Hot answers tagged

244

IMPORTANT: this is based on data I got from your link, but the server might implement some protection. For example, once it has sent its "silver bullet" against a victim, it might answer with a faked "silver bullet" to the same request, so that anyone investigating is led astray. I have tried sending a fake parameter of cHVwcGFtZWxv to see whether it ...


137

Note: If you're here because your certificate suddenly isn't trusted by chrome, see the note about Chrome certificate trust at the bottom of this answer. This has to do with the concept of Certificate Transparency. The Problem Browsers currently trust certificates if four conditions are met: (a) the certificate is signed by a trusted CA, (b) the ...


39

This is a project by Google called Certificate Transparency that attempts to fix flaws with the SSL certificate system. It essentially has three main goals. (Lifted from http://www.certificate-transparency.org/what-is-ct) Make it impossible (or at least very difficult) for a CA to issue a SSL certificate for a domain without the certificate being visible ...


35

There used to be a "vulnerability" where the image could send a HTTP 401 Unauthenticated response, which would trigger a login screen for the user. If you set this as forum avatar, it would spawn a login popup for anyone visiting a page where your avatar appears. Lots of people will then attempt to log in with some username and password combination, probably ...


35

With a cookie! Chrome, like any other browser, is storing a cookie in your file system. Those cookies are what enable you to reconnect automatically to some site. Since it's in your file system, even if you reboot they will still be there. Multiple processes or not is irrelevant here. Then you might wonder, if the cookies are in my file system, does it ...


32

Your certificate only contains a sha1 signature, probably with a lifetime past 1 January 2017. These are deprecated, and Chrome therefore removes the appearance of security. See https://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html for more info.


29

Your exact case is that RSA is used as the key exchange mechanism. Instead, you should use DHE_RSA or ECDHE_RSA. To remove the "obsolete cryptography" warning, you'll need to use "modern cryptography" which is defined as: Protocol: TLS 1.2 or QUIC Cipher: AES_128_GCM or CHACHA20_POLY1305 Key exchange: DHE_RSA or ECDHE_RSA or ECDHE_ECDSA Twitter ...


27

You cannot assume that an add-on is safe "because it's hosted in one of the official extension galleries". In this answer, I start with the explanation of how extensions end up in the extension galleries for the popular browsers. At the end, I dedicate an extra section to Chrome. How does an item get listed in the official stores? Anyone with Google ...


19

So it turns out that Chrome won't trust names that aren't fully qualified. I was working with a host name of "foo" which was fine in IE once the cert was in the list of trusted roots. I created a new cert for "foo.com", repeated exactly the same process and now Chrome is happy.


18

After several hours trying to figure out how to do that in Google Chrome I've found it! You must add the following command line parameters in the shortcut: --cipher-suite-blacklist=0x0005,0x0004 The tricky part is that Google has not translated cipher strings so you must input each cipher in hex based on RFC 2246: 0x0004 = TLS_RSA_WITH_RC4_128_MD5 ...


15

Edit 2015-09-03: Fixed. Fixed as of Chrome version 45 from 2015-09-01. WeakDH.org now reports: Good News! Your browser is safe against the Logjam attack. Most of original post preserved below. Batch Workaround A workaround is to create a batch file that starts Chrome and explicitly disables all ephemeral DH suites. There are different blacklists ...


12

bit.ly itself does not distribute malware, bit.ly is just an URL shortener service which allows you to mask/shorten your original URL. bit.ly however is not only used for good reasons (shortener) and for marketing reasons (click tracking). You have to think about scam and phishing websites as well, which often use bit.ly to hide their domain which ...


11

I install a plugin that allows me to click on any part of a page and it gives me the color of the clicked object For this to work, the plugin needs to register a click event handler and it needs to interact with the document object model of the current HTML page. HTML was originally designed to share scientific documents. And while we build complex web ...


11

The IMG tag will attempt to interpret the data as an image, so Javascript won't be executed. It will be possible to send an image that, once decoded, will require enormous amounts of memory ("PNG bomb"), and it is possible that the graphic routines themselves are vulnerable to malicious content (a carefully crafted image that, when decoded, triggers ...


10

Yes Yes Yes Updated, See the comment from George Bailey for this one. No - like you say the sandbox will prevent that. Read (and send) data on all the pages you visit. Some more details on why this is often needed, but not always is discussed in this question Why need Chrome plugins access to 'all my data' and 'browsing activity'?


10

There are two vulnerabilities, each triggering a jump to address zero: The first, inside markContainingBlocksForLayout: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0xb09fdb70 (LWP 2039)] > 0x00000000 in ?? () (gdb) bt > #0 0x00000000 in ?? () #1 0x0194b82b in markContainingBlocksForLayout (this=0x2e29944, ...


9

Open source software is not necessarily better or more secure. Where open source has an advantage is the potential for independant security minded individuals to examine the source code and hopefully the conceptual model for a given software project. This advantage is contingent on: review by qualified individuals feedback from the reviewer to the ...


9

Chrome has default protection against Reflective XSS attacks. This is not a flaw that sandboxing can address. This protection system works by looking outgoing requests for javascript and preventing that javascript from being executed in the http response. No browser will prevent DOM Based XSS or Stored XSS. Chrome's protection is the weakest when ...


9

From this page: http://blog.chromium.org/2008/09/multi-process-architecture.html There's only one browser process, which manages the tabs, windows, and "chrome" of the browser. This process also handles all interactions with the disk, network, user input, and display, but it makes no attempt to parse or render any content from the web. And from the ...


8

TL;DR You need to use the following parameter to block all RC4 ciphers (as of Chrome 31 in Ubuntu 12.04 with NSS 3.15) --cipher-suite-blacklist=0x0004,0x0005,0xc011,0xc007 In Google Chrome on Ubuntu you have to edit the file /usr/share/applications/google-chrome.desktop and add the parameter to each line that starts with ...


8

Google Chrome has a Sync feature that synchronizes browsing history, configurations, bookmarks, etc. between Chrome browsers using the same Google Account. You've very likely used your Google/GMail account when starting Google Chrome the first time on both computers. You can change the sync settings on your home computer and disable the items you don't want ...


8

All or None. The singly-rooted CA trust paradigm we inherited from the 90s is almost entirely broken. Vanilla browsers do not track or alert if the Certificate Authority backing a SSL certificate of site has changed, if the old and new CA are both recognised by the browser1. As the average computer trusts over a hundred root certificates from several ...


8

XSS prevention is not the responsibility of the browser, XSS holes arise because of flaws in a website, and it is up to the owners of websites to prevent such flaws. Some browsers have implemented attempts at mitigating XSS and CSRF holes in websites, but these are heuristics looking for typical patterns of attacks. They are in no way complete. There is ...


8

The first example is a normal SSL certificate meaning that it's a valid certificate issued by a trusted Certificate Authority, but there was no extended validation of the owner of the domain/site. This could mean that the certificate claims to be from Foo Inc. but the CA did not check that the person/entity applying for the certificate was indeed Foo Inc. ...


8

s3.amazonaws.com is an endpoint for a cloud file storage product offered by Amazon Web Services (AWS) and is used by many websites and apps (albeit usually behind the scenes, but you can serve files from it directly too). Seeing references to that domain is definitely not inherently malicious, however given that you can store just about any file in S3 ...


7

As other answers have already covered, Blue coat (amonngst other security products) have the capability to intercept SSL sessions for users on the network, to inspect the traffic. What your company can and cannot do with this information depends on local laws and potentially the contract you signed when you joined the company. If you have sufficient ...


7

JavaScript itself won't be executed, even if the remote server changes MIME Content-Type to text/javascript, because the browsers will aready expect certain MIME types within the IMG tag. That doesn't really mean they're safe to use, though. One thread I suggest you read is is it safe to allow external images to be attached to Blog or any Web content?. In ...


7

It's not malicious. That doesn't mean that it's 100% safe (almost no piece of software is), but if there are any security holes, then they will be bugs, and not something the author has intended to do. It has 67 contributors on github and I'm sure a lot more people have wen't through the code without making any contributions (especially knowing the fact that ...



Only top voted, non community-wiki answers of a minimum length are eligible