A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.

learn more… | top users | synonyms (2)

3
votes
2answers
245 views

Learning XSS: Why is my javascript ignored?

<a href='mailto:</a><script>/*'></a><script>/*</a>: <br> <hr> <a href='mailto:*/location.href=/*'>*/location.href=/*</a>: <br> ...
3
votes
1answer
94 views

Force user to download a file to their hard drive via hyperlink?

I want to design a scenario in which I have a web site which contains a link. If the user clicks on this link, it will save a file in a specific pat in his hard disk without his consent. Is this ...
3
votes
2answers
147 views

How can users be sure the browser's URL bar is not faked?

For a user to defend against something like Don't understand how my mum's Gmail account was hacked , they should pay attention to URL bar before typing their credentials. But how can you make ...
3
votes
1answer
108 views

What's malicious about file links?

Why did Chrome and Firefox disallow file:/// links? I can imagine an iframe opening a local resource, but which resource is the scary one? They could have just disabled iframes to file:///? Ajax ...
3
votes
1answer
3k views

Is using RC4-MD5/RC4-SHA as SSL ciphers enough for most purpose?

In the AWS ELB, I have uploaded a cert and only selected "RC4-MD5" + "RC4-SHA" as the ciphers and scored A in the ssltest [1] If I using the default ELB setting, I can only score a C Since I am not ...
3
votes
2answers
4k views

How is a website determining my location even via VPN? [duplicate]

I'm currently in China, and accessing the Internet via a VPN in the USA. When I access Google maps or other location-based web services, they all show my location as that of the VPN server. However, ...
3
votes
1answer
2k views

Can your Windows or Linux username be exposed to websites?

For example: Accessing a website with javascript enabled can expose information such as browser, fonts and local time. Can it, theoretically, expose your Windows or Linux username? Will saving a ...
3
votes
1answer
326 views

Updated version of Browser Security Handbook

Google's Browser Security Handbook is a brilliant resource for web application security, and in particular, for understanding how browsers behave. It discusses many issues, and contains tables ...
3
votes
2answers
117 views

Vertical information portal security with a customized web browser

I am creating a SaaS that will be delivered through a Vertical Information Portal (VIP). In my research I have found that by developing a custom lean web browser and installing it on the clients ...
3
votes
1answer
224 views

What servers or clients are immune to related-domain cookie attacks? (*.example.com)

In this question, I want to identify browsers, servers, or implementations that are immune from related domain cookie attacks (e.g. a.example.com vs b.example.com). Lacking any tangible solution, ...
3
votes
1answer
348 views

What does it mean when a webpage says refresh is disabled?

https://www.grc.com/x/ne.dll?rh1dkyd2: To safeguard your privacy we have disabled the browser's "reload" or "refresh" facility while you are in sensitive areas of our web site. Reloading pages ...
3
votes
1answer
185 views

How can I assess the trust worthiness of a browser add-on?

Having learned a bit more about what add-ons/extensions can do in Firefox, I want to minimize my risk and use some safer mechanism to download videos (FLV in particular) for later viewing. ...
3
votes
2answers
99 views

How browser detects Phishing Pages?

I want to know how browsers detect phishing pages.And also what methodology browsers use to detect phishing pages?
3
votes
1answer
156 views

Danger of hidden html form uploading users local files without their knowledge

Is there a danger that a webpage could have a hidden form with a file upload input and js script that would try and take a random guesses at files on a users system and attach them to the form and ...
3
votes
1answer
692 views

Are there any know browsers that support file URL redirection?

I've been addressing an open-redirect issue and in experimenting with the latest fix, I noticed that updating the redirect's protocol to file resulted in a blank page on the browser. That is, ...
3
votes
1answer
14k views

does Avast SafeZone actually make a difference?

SafeZone is a feature in Avast Anti-Virus which is like a virtual machine that only has a web broswer. The benifit of this is that it can't be infected with spyware and isn't suseptible to keylogers. ...
3
votes
1answer
531 views

Apple Developer Account Hacked?

I just did a fresh install of Snow Leopard on a newly-formatted hard drive. Logged into the iPhone Developer Page with Google Chrome (latest build) here: ...
3
votes
1answer
160 views

How is YouTube able to identify anonymous users?

A few days ago I was searching YouTube and I noticed an "outlier" video poped up in the suggestions list. This video had nothing to do with the topic being searched, but instead it was based on a ...
3
votes
1answer
321 views

Can a site I browse in private browsing mode tell if I visited it in regular mode before?

I've noticed when updating a blog, that sometimes refreshing the page won't actually fetch it again, because it is still in the cache. Now, even when I open it in incognito in that same browser(say ...
3
votes
2answers
447 views

Crypto Browser add-on

What are the known limitations with browser addon/extensions that do in browser encryption vs a native implementation in the browser. The addon would expose cryptographic primitives for use in ...
3
votes
1answer
7k views

How does DHE-RSA-AES256-SHA compare to RC4 as the Cipher for SSL?

I read a lot of issue [1] currently stating that RC4 is broken and is at risk. I just checked my web server (nginx) and it is using the default settings, which is DHE-RSA-AES256-SHA How does this ...
3
votes
1answer
223 views

Client-side cross-site access in SSL environment - when it's still possible to do?

I'm trying to imagine an secure sandboxed environment for an application which is big and unexplored, and may contain backdoors. It would live under chroot/virtual environment with no outgoing ...
3
votes
3answers
361 views

Are there any same origin issues (SOP) with TOR?

Are there any issues with Same Origin Policy (SOP) with TOR or *.onion addresses? I'm thinking of cookies Plugins (Silverlight, Flash, Java, etc) Javascript
3
votes
3answers
1k views

What are some recommended open source tools for web browser history analysis?

I'm looking at a series web browser histories from various browsers (IE, Chrome, Firefox, etc) and need to do some analysis. All of these browsers store data much differently, but I was wondering if ...
3
votes
1answer
139 views

How can I avoid Canvas Fingerprinting?

Canvas Fingerprinting has been getting a lot of press these last few days. Here is a study I read on this topic: 1 and 2 What can I do to keep browsing anonymously and avoid this tracking method?
3
votes
1answer
122 views

XSS via PDF when Content-Disposition: Inline?

There are kind of two questions here: Is it possible to have XSS in a PDF file when the Content-Disposition: is "inline"? If it is possible, does the pdf get access to the cookies for that domain ...
3
votes
1answer
99 views

user data accessible through javascript in browser

There are websites which display user information, such as browser version and operating system This website goes even further, and displays some additional information, such as desktop resolution, ...
3
votes
2answers
396 views

Do any web browsers create cached copies of local HTML files?

Suppose that we create a sensitive file as a HTML document, and then view that file with a web browser such as Firefox, or other. Is it possible that the file is treated as if it were a document ...
3
votes
2answers
194 views

Accessing keystrokes directed at iframe?

So I was making a virtual credit card from entropay.com and when I decided to Top up it up with my existing debit card. It opened up the 'Verified by Visa' page(A page in which you have to enter a ...
3
votes
1answer
1k views

What OID Issuance Policies are appropriate for SmartCard and Browser Certificates?

I'm investigating issuance policies for SMIME and Browser certificates with different levels of assurance. For the purposes of S/MIME and Browser certificates, should I even use an assurance policy? ...
3
votes
1answer
263 views

How can I use certificates to secure my webservices? What is available to javascript?

I have a few web services that are accessed over public wifi connections and I think it would be a good idea to issue certificates to encrypt data, prevent MITM, and invalid impersonation (beyond what ...
3
votes
1answer
2k views

Why does Safari seem to be accepting an HTTPS connection every other browser rejects?

This question is inspired by a bug/issue in recent Linksys router firmware. Essentially, something has changed recently that's preventing HTTPS access to the web admin on current generation Linksys ...
3
votes
2answers
99 views

Automated browser-level countermeasures to look-alike login pages

For example, say an unsuspecting visitor gets a link security.stackexchange.com/.... Then it re-opens the login page, with or without an explanation as to why they have to log in again. (this is more ...
3
votes
0answers
66 views

Is the use of JavaScript for cryptography ever appropriate in the browser? [duplicate]

Possible Duplicate: How secure is aSSL (javascript)? Does it effectively mimic SSL? After some searching around, I realized we don't have an easily visible canonical question about this on ...
2
votes
7answers
784 views

Chrome vs Explorer - how to explain in plain words that open-source is better?

Why open-source is better in plain words? Yesterday I had a talk at a DIY bicycle workshop. There is a PC (running XP) that main application is checking emails (nothing really serious). I found it ...
2
votes
4answers
357 views

Clickjacking: can't browsers just forbid/reject placing transparent elements over frames?

Why not? Seems like this is only used for clickjacking, the solution should be simple enough.
2
votes
3answers
359 views

How prevent Javascript from obtaining my location

I usually use a proxy server to browse anonymously. Now I realize that it is possible to find the location of a user using the Geolocation API. How to anonymously browse without disabling Javascript?
2
votes
5answers
1k views

Does the padlock on my browser really indicate a reasonable assurance against eavesdropping?

I know that there have been broken or weak SSL implementations. Do browsers actually have decent standards for what they'll accept and display "the padlock"? Furthermore, are there any practical ...
2
votes
2answers
958 views

How can Bank of America tell that I'm logging in on a computer I haven't used with them before?

When you sign into Bank of America for the first time on a computer that you haven't used with them before, they detect this and force you to answer one of your security questions. I think I've seen ...
2
votes
2answers
375 views

Can cookies reveal my email address?

When I visit livescore.com, ten seconds later I receive marketing emails from gambling companies. If I don't visit this site, I don't receive these emails. Similar things happen when I visit Twitter ...
2
votes
3answers
1k views

How to block the websites on client machines

In our office we are blocking sites like Facebook, Twitter etc.The problem is that some of the users bypass our proxy and firewalls through external proxy sites like www.youhide.com or ...
2
votes
3answers
207 views

Do on-demand SSL certificates exist?

A few days ago, I visited an SSL protected website. Since Safari complained about the SSL-certificate, I did a short inspection: The certificate was issued by GoDaddy in just the minute I ...
2
votes
1answer
130 views

I don't quite understand the principle of “use after free” and CVE-2010-1119

I am a rookie hacker studying android vulnerabilities. My partner and I are studying "CVE-2010-1119". Unfortunately there does not appear to be enough information online. Could anyone please help me ...
2
votes
2answers
987 views

Security behind the windows 8 eye

I use the Windows 8 operating system. Whenever I navigate to the login page of Internet Explorer 10, or even the login screen of the operating system, I see an eye symbol at the end of the password ...
2
votes
3answers
179 views

Website URL to point users to in order to “make a point” about security [closed]

It is 'common knowledge' that unpatched, older browsers and operating systems are dangerous, but when I tell people that they should not do their online banking in IE 6 on a pirated XP service pack 0, ...
2
votes
3answers
395 views

How hard it would be to infect a system with malware through a portable web browser

If I use a portable web browser on a USB device like Google Chrome Portable how hard it would be to get infected by a malware/virus in the system to which the USB device is connected? Google Chrome ...
2
votes
3answers
697 views

Is it possible for a virus or unknown program to automatically start up a webcam

How can I secure my computer more, knowing these days that there are many websites, especially ones where you don't have to even click before a virus is downloaded straight to your hard-drive. I ...
2
votes
9answers
439 views

How can I allow only authorized browsers to access a website?

I have a website and I want it to be accessible only by authorized clients/browsers (ex. with a certficate). The idea is that the users can only access the webpage in their office's computers ...
2
votes
1answer
221 views

Twitter.com in private browsing leaks data to normal browser. Other sites as well? Bug or feature?

This is the first time I encountered similar thing. When I log into the Twitter web site in Chrome (namely, the Iron version which is said to be security enhanced, but that does not matter here) in ...
2
votes
1answer
375 views

How Browsers prevents Malware and Phishing attacks

I want to know how phishing and malware protection features are implemented in modern browsers like Chrome, Firefox, IE etc. Are these features heuristic based, or do browsers maintain a list of ...