A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.

learn more… | top users | synonyms (2)

0
votes
2answers
432 views

How to post comments on websites without being traced back

Just trying to get some general sense about the security on internet now-a-days. There are so many websites I go and comment on different things. If some comments are political and they don't like, I ...
1
vote
0answers
42 views

Encrypting data before sending to SaaS tool and decrypting on browser view

I'd like to send data to a SaaS tool, where the data is stored in the cloud. I'll use Google Analytics as an example, but it applies to any similar service. Google Analytics does not allow you to ...
6
votes
3answers
172 views

Same Origin Policy - XHR response

I know that Same Origin Policy (SOP) prevents a page/script from one origin to read response from another origin, but it does not prevents the page/script from making a XMLHttpRequest (XHR) request to ...
-1
votes
0answers
38 views

Do iPhone Chrome & Safari keep refreshing and sending my IP address to websites while in background?

You can put a browser like Safari or Chrome into the background on iOS without closing your tabs. Will they keep refreshing themselves and send out personal details like your IP address? What about ...
5
votes
2answers
363 views

Questions on true anonymity

I am going to use Tails to connect to Tor through VPN which has AES-256 data encryption, SHA-256 data authentication and RSA-4096 handshake encryption on my Mac on my school's WiFi (as public as I can ...
1
vote
7answers
4k views

Malware ad.adsmatte infection

My PC is infected with malware, whenever I open a webpage and click on it a new tab opens on "ad.adsmatte.com". I scanned my PC with Malwarebytes but was unable to resolve the problem. So I ...
0
votes
1answer
74 views

Scam caller claimed to have elderly friend's “Windows unique identifier”

An elderly friend received a telephone call similar to this Information Security SE post and this one. The caller claimed that my friend's computer had a problem that needed to be fixed. My friend ...
3
votes
1answer
402 views

Can a site I browse in private browsing mode tell if I visited it in regular mode before?

I've noticed when updating a blog, that sometimes refreshing the page won't actually fetch it again, because it is still in the cache. Now, even when I open it in incognito in that same browser(say ...
0
votes
0answers
242 views

Does Microsoft Edge (Spartan) share Cookies, Cache, Passwords, or TLS Certificates with Internet Explorer?

Windows 10 was released with a new browser called Microsoft Edge. Interestingly, Internet Explorer is also installed on the same default install. Given that Chrome and Firefox tend to separate their ...
2
votes
2answers
176 views

Steps after getting hit with malware or browser exploits on Xubuntu

Well, today I was browsing the internet and I suddenly got redirected to a chinese hosted malware site and firefox started going crazy. I checked the url on virustotal with my phone and it found other ...
0
votes
1answer
57 views

Is injecting malicious file with browser localstorage possible?

Lets say, I visited a "malicioussite.com" and the server had a "malicious.js" in it whose job is to write malicious code to my browser localStorage and save it to the my computer then execute it to ...
3
votes
3answers
101 views

How do browsers negotiate SSL/TLS connection parameters?

For the purpose of this question, let assume that an SSL/TLS connection has 4 parameters: protocol, symmetric encryption method, asymmetric encryption method, MAC. During the negotiation of SSL ...
3
votes
1answer
65 views

Browsers root CA accepted, countries and checking fingerprints

This is a question derived from several others, and I can not comment on those, so it is not duplicated, please read: In some related questions some users comment that: "They wouldn't ...
2
votes
1answer
70 views

Google Analytics use of JSONP, what are the security risks?

These days Google Analytics uses a JSONP request to load ga.js into user's web pages via a callback function. According to the Wikipedia, JSONP can "inject any content into a website." What exactly ...
1
vote
1answer
41 views

How much protection is really offered by TLS_FALLBACK_SCSV?

I'm researching the extent to which TLS_FALLBACK_SCSV protects against Cipher Suite Downgrade attacks. I understand that the correct way to protect is to remove support for the insecure cipher ...
1
vote
1answer
55 views

Does WebCrypto also mandate the crypto algorithms be implemented in Javascript?

I am trying to understand what WebCrypto means. From what I understand it is - A Javascript Crypto API spec that all browsers must (hopefully) support. Am I correct? If so are the crypto algorithms ...
2
votes
1answer
46 views

Using RSA for Web Application Authentication

I have a network that is only accessible through bastion servers over ssh. In it, I am developing web applications that are exposed to end users via GUI's served up over websockets. All traffic into ...
17
votes
3answers
75k views

How to determine if a browser is using an SSL or TLS connection?

I want to know whether my browser is using SSL or TLS connection if I see HTTPS. I want to know for IE, Firefox, Chrome and Safari. I want to know the protocol version.
5
votes
1answer
3k views

Why does Safari seem to be accepting an HTTPS connection every other browser rejects?

This question is inspired by a bug/issue in recent Linksys router firmware. Essentially, something has changed recently that's preventing HTTPS access to the web admin on current generation Linksys ...
3
votes
2answers
74 views

Internet Explorer - Advanced Properties for Trusted Root Certificates

If you go to IE -> Internet Options -> Content -> Certificates -> Trusted Root Certification Authorities. Now Click on some CA certificates and click on Advanced You can add properties to the ...
26
votes
2answers
31k views

Can you get virus just by visiting a website in Chrome?

I've recently read Google Chrome: The End of Drive-By Downloads. Is it true to say that drive-by-downloads are history in Google Chrome? So if I have a link (from a spam email) I can right-click >> ...
3
votes
2answers
298 views

Ways around browser xss detection

Most modern browsers will detect xss attempts (script code in the URL) and prevent execution. Are there any known standard ways around this or are xss attacks pretty much impossible now?
38
votes
2answers
16k views

Why do browsers enforce the same-origin security policy on iframes?

I did a small test on Chrome (V37) today. I created a small page and loaded it to the browser: <!DOCTYPE html> <html> <head> <title>Untitled Document</title> ...
103
votes
5answers
3k views

How can I protect myself from this kind of clipboard abuse?

Clipboard abuse from websites Many websites use JavaScript or CSS to stealthily insert or replace text in the user's clipboard whenever they copy information from the page. As far as I know this is ...
14
votes
4answers
2k views

What are the security issues with “eval()” in JavaScript?

Every time that someone mentions eval(), everyone says that there are "security issues" with it, but nobody ever goes into detail about what they are. Most modern browsers seem to be able to debug ...
35
votes
9answers
4k views

Why is it a security problem not to update one's browser?

Is it in general a security problem not to update your browser. Firefox constantly prompts me to update my browser, but how dangerous is it to not update? As part of this question, I would like to ...
-2
votes
0answers
25 views

So I have a compter from my company and I want to know. if I am not on windows working page can my employer still see my browsing data? [duplicate]

So I go on incognito and I watch videos and browse websites. so if I do this can my employer see what I am doing? And how can they see. Please give a brief step by step description. By the way I ...
3
votes
1answer
103 views

Secure Flash with Click to Play Plugins in the Enterprise

In the recent light of repeating critical Flash vulnerabilities there are recomendations to use browserplugins like click-to-play to prevent unnecessary flash content to automatically load with every ...
5
votes
3answers
110 views

Can a website detect my local WIFI network I am in?

I have two computers, both of them locate at the same local WIFI network ( ie: connected to the same router). I use VPN on a computer to visit a website, and don't use VPN on another to visit the ...
1
vote
0answers
24 views

Pop ups after adware removal [closed]

I have a user who had a program called "Shopshop" running on his system that would cause page redirecting when using Chrome, IE, etc. I was able to remove the infection and extensions and ran AV and ...
13
votes
1answer
1k views

Which parts of an HTTPS connection can be revealed? [duplicate]

Say, I use a public WiFi connection to load https://google.com in the browser, and then continue browsing on that site for a few more pages (performing searches in Google). Can anyone else (like ...
3
votes
1answer
88 views

Can OpenVPN monitor my passwords in my browser?

I want to know if I run OpenVPN when I want to log in to websites (like Gmail etc.....) is my username/password in danger? Can they monitor saved passwords in my browser or anything else? I'm new to ...
21
votes
4answers
21k views

Is it possible to easily retrieve Thunderbird's passwords with access to HDD?

I know Firefox 8 stores it's passwords in a SQLite database, which can easily be stolen with access to the HDD! What about Thunderbird 8? How does it store the passwords and how can one retieve them? ...
3
votes
1answer
165 views

Which Browsers support TACK?

TACK is an IETF draft that allows certificate pinning for a TLS web server, provided the clients' browsers support it. Unlike the certificate pinning feature available with HSTS preloading, the ...
-1
votes
1answer
69 views
0
votes
3answers
17k views

HTTPS icon red and crossed out - Chrome browser

I just would like to ask what actually means when HTTPS icon is red / crossed - out. Is this site is vulnerable to Man in the Middle Attack? Is it safe or not?
3
votes
1answer
37 views

What are the security benefits to block all http referer header requests for web browser?

I would like to know also if you lose site functionality. Is this a security benefit that is beneficial than compromising functionality (if compromising at all)? What I mean by this is one a ...
12
votes
4answers
8k views

Is WebGL a security concern?

Is WebGL a potential security problem due to the low level access it provides? For example, a web page can attempt to compile and run any shader source it wants. It seems that security would ...
4
votes
1answer
72 views

How can I see which sites have set the HSTS flag in my browser?

My question is about Firefox and Chrome. Is there a possibility to see which sites have set the HSTS flag in my browser?
6
votes
3answers
157 views

How to add certificate pinning for a certain domain to my web browser?

There is HPKP (HTTP Public Key Pinning) which servers use to tell the client's web browser which certificates to trust (in the future) for the domain that is being contacted. Google's Chrome and ...
4
votes
2answers
4k views

How to display friendly notification about no TLS 1.0 support in browser [closed]

A browser that only has TLS 1.0 support won't be able to establish an HTTPS session with a server that has only TLS 1.1 and TLS 1.2 support. This typically results in a cryptic (to a normal user) ...
1
vote
1answer
112 views

Browser response to SHA1 signed cert

Generated a IIS server certificate using my domain certificate authority (presumed to be an intermediate to the 'secret' root CA) via the Server Certificates -> Create Domain Certificate 'wizard'. ...
28
votes
3answers
8k views

How can a webpage get the MAC address?

I was logged on to my router and filling out some information. I clicked a button and a field was automatically filled in with my computer's MAC address. How is this possible? Does it present a ...
0
votes
2answers
85 views

Finance with the multitude of “Secure Browsers” [closed]

[Thanks for the great answers! But it was put on hold so I've edited my question to be a lot less opinion-based. Based on the answers already given, though, I am getting the sense that booting off a ...
1
vote
1answer
297 views

Web site blocked by Windows defender and is marked as unsafe in IE

I posted this originally on Drupal Stack Exchange, and it was recommended that I try here for an answer. Here is the original question: Visiting my Drupal 7 site just now with IE 11, I get this ...
51
votes
4answers
16k views

Why is the same origin policy so important?

I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
2
votes
2answers
193 views

Chrome status warning on a netbanking secure site connection [duplicate]

I visited my bank's web banking site and clicked on the Green Lock in the address bar of my Google Chrome browser out of curiosity. Under the "Connections" tab Chrome spits out this disturbing ...
3
votes
3answers
125 views

Why did I see an insecure browser warning on my page?

Originally I was under the impression that a particular page on a site I visited was showing an insecure content warning in my browsers due to the tags on the page having plan http href attributes. ...
1
vote
0answers
35 views

What are the security implications of enabling a SNI-hole on a web server?

A web server (let's say Apache 2.4) implements SNI. It is configured with a 4096 bit SHA384-signed Wildcard Certificate (*.land.org) with a Subject Alternative Name (land.org). The Certificate ...
0
votes
3answers
176 views

Restrict website access

I want website (A) to only work if a visitor came by clicking a link from a specific other website (B). Initially I thought of using the document.referrer from website A to check whether website B is ...