A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.

learn more… | top users | synonyms (2)

9
votes
2answers
6k views

Is BEAST really fixed in all modern browsers?

BEAST is said to be fixed in all modern browsers: Chrome and Firefox IE in Jan 2012 Opera in Dec 2011. It's also fixed in OpenSSL since 2002. Do these fixes mean that it's safe to use ciphers in ...
3
votes
1answer
236 views

Client-side cross-site access in SSL environment - when it's still possible to do?

I'm trying to imagine an secure sandboxed environment for an application which is big and unexplored, and may contain backdoors. It would live under chroot/virtual environment with no outgoing ...
15
votes
4answers
4k views

Why users want to disable cookies?

I just started to create a new web application. In the documentation, it is written that I have to prepare for the situation where users have disabled cookies. This is not the first time I have read ...
4
votes
2answers
197 views

Is using a “Red” and a “Green” browser to balance LOB requirements and security a good approach?

I currently work in a manufacturing company with round about 5000 computers and 6000 employees. We use a lot of web based line of business applications (all internal, non over the Internet) in order ...
5
votes
1answer
46k views

Chrome is telling me I am receiving a forged certificate for Gmail, is someone trying to hack me?

I went to log on to https://mail.google.com this morning and I got the following error. Is someone trying to attack me or is this just a bug? I'm on a WPA2 encrypted wireless connection using Chrome ...
0
votes
1answer
409 views

How securely use Firefox Add-on to prevent steal data?

Some videos on YouTube demonstrate how a Firefox extension can collect login information used to login to websites such as Facebook. After installing this tool/malware as Firefox Add-on, I observed ...
4
votes
2answers
2k views

Does Java applets reveal the real IP address, even when using proxy or vpn?

Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?
1
vote
2answers
343 views

Custom font protection?

I have a custom characters that to most people it appears as chinese, arabic or just some random symbles, it is a simple way I make sure that my written notes are readable just by need. I have grown ...
5
votes
2answers
603 views

Workarounds for :visited CSS History reconnaissance

Several years ago it was possible to use a:visited { background: url('/log.php'); } to figure out on what website user has been previously. But now it is restricted by browsers. Is there any ...
4
votes
1answer
1k views

How to detect cookie stuffing attacks?

So the question is how to detect cookie stuffing attacks and how to protect against them? In case of image-based cookie stuffing I can detect that related resources are not loaded and therefore ...
-1
votes
1answer
189 views

What was Microsoft trying to do when they had Windows Updates over their website? [closed]

What was Microsoft trying to do when they had Windows Updates over their website? Now it's completely integrated into the operating system and it seems much smoother. The Linux and Mac I've used got ...
10
votes
2answers
2k views

How to protect against clickjacking attack but allow legit iframes?

I'm aware of modern anti-clickjacking approaches, such as X-Frame-Options header or framekiller scripts. But all these tactics prevent content to be inside iframe. But what if there is a requirement ...
6
votes
3answers
2k views

What are potential security risks when using an insecure wireless connection?

If someone is using an insecure wireless connection (for example a hot spot in a coffee shop) does it posse a threat even if the person is using a secure application layer protocol? What I mean by ...
-1
votes
1answer
110 views

How come FireFox came out with another release a week latter? Was a threat discovered? [closed]

I updated to FireFox 13 last week and today I got a message about there being a security update and upgrading to FireFox 14. Was a major security threat found? What justified the release of version 14 ...
-1
votes
1answer
154 views

Comparing cookie values with page parameters (i.e. href)

Could you suggest if there is any reason to compare cookie value domain, path, etc with web "location.href" and so on? I mean - on the client side.
1
vote
1answer
2k views

HTTPS and cache injection

I understand the downside of this attack and what wrong can be done. But I dont understand how is it done ? Well, I need to educate myself, any pointers would be useful.
16
votes
2answers
2k views

HSTS extra security over HTTPS

Is HSTS good to use even if my servers are configured to use HTTPS (Even if HTTP is used, the rewrite rules in apache makes it to HTTPS) Also does HSTS make even the resources like CSS, images to be ...
10
votes
4answers
1k views

Why do browsers warn about mixed content for images?

I'm dealing with a phpBB forum user who wants to set up SSL on their entire site to secure user credentials and "private" parts of the website. However, they want to preserve the traditional forum ...
7
votes
3answers
395 views

Is it advisable to have a web browser remember login credentials?

I have a really long random password for my cellphone account and have it written down in a safe place. I only use it once a month and am considering having my browser remember it. Would there be any ...
-1
votes
2answers
103 views

What happens when and attacker changes the installed public keys in browser

I was reading about SSL. I understood that each browser comes with a predefined set of known public keys,which is then used to authenticate the messages. I was wondering what will happen when a virus ...
2
votes
3answers
579 views

Are there any addons that disable only some functionality of scripts?

Tor comes bundled with NoScript. Correct me if I'm wrong but that's because client sided scripts can determine the originating IP address regardless of who the traffic is passed through. But NoScript ...
3
votes
3answers
2k views

Do browsers allows pages loaded on one tab to access/intercept/inject data in other tabs?

I was surprised to hear from this Reuters video that it was possible for a page loaded on one tab to access and/or inject data onto another page loaded on a different tab. TL;DW (too lazy; didn't ...
3
votes
1answer
16k views

does Avast SafeZone actually make a difference?

SafeZone is a feature in Avast Anti-Virus which is like a virtual machine that only has a web broswer. The benifit of this is that it can't be infected with spyware and isn't suseptible to keylogers. ...
3
votes
2answers
2k views

Do most browsers handle mixed encrypted and unencrypted content correctly?

In Google Chrome, when I go to an encrypted page that contains unencrypted content, I get the following pop-down, which allows me to either load or not load the insecure content, making a clear ...
2
votes
1answer
57 views

Does SGC Support reduce HTTPS security?

Server Gated Cryptography is a legacy technology (implemented by obsolete laws) that allows older browsers to establish a SSL session at a higher encryption. This article says SGC should never be ...
8
votes
5answers
2k views

What do the various browser “private modes” do?

Recently there has been some disagreement as to what "private mode" means when it comes to various browsers. Primarily I am referring to... IE's "InPrivate Browsing" Google Chrome's "Incognito ...
3
votes
4answers
217 views

Improving the privacy of a casual Web user

I am interested in improving the privacy available to me as a casual internet user with a default browser. I think that Tor is too slow and that the "Privacy Mode" in browsers isn't really practical. ...
8
votes
4answers
2k views

Is using “HTTPS everywhere” extension secure?

I would like to know if one should use 'HTTPS everywhere' extension? Is it secure to use it? Are there any better alternatives? HTTPS Everywhere is a Firefox and Chrome extension that encrypts ...
3
votes
2answers
559 views

Risks of serving untrusted content under HTTP Content-Type: text/plain?

Am I gonna run into XSS attacks by doing this, or will a file download be prompted? Are there security problems that would rise in a modern browser?
6
votes
2answers
2k views

How can end-users detect malicious attempts at SSL spoofing when the network already has an authorized SSL proxy?

I'm working on one client's network where they have enabled HTTPS authority spoofing on their proxy. This allows them to effectively perform a man-in-the-middle attack to decipher all outgoing ...
7
votes
1answer
7k views

Does Google Chrome protect against cross site scripting (XSS)?

In Firefox I've been using the NoScript extension to protect myself from certain kinds of malware attacks. NoScript is well known as a very powerful extension for Firefox and introduced protection ...
1
vote
3answers
915 views

Could some one please explain - Remote Post SQL Injection

Would anyone be able to post a link to an article which explains how to do a Remote Post SQL Injection and how to prevent anything bad happening. Or even just explain on here. Any help would be ...
1
vote
1answer
149 views

Closed Internet Explorer inprivate trace

Suppose that a user uses inprivate mode in Internet Explorer and browsed something. Now, an administrator wants to search the user's activity in Internet Explorer using the user's PC without having ...
4
votes
4answers
867 views

Clients trust my custom CA

I'm sorry if this is a dumb question. I'm new to all this. I have a large number of users. I need to be able to generate SSL certs for various internal domain names. All of these certs need to be ...
1
vote
1answer
166 views

Is the javascript browser tool at printfriendly.com secure for my browser

I use Win Xp Home with SP3 and am pretty aware of security problems. I use Palemoon 12.1, a version of Firefox optimized for windows. I usually use printfriendly bookmarklet to create printable pages ...
9
votes
2answers
4k views

Worst case scenario, what can a Chrome extension do with “Your data on all websites” and “Your tabs and browsing activity”?

Chrome extensions, and just like other browsers, appear to often get quite some extensive access to your browser data. In fact, most extensions I've installed require access to: Your data on all ...
1
vote
2answers
96 views

Preventing a socially-engineered transaction

Can you explain what this blog means when it says: Something to think about when it comes to transaction signatures – demonstrating the need to keep the entire process off the PC (in this case) ...
3
votes
2answers
117 views

Vertical information portal security with a customized web browser

I am creating a SaaS that will be delivered through a Vertical Information Portal (VIP). In my research I have found that by developing a custom lean web browser and installing it on the clients ...
10
votes
2answers
3k views

Using iframes to sandbox untrusted code

I'm trying to create an extensible platform, where my site will provide a model and some views (both client-side, in the browser) and third party sites may add their own views as well. The goal here ...
-1
votes
2answers
320 views

Restore session in Firefox

Restore session in Firefox What does this mean, is it related to the session concept which is stored on the web server? If I stop the computer with my web-app, and then start it again before the ...
1
vote
2answers
592 views

Are flash cookies still a threat and that persistent?

One year (or more) ago flash cookies were really a problem, because they could not be deleted from within a browser. They were not managed by the browser but by the flash player. Flash cookies were ...
0
votes
1answer
104 views

Implementation of a FREE web filter [closed]

I just want some advice for the implementation of a web filter for a school network. Just want to block some contents and url. A free tool should be fine I guess. Any recommendations? Thanks!
28
votes
4answers
27k views

Why is passing the session id as url parameter insecure?

I recently followed a discussion, where one person was stating that passing the session id as url parameter is insecure and that cookies should be used instead. The other person said the opposite and ...
2
votes
1answer
189 views

Browsers and export regs. Is SGC still valid?

I was reading a rather "dated" book on SSL/TLS, which mentions about International Step Up certificates and Microsoft's Server Gated Certificates which were the way arround the US export rules for ...
8
votes
4answers
6k views

Is WebGL a security concern?

Is WebGL a potential security problem due to the low level access it provides? For example, a web page can attempt to compile and run any shader source it wants. It seems that security would ...
5
votes
4answers
11k views

Security issues using iframes

We are looking to move to iframes due to technical challenges. By moving to iframes it will be easier to manage the technical issues. But we are not totally sure of security implications of iframes. ...
2
votes
2answers
865 views

What if a browser does not understand the secure flag of cookie

I have two questions related to the same: 1 - As 'Httponly' attribute is understood by a set of modern browsers (https://www.owasp.org/index.php/HttpOnly#Browsers_Supporting_HttpOnly), I was ...
5
votes
1answer
262 views

What countries have laws in place that respect Do Not Track HTTP headers or cookies?

Google offers a Chrome plugin that uses cookies to control privacy, while Firefox offers a HTTP Header to tell websites to not track the users and log the data anonymously. This obviously extends a ...
6
votes
2answers
1k views

Considering that SRP is better than SSH and Basic Auth, how can it be implemented in a website?

SRP is short for Secure Remote Password protocol, and provides a better way for passwords to be sent over the internet. I've read the information at it's Stanford University home page, the Wiki ...
7
votes
4answers
3k views

What web browsers support OCSP stapling? Are the privacy and performance features the same?

OCSP stapling decreases the load on a PKI infrastructure's OCSP server by attaching a signed OCSP response to the target in a TLS connection. In addition it creates a more secure/private session ...