A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

learn more… | top users | synonyms (2)

5
votes
3answers
55 views

When testing out security vulnerabilities on sites such as OWASP Projects, should we be in a secured/protected environment?

I was curious if there is any need to secure/protect ourselves when doing projects on sites like OWASP to learn about vulnerabilities or "Wargames/Challenges" such as what's posted in these links How ...
5
votes
2answers
87 views

Passive fingerprinting of HTTPS client

Is it possible to passively fingerprint a HTTPS client, based solely on data visible to a network eavesdropper? In other words, consider a network monitoring box that can see all the packets (but ...
4
votes
1answer
98 views

Risks of HTML/JavaScript window.opener security flaw?

I do not know if you are aware of this flaw, but here is a basic example: somepage.html (pointing to malicious.html): <!DOCTYPE html> <html> <head> <meta charset="utf-8"> ...
2
votes
1answer
226 views

Encrypting data before sending to SaaS tool and decrypting on browser view

I'd like to send data to a SaaS tool, where the data is stored in the cloud. I'll use Google Analytics as an example, but it applies to any similar service. Google Analytics does not allow you to ...
1
vote
1answer
101 views

Standard for securing web server to client connections via HTTPS on the local area network

I am trying to set up some kind of secure client to web server connection that takes place entirely on local area networks, but I'm having trouble understanding what the recommended best practice is. ...
1
vote
1answer
60 views

How to distinguish malware from system crash?

Recently, I browsed to a website, which appeared to consume all the computer's resources. Although the mouse cursor continued to move, the browser (and other applications) slowed down fast and soon ...
0
votes
1answer
22 views

How can I determine the common cryptographic suites I need to enable on my browser for common websites?

How do I determine the common cryptographic suites I need to enable on my browsers (I use IE11, Firefox/Nightly 49, Chrome 51) running on Windows for common websites, for eg, www.google.com, www.w3....
0
votes
1answer
102 views

Why does Safari still support SSL 3?

The "POODLE" attack was made public in October, 2014. Why does Safari still support SSL 3.0 after POODLE showed it to be insecure?
0
votes
1answer
93 views

Is WebRTC safe for connecting random clients to each other?

I am trying to implement a chatroulette-sque app, and WebRTC seems to be the best choice as far implementing something that doesn't take a vast amount of server resources. My current scheme is to ...
-1
votes
1answer
76 views

What to do after exposure to a drive-by infection?

I clicked on a link that pretty clearly offered exposure to a drive-by infection. I won't post the link itself, but I got it from a link which is inside a reddit link (obviously the reddit website ...
5
votes
0answers
733 views

Content-Security-Policy & Facebook login

This question seems to be related to http://stackoverflow.com/questions/15913200/facebook-js-sdk-not-executed-in-my-chrome-extension , but I am not developing a chrome extension. I am developing a ...
3
votes
0answers
65 views

Secure a server on `localhost` such that only the authorized users can connect

Consider an application (such as an IPython notebook) that runs an HTTP server, and that (by design!) allows arbitrary code execution by authenticated users (this is the entire point of IPython, ...
3
votes
0answers
62 views

How safe is WebCryptoAPI these days?

The 1Password Tool (software) introduced the 1Password for Teams. Now I thought this is a great peace of Software. But now they can show Passwords in the Browser. They do say: We encrypt ...
3
votes
0answers
35 views

How to check if redirected site like OAuth is genuine?

One common security advise is to open sites only from bookmarks (see also Explain to non tech savvy person how to check that your connection to mybank.com is safe? ). This approach fails if a site ...
3
votes
0answers
36 views

How to disable typed arrays in firefox as rowhammer mitigation

I am concerned about the potential attack surface exposed by JavaScript typed arrays as a means of performing rowhammer attacks. Is it possible to disable (via official means or otherwise) typed ...
2
votes
0answers
68 views

Configuring Chrome to handle ETags like Safari

ETags can be used for tracking, but I happened to notice that Safari handles them differently from Chrome (and Firefox). I believe it's non-standard because it doesn't work across domains. If we ...
2
votes
0answers
142 views

How to enable ECDHE in openjdk-1.8.0 in CentOS 6.7?

I have seen many posts that hinted ECDHE is available in the SunEC provider way back in openjdk-1.6.0. My environment: CentOS 6.7 with openjdk 1.8.0.71-1.b15.el6_7. No ECDHE. Made 2 changes in jre/...
2
votes
0answers
83 views

Do any specific steps need to be taken into account for the user's browser and browser caching for a HIPAA compliant web application?

I'm currently writing a web application that will need to be HIPAA compliant. It is very JavaScript heavy, and ePHI will be sent over an encrypted connection in the form of JSON. The transmission ...
2
votes
0answers
379 views

Suggestions on how to capture network connections/traffic for determining browser/SSL versions?

I've started thinking about how to approach analyzing my network traffic for information relating to SSL and browser usage for my web server farm. I also suspect there are some shadow (legacy, unknown)...
1
vote
0answers
48 views

Have there been any known “in the wild” exploits of any Google Chrome (Android) 40.0.2214.89 vulnerabilities?

https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-15031/version_id-179594/Google-Chrome-40.0.2214.89.html I looked for any news about them and couldn't find anything. Anyone ...
1
vote
0answers
33 views

Where should I store sensitive data within an Apache Cordova application?

I have to implement a 2 factor authentication (2FA) feature within an Apache Cordova application so that the user is able to login into the desktop application using the generated token. Common 2FA ...
1
vote
0answers
237 views

Hidden TrueCrypt Container containing the Tor Browser Bundle

I'm considering using a hidden TrueCrypt container to keep a Tor browser bundle copy which could save bookmarks. In this case, would the TBB leave traces on the OS it started with? E.g. I use my ...
1
vote
0answers
138 views

Accessing Chrome and Gmail on a stolen drive

I was trying to search for this, but could not find the answer anywhere - apology in advance if already answered. I have a Linux desktop installed on a thumb drive, which I keep in my pocket. This ...
0
votes
0answers
30 views

Java Exploits - Not using the browser plugin

I'm looking for examples of Java exploits that do not leverage the Java browser plug-in/Browser applet to run. For example: Drive-by downloads that download a Java file that is run by the JRE but ...
0
votes
0answers
32 views

Setting specific geoIP in Piratebrowser

I'm using Piratebrowser. In order to set a specific country's IP, I used the line ExitNodes {in} which is working. I'm getting an Indian IP in dnsleaktest, but my geolocation is getting a Japanese ...
0
votes
0answers
34 views

Since yesterday, NoScript has asked twice whether to “allow scripts from example.com”. What gives?

Since yesterday 2015-01-19, I have had two occasions where NoScript has apparently blocked scripts from "example.com", the actual domain, not the meta-level foo variable. According to this Wikipedia ...
0
votes
0answers
55 views

Is keeping business data in browser database websql secure?

Knowing that Server always validates the data before saving it. Browser app is generating the data based on user input and some business logic and is storing it locally. Browser app then synchronize ...
0
votes
0answers
26 views

Different chanels for BeEF UI and Communication Server

I am working with BeEF tool and I want to access the UI interface using https (I don't want to communicate via VPN to access the control panel), while at the same time, I need to serve the http hooks ...
0
votes
0answers
1k views

Does Microsoft Edge (Spartan) share Cookies, Cache, Passwords, or TLS Certificates with Internet Explorer?

Windows 10 was released with a new browser called Microsoft Edge. Interestingly, Internet Explorer is also installed on the same default install. Given that Chrome and Firefox tend to separate their ...
0
votes
0answers
2k views

Does this list every Chrome extension/addin that may leak privacy?

I am looking for a simple list of all extensions, preference, custom processes, and "flags" that may disclose a user's privacy or other details to a 3rd party. To that end, I discovered: chrome://net-...
0
votes
0answers
369 views

Google Chrome Crash Report Analysis

I am new to the field of crash analysis. I recently, by accident, happened to crash Google Chrome. I do not know the reason as to why the crash really happened. I'd like to know it in depth though. ...