A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.
11
votes
5answers
874 views
Different strategies for online anonymity and their +/-s?
I saw this question about anonymous web browser, but I wanted to go a little bit more in depth. I prefer answers that take into account how a connection would be traced back, time it would take to ...
11
votes
6answers
1k views
Anonymous web browser. Is it real?
Do anonymous browsers work? What principles do they use? Can I use them to test access to my web site? Can I detect if a visitor is using one? What is the different between traditional and anonymous ...
8
votes
4answers
2k views
Options when defending against SSLstrip?
I'm wondering, does anyone have any suggestions to defend against SSLstrip particularly?
38
votes
4answers
5k views
How much can I trust Tor?
Greetings.
How much can I depend on Tor for anonymity? Is it completely secure? My usage is limited to accessing Twitter and Wordpress.
I am a political activist from India and I do not enjoy the ...
14
votes
6answers
1k views
What are the security implications of people downloading addons, wrongly thinking that they are safe?
I recently learned about a plugin for Firefox called Fire Sheep, which was featured on the Security Now podcast. I downloaded F.S. and began examining it. To my surprise it includes C++ code that must ...
25
votes
2answers
3k views
What malicious things can happen when clicking on links in email?
I've received a spam from one of my friends (well I'm sure he didn't send it). so there's this link, and i'd thought what exactly would be the implications of clicking the link (i've not clicked it ...
4
votes
3answers
1k views
Any additional security with large blacklisting hosts file?
I run Windows with a pretty hefty c:/windows/system32/drivers/etc/hosts file obtained from http://winhelp2002.mvps.org/hosts.htm. I update this file as regularly as I remember and layer it with ...
10
votes
7answers
792 views
How to browse the Internet safely?
What is the best way to browse the Internet safely? By safely I mean:
anonymously
having encrypted communication
Extra bonus for:
being able to do it with little or no performance impact
cheaply ...
25
votes
9answers
4k views
Is visiting HTTPS websites on a public hotspot secure?
It's often said that HTTPS SSL/TLS connections are encrypted and said to be secure because the communication between the server and me is encrypted (also provides server authentication) so if someone ...
7
votes
4answers
338 views
Unknown malware, how to report it and whom to report it to?
I'm a professional Windows system administrator, but I've been caught off-guard (or maybe some malware writer has been very clever) and I caught some unknown malware on my home computer (Windows 7 x64 ...
15
votes
2answers
6k views
Can you get virus just by visiting a website in chrome
I've recently read Google Chrome: The End of Drive-By Downloads. Is it true to say that drive-by-downloads are history in Google Chrome?
So if I have a link (from a spam email) I can right-click >> ...
18
votes
4answers
2k views
How secure are my passwords in the hands of Firefox using a Master Password?
I'm relying on Firefox to remember my passwords, using a Master Password of more than 25 characters. How secure is this set-up?
13
votes
5answers
514 views
Are address bars unphishable?
I've taken, out of curiosity, the Phishing Quiz by OpenDNS that tries to teach the general public about detecting phishing:
Ever wonder how good you are at telling the difference between a ...
9
votes
5answers
675 views
Is Google Chrome more secured browser?
I was amazed that IE 8, Safari, Firefox were hacked so fast. Is it really Chrome so good or it was not tested?
Has anyone other results of independent investigations about security of web browsers?
...
8
votes
2answers
510 views
MIME sniffing protection
As it is known, older versions of MSIE (before 8) have a nasty habit of treating images as HTML if they "look like" HTML, which can lead to nasty vulnerabilities for sites that allow people to upload ...
9
votes
4answers
483 views
Vulnerabilities common only in mobile solutions?
I was wondering if there are any threats for web-applications used on mobile phones that haven't been known in the "full size" browsers earlier.
I haven't heard of any serious or common problems that ...
7
votes
5answers
2k views
Does HTTPS Everywhere defend me against sslsniff-like attacks?
http://www.thoughtcrime.org/software/sslsniff/
If I have a domain on my HTTPS Everywhere list, so that theoretically it could be only visited via an HTTPS connection in my Firefox, then could an ...
20
votes
8answers
2k views
Is anybody using client browser certificates?
Client browser certificates seem to be a nice way to protect sites from intruders - it is impossible to guess and should be harder to steal. Of course, they do not solve all the problems, but they add ...
11
votes
5answers
1k views
Solution to allow JavaScript input but prevent XSS
We have a simple Blog system that allows users to input html and JavaScript to build a blog page. I'm aware that allowing javascript open up the door to xss attacks. We do however need to allow users ...
11
votes
4answers
733 views
How are browser saved passwords vulnerable?
Most browsers offer to save the password after entering it on many logon pages. What types of vulnerabilities are there for such saved passwords. I'm interested in what ways malware on web pages ...
15
votes
8answers
827 views
Ways to secure yourself from Firesheep kiddies and other sniffing
Just a few days ago I had my first encounter with Firesheep. Luckily I was the one using it. Well, it scared me into looking for ways to secure myself. So I have two questions:
In exactly what ...
18
votes
3answers
796 views
NoScript: How to determine which sites/scripts to whitelist?
NoScript is a great plug-in, both for security and for ad blocking. However, I've found it's not always easy to figure out what scripts need to be permitted on certain pages, to be able to use the ...
12
votes
4answers
2k views
TLS 1.0 JavaScript injection vulnerability (BEAST): what to do client-side?
With the alleged SSL/TLS vulnerabilities used by the BEAST exploit, there seems to be a security gap between TLS versions; TLS 1.0 being the problematic one but still the only option for many sites.
...
10
votes
4answers
648 views
Why isn't OCSP required by default in browsers?
According to the following screenshot, taken from firefox-3.6.17-1.fc14.i686, Firefox has an option to fail closed when unable to connect to OCSP servers.
Can someone please explain why this isn't ...
8
votes
2answers
550 views
HSTS extra security over HTTPS
Is HSTS good to use even if my servers are configured to use HTTPS (Even if HTTP is used, the rewrite rules in apache makes it to HTTPS)
Also does HSTS make even the resources like CSS, images to be ...
5
votes
2answers
567 views
Considering that SRP is better than SSH and Basic Auth, how can it be implemented in a website?
SRP is short for Secure Remote Password protocol, and provides a better way for passwords to be sent over the internet.
I've read the information at it's Stanford University home page, the Wiki ...
5
votes
2answers
3k views
How to thwart sslstrip attack?
I need help understanding the dynamics of an sslstrip attack. I'm using it to test the security of a site that I own. I can successfully sniff the victim (in this case, myself) credentials over the ...
5
votes
2answers
156 views
RC4 bias protection with padding in TLS
On the answer to my previous question about RC4 vulnerabilities in TLS, Thomas Pornin gave a great answer, in which he said:
One way to "fix" RC4, which has been suggested many times, is to drop ...
3
votes
3answers
899 views
sslstrip vs. privoxy redirect rule on clients
I watched this video: http://www.securitytube.net/video/193 Now I'm thinking about an example.
Suppose I have a privoxy proxy on my PC:
user.action file (just part of it):
{ ...
3
votes
3answers
269 views
Protecting websites from outdated browsers and plugins via a whitelist/blacklist combination?
Aside from using browser headers, I want to blacklist/whitelist browser and plugins from my site so that I can prevent these older unpatched systems from (1) being a general user of my site (2) ...
1
vote
1answer
109 views
Closed Internet Explorer inprivate trace
Suppose that a user uses inprivate mode in Internet Explorer and browsed something.
Now, an administrator wants to search the user's activity in Internet Explorer using the user's PC without having ...
18
votes
2answers
3k views
Why is the same origin policy so important?
I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
13
votes
5answers
2k views
Preventing information disclosure from browser back button/history?
I have sensitive data that will be hosted on a website, and I would like to prevent the data from being exposed in this scenario:
The primary user logs off the application, but does not close the ...
20
votes
2answers
1k views
From a technical standpoint, how does the zero-day Internet Explorer vulnerability discovered in September 2012 work?
I'm looking for an answer that explains the issue from the prespective of a developer/engineer. What is exactly being exploited and why does it work?
Please note that I am not looking for ...
8
votes
2answers
1k views
Using iframes to sandbox untrusted code
I'm trying to create an extensible platform, where my site will provide a model and some views (both client-side, in the browser) and third party sites may add their own views as well. The goal here ...
7
votes
5answers
776 views
Websites that interactively test browser security (XSS, CSRF, Javascript, etc)
I'm looking for a comprehensive list of browser test sites so that I can visually prove that the browser is patched and configured for safe web browsing. My intent is to know what risks may exist ...
9
votes
2answers
2k views
Are there any statistics about webservers and browsers TLS support?
From Hackers break SSL encryption used by millions of sites:
The vulnerability resides in versions 1.0 and earlier of TLS, or transport layer security, the successor to the secure sockets layer ...
11
votes
4answers
749 views
Is clipboard secure?
Can a browser get the data on my clipboard? Data could be for example my temporary password?
Any browser or operating system that allows this?
10
votes
2answers
199 views
What should I look for when auditing a Browser extension / plugin?
I've been asked to do a security audit on a cross-browser plugin for desktop browsers developed by a third party. I am a web developer with a reasonable grasp of Javascript but am not a browser ...
7
votes
3answers
259 views
Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?
On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
7
votes
2answers
2k views
Worst case scenario, what can a Chrome extension do with “Your data on all websites” and “Your tabs and browsing activity”?
Chrome extensions, and just like other browsers, appear to often get quite some extensive access to your browser data. In fact, most extensions I've installed require access to:
Your data on all ...
4
votes
2answers
838 views
Does Java applets reveal the real IP address, even when using proxy or vpn?
Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?
11
votes
3answers
1k views
How can I prevent tracking by ETAGs?
An ETAG is a HTTP header that is sent-behind-the-scenes between a web browser and an web server. This value is intended to control how long a particular file is cached on the client side.
There is ...
8
votes
2answers
184 views
User-specific Subdomains : JavaScript security
If I provide a public-facing website for users on my website at their own subdomain (e.g. bob.myapp.com) under their own control, can I allow them to execute arbitrary JavaScript without putting my ...
6
votes
2answers
441 views
Firefox Add-ons not using HTTPS? Security bug. (?)
If I add a rule in Privoxy:
echo '{ +redirect{s@http://@https://@} }
.mozilla.org' >> /etc/privoxy/user.action
then I can't install Firefox Add-ons. Why?
I though the Firefox Add-ons ...
5
votes
3answers
200 views
How safe are copies of Firefox that are on various Mozilla mirror sites?
If I end up downloading a .dmg or .exe (depending on OS) installer from some mirror site, how can I be sure that a virus or trojan or spyware has not been added?
I don't see any mechanism for ...
4
votes
4answers
318 views
Is online banking more secure on iOS than a desktop computer?
Does Apple's iOS provide a more secure environment for online commerce (banking or shopping) than Windows or Mac OS X? Since the only software that can run on iOS must be vetted by Apple, the ...
4
votes
2answers
7k views
How to determine if a browser is using an SSL or TLS connection?
I want to know whether my browser is using SSL or TLS connection if I see HTTPS.
I want to know for IE, Firefox, Chrome and Safari. I want to know the protocol version.
4
votes
2answers
137 views
Is using a “Red” and a “Green” browser to balance LOB requirements and security a good approach?
I currently work in a manufacturing company with round about 5000 computers and 6000 employees.
We use a lot of web based line of business applications (all internal, non over the Internet) in order ...
4
votes
3answers
284 views
Are there security (esp. privacy) benefits to deleting cookies?
As the title says, I'm wondering if there are any security/privacy benefits to managing cookies - that is, managing by deleting cookies you don't want or need.
I deleted all my cookies about a week ...
