Hot answers tagged

249

IMPORTANT: this is based on data I got from your link, but the server might implement some protection. For example, once it has sent its "silver bullet" against a victim, it might answer with a faked "silver bullet" to the same request, so that anyone investigating is led astray. I have tried sending a fake parameter of cHVwcGFtZWxv to see whether it ...


141

Note: If you're here because your certificate suddenly isn't trusted by chrome, see the note about Chrome certificate trust at the bottom of this answer. This has to do with the concept of Certificate Transparency. The Problem Browsers currently trust certificates if four conditions are met: (a) the certificate is signed by a trusted CA, (b) the ...


62

To expand on what @d1str0 said: if the creator of your browser wanted to steal your passwords, it would be trivial to send them to a manufacturer controlled server whenever you entered them - they don't need to bother with the hassle of telling you about sync procedures, or offering to remember passwords. All browsers by default send a certain level of usage ...


46

Your exact case is that RSA is used as the key exchange mechanism. Instead, you should use DHE_RSA or ECDHE_RSA. To remove the "obsolete cryptography" warning, you'll need to use "modern cryptography" which is defined as: Protocol: TLS 1.2 or QUIC Cipher: AES_128_GCM or CHACHA20_POLY1305 Key exchange: DHE_RSA or ECDHE_RSA or ECDHE_ECDSA Twitter ...


44

If you were worried about Chrome or Firefox stealing your passwords, you wouldn't be using them as a web browser in the first place. An application like Keepass or LastPass can keep your passwords encrypted with a master password. If you don't use a master password, your web browser can unencrypt your passwords at any time. It's up to you on what level ...


39

This is a project by Google called Certificate Transparency that attempts to fix flaws with the SSL certificate system. It essentially has three main goals. (Lifted from http://www.certificate-transparency.org/what-is-ct) Make it impossible (or at least very difficult) for a CA to issue a SSL certificate for a domain without the certificate being visible ...


35

With a cookie! Chrome, like any other browser, is storing a cookie in your file system. Those cookies are what enable you to reconnect automatically to some site. Since it's in your file system, even if you reboot they will still be there. Multiple processes or not is irrelevant here. Then you might wonder, if the cookies are in my file system, does it ...


35

This is a proxy authentication pop up! And it's most likely a proxy related attack. When you connect to the Internet through a proxy, you'll be asked to enter username and password if the proxy requires an authentication. For example: Note that the whole text The server http:// ... The server says is editable, and you can change it in the proxy server ...


35

TL;TR: it is probably a BlueCoat ProxySG or similar proxy which can be configured to behave that way. Nothing to worry about. Details: What you see is a dialog for HTTP basic access authentication. This is not what Facebook uses for authentication. This means that this dialog is not from Facebook itself. My guess is that facebook.com is filtered by your "...


34

There used to be a "vulnerability" where the image could send a HTTP 401 Unauthenticated response, which would trigger a login screen for the user. If you set this as forum avatar, it would spawn a login popup for anyone visiting a page where your avatar appears. Lots of people will then attempt to log in with some username and password combination, probably ...


32

Your certificate only contains a sha1 signature, probably with a lifetime past 1 January 2017. These are deprecated, and Chrome therefore removes the appearance of security. See https://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html for more info.


27

You cannot assume that an add-on is safe "because it's hosted in one of the official extension galleries". In this answer, I start with the explanation of how extensions end up in the extension galleries for the popular browsers. At the end, I dedicate an extra section to Chrome. How does an item get listed in the official stores? Anyone with Google ...


19

So it turns out that Chrome won't trust names that aren't fully qualified. I was working with a host name of "foo" which was fine in IE once the cert was in the list of trusted roots. I created a new cert for "foo.com", repeated exactly the same process and now Chrome is happy.


17

After several hours trying to figure out how to do that in Google Chrome I've found it! You must add the following command line parameters in the shortcut: --cipher-suite-blacklist=0x0005,0x0004 The tricky part is that Google has not translated cipher strings so you must input each cipher in hex based on RFC 2246: 0x0004 = TLS_RSA_WITH_RC4_128_MD5 ...


15

Edit 2015-09-03: Fixed. Fixed as of Chrome version 45 from 2015-09-01. WeakDH.org now reports: Good News! Your browser is safe against the Logjam attack. Most of original post preserved below. Batch Workaround A workaround is to create a batch file that starts Chrome and explicitly disables all ephemeral DH suites. There are different blacklists ...


13

Alright, here we go: Question 1 TLS 1.0 is not quite perfect. See the answers to this question for details. 3DES is somewhat odd these days, but still okay, nonetheless depricated by AES. using RSA as a key exchange mechanism fails to provide forward secrecy. using SHA1 is okayish right now but expecected to be broken any time, hence there is the SHA2 ...


12

No, because the XSS filter only looks whether it sees XSS code in the input back in the HTML outputted by your server. For example, if Chrome sees your web page is accessed with an URL that contains the following: ?q=<script>alert("XSS!")</script> and if the HTML returned by the server contains this: <p>You have searched for <b>...


12

bit.ly itself does not distribute malware, bit.ly is just an URL shortener service which allows you to mask/shorten your original URL. bit.ly however is not only used for good reasons (shortener) and for marketing reasons (click tracking). You have to think about scam and phishing websites as well, which often use bit.ly to hide their domain which ...


12

Click on the 🔒 lock icon in the location bar Click on the “Details” link next to “Your connection to this site is private.” This opens the Security tab of the Developer Tools. Reload the page. The Security thing’s left column goes “🔒 Overview”, “Main Origin”… Click on the next one, “⚫ https://security.stackexchange.com”. Connection Protocol ...


11

I install a plugin that allows me to click on any part of a page and it gives me the color of the clicked object For this to work, the plugin needs to register a click event handler and it needs to interact with the document object model of the current HTML page. HTML was originally designed to share scientific documents. And while we build complex web ...


11

Chrome has default protection against Reflective XSS attacks. This is not a flaw that sandboxing can address. This protection system works by looking outgoing requests for javascript and preventing that javascript from being executed in the http response. No browser will prevent DOM Based XSS or Stored XSS. Chrome's protection is the weakest when ...


11

The IMG tag will attempt to interpret the data as an image, so Javascript won't be executed. It will be possible to send an image that, once decoded, will require enormous amounts of memory ("PNG bomb"), and it is possible that the graphic routines themselves are vulnerable to malicious content (a carefully crafted image that, when decoded, triggers ...


10

There are two vulnerabilities, each triggering a jump to address zero: The first, inside markContainingBlocksForLayout: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0xb09fdb70 (LWP 2039)] > 0x00000000 in ?? () (gdb) bt > #0 0x00000000 in ?? () #1 0x0194b82b in markContainingBlocksForLayout (this=0x2e29944, owner=...


10

Open source software is not necessarily better or more secure. Where open source has an advantage is the potential for independant security minded individuals to examine the source code and hopefully the conceptual model for a given software project. This advantage is contingent on: review by qualified individuals feedback from the reviewer to the ...


10

Yes Yes Yes Updated, See the comment from George Bailey for this one. No - like you say the sandbox will prevent that. Read (and send) data on all the pages you visit. Some more details on why this is often needed, but not always is discussed in this question Why need Chrome plugins access to 'all my data' and 'browsing activity'?


10

XSS prevention is not the responsibility of the browser, XSS holes arise because of flaws in a website, and it is up to the owners of websites to prevent such flaws. Some browsers have implemented attempts at mitigating XSS and CSRF holes in websites, but these are heuristics looking for typical patterns of attacks. They are in no way complete. There is ...


10

s3.amazonaws.com is an endpoint for a cloud file storage product offered by Amazon Web Services (AWS) and is used by many websites and apps (albeit usually behind the scenes, but you can serve files from it directly too). Seeing references to that domain is definitely not inherently malicious, however given that you can store just about any file in S3 there'...


9

All or None. The singly-rooted CA trust paradigm we inherited from the 90s is almost entirely broken. Vanilla browsers do not track or alert if the Certificate Authority backing a SSL certificate of site has changed, if the old and new CA are both recognised by the browser1. As the average computer trusts over a hundred root certificates from several ...



Only top voted, non community-wiki answers of a minimum length are eligible