A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.

learn more… | top users | synonyms (2)

3
votes
2answers
532 views

Risks of serving untrusted content under HTTP Content-Type: text/plain?

Am I gonna run into XSS attacks by doing this, or will a file download be prompted? Are there security problems that would rise in a modern browser?
6
votes
2answers
2k views

How can end-users detect malicious attempts at SSL spoofing when the network already has an authorized SSL proxy?

I'm working on one client's network where they have enabled HTTPS authority spoofing on their proxy. This allows them to effectively perform a man-in-the-middle attack to decipher all outgoing ...
7
votes
1answer
6k views

Does Google Chrome protect against cross site scripting (XSS)?

In Firefox I've been using the NoScript extension to protect myself from certain kinds of malware attacks. NoScript is well known as a very powerful extension for Firefox and introduced protection ...
1
vote
3answers
911 views

Could some one please explain - Remote Post SQL Injection

Would anyone be able to post a link to an article which explains how to do a Remote Post SQL Injection and how to prevent anything bad happening. Or even just explain on here. Any help would be ...
1
vote
1answer
149 views

Closed Internet Explorer inprivate trace

Suppose that a user uses inprivate mode in Internet Explorer and browsed something. Now, an administrator wants to search the user's activity in Internet Explorer using the user's PC without having ...
4
votes
4answers
789 views

Clients trust my custom CA

I'm sorry if this is a dumb question. I'm new to all this. I have a large number of users. I need to be able to generate SSL certs for various internal domain names. All of these certs need to be ...
1
vote
1answer
164 views

Is the javascript browser tool at printfriendly.com secure for my browser

I use Win Xp Home with SP3 and am pretty aware of security problems. I use Palemoon 12.1, a version of Firefox optimized for windows. I usually use printfriendly bookmarklet to create printable pages ...
9
votes
2answers
4k views

Worst case scenario, what can a Chrome extension do with “Your data on all websites” and “Your tabs and browsing activity”?

Chrome extensions, and just like other browsers, appear to often get quite some extensive access to your browser data. In fact, most extensions I've installed require access to: Your data on all ...
1
vote
2answers
94 views

Preventing a socially-engineered transaction

Can you explain what this blog means when it says: Something to think about when it comes to transaction signatures – demonstrating the need to keep the entire process off the PC (in this case) ...
3
votes
2answers
117 views

Vertical information portal security with a customized web browser

I am creating a SaaS that will be delivered through a Vertical Information Portal (VIP). In my research I have found that by developing a custom lean web browser and installing it on the clients ...
9
votes
2answers
3k views

Using iframes to sandbox untrusted code

I'm trying to create an extensible platform, where my site will provide a model and some views (both client-side, in the browser) and third party sites may add their own views as well. The goal here ...
-1
votes
2answers
305 views

Restore session in Firefox

Restore session in Firefox What does this mean, is it related to the session concept which is stored on the web server? If I stop the computer with my web-app, and then start it again before the ...
1
vote
2answers
574 views

Are flash cookies still a threat and that persistent?

One year (or more) ago flash cookies were really a problem, because they could not be deleted from within a browser. They were not managed by the browser but by the flash player. Flash cookies were ...
0
votes
1answer
103 views

Implementation of a FREE web filter [closed]

I just want some advice for the implementation of a web filter for a school network. Just want to block some contents and url. A free tool should be fine I guess. Any recommendations? Thanks!
28
votes
4answers
25k views

Why is passing the session id as url parameter insecure?

I recently followed a discussion, where one person was stating that passing the session id as url parameter is insecure and that cookies should be used instead. The other person said the opposite and ...
2
votes
1answer
178 views

Browsers and export regs. Is SGC still valid?

I was reading a rather "dated" book on SSL/TLS, which mentions about International Step Up certificates and Microsoft's Server Gated Certificates which were the way arround the US export rules for ...
8
votes
4answers
6k views

Is WebGL a security concern?

Is WebGL a potential security problem due to the low level access it provides? For example, a web page can attempt to compile and run any shader source it wants. It seems that security would ...
5
votes
4answers
11k views

Security issues using iframes

We are looking to move to iframes due to technical challenges. By moving to iframes it will be easier to manage the technical issues. But we are not totally sure of security implications of iframes. ...
2
votes
2answers
807 views

What if a browser does not understand the secure flag of cookie

I have two questions related to the same: 1 - As 'Httponly' attribute is understood by a set of modern browsers (https://www.owasp.org/index.php/HttpOnly#Browsers_Supporting_HttpOnly), I was ...
5
votes
1answer
251 views

What countries have laws in place that respect Do Not Track HTTP headers or cookies?

Google offers a Chrome plugin that uses cookies to control privacy, while Firefox offers a HTTP Header to tell websites to not track the users and log the data anonymously. This obviously extends a ...
6
votes
2answers
1k views

Considering that SRP is better than SSH and Basic Auth, how can it be implemented in a website?

SRP is short for Secure Remote Password protocol, and provides a better way for passwords to be sent over the internet. I've read the information at it's Stanford University home page, the Wiki ...
7
votes
4answers
3k views

What web browsers support OCSP stapling? Are the privacy and performance features the same?

OCSP stapling decreases the load on a PKI infrastructure's OCSP server by attaching a signed OCSP response to the target in a TLS connection. In addition it creates a more secure/private session ...
2
votes
2answers
111 views

Does TLS-OBC only improve security of Web Browsers? Does it improve the security of SSH?

I'm studying the TLS-OBC extension and would like to know if it improves security of non Web-based protocols? Specifically, would it be of any benefit to SSH clients? (version 1 or version 2.x/secsh) ...
22
votes
6answers
4k views

How can I prevent tracking by ETAGs?

An ETAG is a HTTP header that is sent-behind-the-scenes between a web browser and an web server. This value is intended to control how long a particular file is cached on the client side. There is ...
5
votes
1answer
215 views

What issues might exist with TLS-OBC's emulation of Browser Certificates?

TLS-OBC is an RFC proposal that increases SSL/TLS security by using certificates on both ends of the TLS connection. What's special here is that the client is permitted to dynamically create a local, ...
10
votes
2answers
361 views

How do you visit a link without risking your computer?

I got a link from: http //61.19.247./~naowit/dustin.html (removed the last digits so you don't accidentally click it! (they were 192)), which was masked as a youtube.com link via email. Now I'm not ...
5
votes
3answers
496 views

Are there security (esp. privacy) benefits to deleting cookies?

As the title says, I'm wondering if there are any security/privacy benefits to managing cookies - that is, managing by deleting cookies you don't want or need. I deleted all my cookies about a week ...
3
votes
1answer
228 views

What servers or clients are immune to related-domain cookie attacks? (*.example.com)

In this question, I want to identify browsers, servers, or implementations that are immune from related domain cookie attacks (e.g. a.example.com vs b.example.com). Lacking any tangible solution, ...
4
votes
1answer
3k views

cookie path protection within same domain

The answer to this question about how cookies are potentially vulnerable between sub-domains sparked my curiosity. As far as I know, if a cookie is set on a sub-path of the same domain ...
2
votes
4answers
901 views

Chrome Frame is an example of how browsers “merge together”. How can I unmerge all of them?

Chrome Frame is an add in that integrates with IE and Firefox. Firefox has a similar component, and I hear that the .NET runtime finds its way into all the other browsers. Additional integration ...
3
votes
3answers
364 views

Are there any same origin issues (SOP) with TOR?

Are there any issues with Same Origin Policy (SOP) with TOR or *.onion addresses? I'm thinking of cookies Plugins (Silverlight, Flash, Java, etc) Javascript
0
votes
2answers
957 views

Issuing browser certificates to Chrome and Firefox with Microsoft CA

Most companies use IE with an ActiveX control to create a CSR and submit it to the CA for approval. Since many browsers either block or don't support ActiveX controls, how can I enroll them using a ...
1
vote
1answer
524 views

Wireshark log analyzing

I have the following Wireshark log and I want to categorize the attack. I think it prints the user under apache runs and then prints the system information. From this log can we determine if the ...
3
votes
1answer
2k views

Why does Safari seem to be accepting an HTTPS connection every other browser rejects?

This question is inspired by a bug/issue in recent Linksys router firmware. Essentially, something has changed recently that's preventing HTTPS access to the web admin on current generation Linksys ...
5
votes
3answers
276 views

Is “untrusted code” reported by DOM Snitch a vulnerability?

One of the most frequent errors that DOM Snitch finds in sites is Untrusted code. He finds it in google.com for example. Here is an output of this tool: Is it a vulnerability? Edit: This report of ...
1
vote
2answers
546 views

http blocked over very low ports in Opera web browser

Opera blocks the user from making http requests over very low ports (below 1024). Why does Opera not allow the user to override this setting? What is wrong with running a web server on, say, port ...
5
votes
4answers
452 views

Is it harmful to redirect web bugs to localhost on hosts file?

I was checking the article hosts file on Wikipedia, and I found this: Blocking access to servers of unwanted content by redirecting them to the local host (127.0.0.1) may have security ...
3
votes
3answers
1k views

What are some recommended open source tools for web browser history analysis?

I'm looking at a series web browser histories from various browsers (IE, Chrome, Firefox, etc) and need to do some analysis. All of these browsers store data much differently, but I was wondering if ...
8
votes
2answers
649 views

Should user be allowed to save password in browser?

The auditing company found a bug "The Auto-complete form attribute is set in password field". They suggested to disable autocomplete for this field to prevent disclosure of it "when working on shared ...
0
votes
2answers
174 views

What is Greasemonkey / Userscripts and how does it relate to IT Security?

I came across http://userscripts.org/ and learned that it is popular among web-users to install something called "Greasemonkey" to allow client side scripts to run. What are the benefits of ...
2
votes
4answers
360 views

Clickjacking: can't browsers just forbid/reject placing transparent elements over frames?

Why not? Seems like this is only used for clickjacking, the solution should be simple enough.
7
votes
2answers
6k views

How to thwart sslstrip attack?

I need help understanding the dynamics of an sslstrip attack. I'm using it to test the security of a site that I own. I can successfully sniff the victim (in this case, myself) credentials over the ...
6
votes
1answer
402 views

How do I check the code of a Chrome extension to make sure it's not stealing my info?

I've been reading more and more about just how much access browser extensions can have to your data. This is a little unsettling, so I'm curious if there is a way to Vet these extensions and make sure ...
4
votes
2answers
512 views

Can one get infected through visiting a site with a PHP script on it and if yes, how?

I can imagine a clientside JavaScript that gets executed in a vulnerable browser to do some harm, but how can this be done with PHP? Since it's serverside it shouldn't have access to the visitor's ...
3
votes
1answer
536 views

Apple Developer Account Hacked?

I just did a fresh install of Snow Leopard on a newly-formatted hard drive. Logged into the iPhone Developer Page with Google Chrome (latest build) here: ...
3
votes
2answers
4k views

Can Cookies Without the Secure Flag be Stolen, even when only accessed via HTTPS?

Is it possible to capture the cookies used by HTTPS site when cookies don't have secure flag set. Suppose the site is https://www.example.com. http://www.example.com does not show up, also ...
2
votes
3answers
715 views

Is it possible for a virus or unknown program to automatically start up a webcam

How can I secure my computer more, knowing these days that there are many websites, especially ones where you don't have to even click before a virus is downloaded straight to your hard-drive. I ...
4
votes
2answers
2k views

How is user authentication sent in a public wifi? Radius/802.1x/EAP etc

I visit the airport, I pull out my laptop and connect to a network (no password needed). I open up my browser and i am presented with a screen saying I need to pay to use the network. If I pay, I ...
1
vote
2answers
857 views

Why websense not allowing homepage url(youtube) but a video page?

My company uses Websense, when someone goes to youtube by directly hitting url from browser it says it's blocked due to category :Entertainment. When someone searches for a video in google and ...
2
votes
7answers
803 views

Chrome vs Explorer - how to explain in plain words that open-source is better?

Why open-source is better in plain words? Yesterday I had a talk at a DIY bicycle workshop. There is a PC (running XP) that main application is checking emails (nothing really serious). I found it ...