A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.

learn more… | top users | synonyms (2)

8
votes
1answer
5k views

Why is 'avast! Web/Mail Shield Root' listed as CA for google.com?

I just noticed something weird in my browser: the certificate for www.google.com has been issued by avast! Web/Mail Shield Root. Should I be worried? I am using avast! Antivirus so it's probably a ...
0
votes
1answer
184 views

Web site blocked by Windows defender and is marked as unsafe in IE

I posted this originally on Drupal Stack Exchange, and it was recommended that I try here for an answer. Here is the original question: Visiting my Drupal 7 site just now with IE 11, I get this ...
2
votes
4answers
133 views

How safe is SSL on an untrusted computer and network?

In situations where the consumer doesn't trust/control the workstation and the network, can consumer safely do potentially sensitive activities (like making a payment or transferring confidential ...
34
votes
8answers
5k views

Why do browsers default to http: and not https: for typed in URLs? [duplicate]

When I type example.com without any scheme into the browser bar and press Enter it is interpreted as HTTP://example.com, not HTTPS://example.com. Why? And where are the plans to fix this? (To be ...
-4
votes
2answers
213 views

Is “HTTPS” ~100% secure? [duplicate]

Assuming that we have a "green bar connection" to a website, e.g.: Is an attacker still able to sniff our traffic? How secure is a user from man-in-the-middle attacks when he has established a ...
2
votes
3answers
181 views

External cross domain include script

One of my web application underwent a vulnerability assessment recently, and one of the findings is about cross domain include script. Our web app uses addthis_widget.js from AddThis to bookmark ...
3
votes
7answers
533 views

Can one reliably show HTTPS status in browser (not just the lock in the URL bar)?

I'm almost certain this isn't possible, as it would probably be too exploitable, but I wanted to ask the community just in case. Is there a way to determine and display the state of HTTPS on a page ...
2
votes
1answer
94 views

What are empty requests in web server log?

In my nginx access.log I have plenty of request logs like this: 1.2.3.4 - - [18/Aug/2014:12:09:33 +0200] "-" 400 0 "-" "-" As you see there is neither browser specification nor any target url. I ...
0
votes
0answers
42 views

Clarification on a website security

I am new to work on website handling and here are my questions. 1) How can I ensure that the pages accessing is secure enough for data transmission , sql injection and several other attacks. 2) How ...
11
votes
2answers
843 views

How can I hide my logged in sessions from other websites?

Most people go on browsing the web while connected to their facebook/gmail/etc. accounts. Other websites somehow know what accounts you're logged in. For example, if you go to hide.me's torrent page, ...
2
votes
1answer
49 views

Secure Flash with Click to Play Plugins in the Enterprise

In the recent light of repeating critical Flash vulnerabilities there are recomendations to use browserplugins like click-to-play to prevent unnecessary flash content to automatically load with every ...
1
vote
1answer
22 views

Can a Certificate Authority associated with Active Directory publish a client certificate to a browser?

Can I use some integration of Windows Active Directory and a Certificate Authority to embed a client certificate in a browser that will be trusted by a server? I have a private domain and control ...
0
votes
2answers
516 views

Browser and SSL support

According to http://en.wikipedia.org/wiki/Transport_Layer_Security#Web_browsers most browsers support SSL 3.0. And with my understanding (please correct me if I am wrong), when a browser just ...
-2
votes
2answers
81 views

How would I start becoming knowledgable about hacking and able to do it? [closed]

Is there a site I can start reading tutorials to simpler stuff to build up my skills??? Or is someone willing to give me a task (easy one) to do?
0
votes
1answer
22 views

Secure keyboard entry with JavaScript or Flash?

Is it possible to perform secure keyboard entry (similar to what is offered in the OS X Terminal app) using only web technologies and/or Flash? If not, is there any way to more broadly guarantee ...
3
votes
2answers
95 views

How does a browser manage secure sessions and store session keys?

I am interested in how a browser manages secure sessions. As I understand it this is the scenario when logging into a google account: 1) Browser (B) and google Server (S) perform a handshake to ...
1
vote
2answers
83 views

Can Professor See Open Tabs Or History? [closed]

I have a professor that has online quizzes. They mentioned on the first day that they can see the other tabs open in the browser so don't try to cheat by looking up answers. Is this possible? If not ...
2
votes
3answers
55 views

Are auto complete forms a security concern?

I know when I fill out forms with address and email it will attempt to auto complete the rest of the information. Is it possible to include more hidden fields on the page in order to get more ...
4
votes
2answers
99 views

find if 0-day flash bug was exploited (on a particular machine)

There have been several critical 0-day exploits in the past days/weeks in Flash alone. Nobody knows how long the 0-days have been exploited, and it is reasonable to expect that there are 0-days being ...
0
votes
1answer
41 views

From a security perspective, why not a screenshot api for browser? [closed]

I mean a javascript api for capturing a renderered html page, or current viewport, and dump content onto an image. While there are obvious attacks, such as taking screenshot of sensitive information, ...
18
votes
4answers
4k views

Why users want to disable cookies?

I just started to create a new web application. In the documentation, it is written that I have to prepare for the situation where users have disabled cookies. This is not the first time I have read ...
3
votes
1answer
70 views

How is this web resource hidden from the user? [closed]

Motivation: I've been interested in how various agencies hide data, either through incompetence or willful intent, that is required to be "open". Specifically I've seen oil companies use images to ...
2
votes
2answers
122 views

Steps after getting hit with malware or browser exploits on Xubuntu

Well, today I was browsing the internet and I suddenly got redirected to a chinese hosted malware site and firefox started going crazy. I checked the url on virustotal with my phone and it found other ...
3
votes
1answer
67 views

How does the same-origin policy apply between browser tabs? [duplicate]

Let's assume that we have 2 open tabs in a browser containing page A (A.html, A.js) into the first tab and page B (B.html, B.js) into the second tab and that page A and B have the same origin (scheme, ...
28
votes
5answers
3k views

IMG tag vulnerability

Is it safe to display images from arbitrary domains? I.e. let's say I have an image on my page: <img src="http://badguy.com/image.gif" /> What if image.gif will return some js attack vector, ...
8
votes
2answers
287 views

How to improve the security and privacy of Firefox

What would be a sensible approach to enhance the security and privacy of Firefox? I did not find a question about this and I feel that some guidelines for casual web users would be handy. Currently ...
3
votes
1answer
72 views

Login to one site using other site's credentials

I am frequently seeing websites that allows a user to log-in to their site using other websites log-on credentials. If there is a page that allows me to log-in using my google account or facebook ...
5
votes
1answer
83 views

Why is a child window allowed to change the location of its parent?

Maybe a silly question. When opening a new tab via target="_blank", the page that loads in that tab is allowed to set a new location in the parent tab using: ...
8
votes
3answers
191 views

Preventing user supplied javascript from posting to external server

I am writing an internal tool that will support plugins written by other developers. Ideally, these plugins would have a Javascript component to allow people to make widgets. Some of the pages these ...
4
votes
3answers
353 views

Security of a Windows XP system after April 8th when running the latest Firefox or Chrome

As we all know, Microsoft stops developing security patches for Windows XP very soon. If a bug in the kernel was to be found that would allow an attacker to take control by, say, sending a specially ...
6
votes
3answers
4k views

Force a connection via SSL3 to detect POODLE vulnerability

I have been reading up on the POODLE vulnerability. From my understanding, and correct me if I am wrong, you need to allow connections to be made via SSLv3 on the server. The server I am currently ...
0
votes
1answer
129 views

Can HTTPS be compromised by first contact?

Let's say I am behind my PC and want to go to any secured website (HTTPS). I have the direct IP address so any possible hack on DNS level is not possible (because I am not using it ;) ). The packet ...
16
votes
5answers
1k views

Is Google Chrome a better secured browser?

I was amazed that IE 8, Safari, Firefox were hacked so fast. Is it really Chrome so good or it was not tested? Has anyone other results of independent investigations about security of web browsers? ...
0
votes
0answers
29 views

Chromium Sandbox on Mac OSX: Is it enabled by default?

I have decided to finally replace the closed source and privately owned Google Chrome with the open-source Chromium on my Mac OSX 10.9.2 (Mavericks). I have read the differences between both here: ...
8
votes
4answers
20k views

Advanced techniques for detecting a proxy/getting original IP

In what manner can a website detect my original IP address, even though I'm using a proxy server? I've noticed this with a few sites. There are four proxy methods I've used: Firefox with a proxy ...
2
votes
1answer
104 views

Are my passwords saved in Google Chrome safe when I'm logged out?

I understand that Chrome uses the OS's password storage mechanism to protect passwords on your computer. 1 I also understand that these passwords can be (in my case, are) protected with a passphrase ...
81
votes
5answers
2k views

How can I protect myself from this kind of clipboard abuse?

Clipboard abuse from websites Many websites use JavaScript or CSS to stealthily insert or replace text in the user's clipboard whenever they copy information from the page. As far as I know this is ...
2
votes
1answer
42 views

Spoofing of Server Sent Events

In the spec for Server Sent Events, it says Authors should check the origin attribute to ensure that messages are only accepted from domains that they expect to receive messages from. Otherwise, ...
3
votes
1answer
59 views

PKI - Why Root CA is in intermediate CA section?

I can't understand why, when I accept to "install" a custom self signed Root CA on IE browser, the root certificate ends up in the "intermediate CA" section, rather than in "Root CA" section in the ...
41
votes
4answers
12k views

Why is the same origin policy so important?

I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
3
votes
2answers
100 views

How does infection through web surfing work?

Often I read about compromise due to visit a malicious site which download some exploit to your computer. I've never seen a detailed process, all books/tutorials I read just say sentences like "once ...
1
vote
5answers
86 views

Beyond patching, how can I reduce the risk of browser exploits?

Keeping web browsers on the most up to date version and also the plugins that are used is pretty much all we do. Is there anything I else I can do to reduce the risk of browser exploits? The only ...
9
votes
4answers
4k views

How does BeEF work? (working understanding)

I have recently come across the BeEF- a browser exploitation tool. In most of the articles, it is said time and again that it is developed for research and pen test purposes! Has anyone worked with ...
3
votes
1answer
230 views

How does firefox sync password recovery work?

According to Mozilla Sync-new-security-model, Firefox servers are not able to decrypt your sync data without your password. So I figured that, the browser generates a key from your password, encrypts ...
-6
votes
2answers
61 views

Large web application security challenges [closed]

What are the biggest challenges of security in web applications? I want to do a search in the area but I'm not sure what I want to look, I want something that people think it is impossible to serve ...
1
vote
1answer
73 views

How does Yandex Alpha sign me in automatically?

I downloaded the new Yandex Alpha browser. When installing, I chose not to make it the default browser and not to send anonymous usage statistics. I never got a prompt whether I wanted to import ...
2
votes
2answers
355 views

How to display friendly notification about no TLS 1.0 support in browser [closed]

A browser that only has SSL 1.0 support won't be able to establish an HTTPS session with a server that has only TLS 1.1 and TLS 1.2 support. This typically results in a cryptic (to a normal user) ...
1
vote
1answer
74 views

Reflected file download Scenario

I'm making a Java-based web application that is intentionally vulnerable to Reflected File Download (RDF). White paper is here I read the requirements of reflected file download vulnerability as ...
1
vote
2answers
67 views

How to avoid referer information leakage during password reset

Most password reset systems involve emailing the user a one-time link that lets them reset their password. The token needs to be in the URL, as most email clients do not allow HTML emails to perform ...
11
votes
2answers
770 views

How safe is it to use developer's version of the browsers [closed]

I have heard that the developer versions of browsers (chrome and firefox) are less secure than stable versions of them. Is it true? Is there any sense in using developer editions of browsers for ...