as normal user (non admin) a virus - which uses a security leak in my browser - will only gets privileges of the normal ...
1
vote
1answer
310 views
Wireshark log analyzing
I have the following Wireshark log and I want to categorize the attack. I think it prints the user under apache runs and then prints the system information. From this log can we determine if the ...
1
vote
1answer
362 views
Firefox Desktop Shortcut Being Renamed
On my Vista PC the Firefox shortcut icon is being randomly renamed. The name changes to some variation of a recently visited URL. This unwanted action has survived several version updates. Of course I ...
1
vote
2answers
91 views
How do browsers know which cookie to get?
I tried writing a script that would display the contents of a cookie set by another website but it didn't work.
<?php
echo 'Website cookie is '.$_COOKIE['locale'];
?>
But I get an undefined ...
1
vote
2answers
100 views
Is every client-side language more vulnerable?
With web browser plug-ins like Firebug, it is easy to manipulate the source code of client-side language such as HTML and JS. Then are those languages more vulnerable than server-side ones ?
When one ...
1
vote
2answers
454 views
Are flash cookies still a threat and that persistent?
One year (or more) ago flash cookies were really a problem, because they could not be deleted from within a browser. They were not managed by the browser but by the flash player. Flash cookies were ...
1
vote
1answer
63 views
1
vote
1answer
72 views
generating RSA keys through the browser
HTML5 has the element that sends an SPKAC to the server (as I understand it).
But how do you do it in IE?
One CA's websites gives me the following prompt:
This Web site is attempting to perform a ...
1
vote
3answers
321 views
Do client certificates provide protection against MITM?
I'm looking for a way to protect clients from a MITM attack without using a VPN, and ToR. My thought is that client certificates might do the job, but I'm not entirely sure since not too much server ...
1
vote
2answers
229 views
http blocked over very low ports in Opera web browser
Opera blocks the user from making http requests over very low ports (below 1024). Why does Opera not allow the user to override this setting?
What is wrong with running a web server on, say, port ...
1
vote
2answers
428 views
Why websense not allowing homepage url(youtube) but a video page?
My company uses Websense, when someone goes to youtube by directly hitting url from browser
it says it's blocked due to category :Entertainment.
When someone searches for a video in google and ...
1
vote
2answers
556 views
Are Google Chrome Extensions vulnerable?
I've just discovered this:
You can create IFRAME pointing to "chrome-extension://" protocol
You can access IFRAME content with jQuery
Does this mean, I'm able to use badly written Chrome ...
1
vote
1answer
51 views
Java applet authenticity problem
I implemented an applet in java to authenticate users at my website by the usage of MIFARE cards and everything is working good. However I am concerned about the applet's authenticity, in other words, ...
