Tag Info

New answers tagged

3

When looking what ciphers you actually provide: openssl ciphers -V 'ECDH+AESGCM256:DH+AESGCM256:ECDH+AES256:SH+AES256:RSA+AESGCM256:RSA+AES256:!aNULL:!MD5:!kEDH:!DSS' 0xC0,0x30 - ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD 0xC0,0x2C - ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) ...


3

There doesn't seem to be a fix yet. -- In fact not even an announcement of one. (Correct me if I'm wrong.) Batch Workaround A workaround is to create a batch file that starts Chrome and explicitly disables all ephemeral DH suites. There are different blacklists strings floating around the internet at the moment. Below is my attempt. Cipher suites are ...


0

He needs only one page, right ? Fine then, you might want to save it somewhere, so he can access only that page. Assuming the data he is trying to get is static, and assuming it's only for data processing purposes he needs that access, wouldn't that be a solution to save it somewhere else to give him access only to that page ? Unless it's the secure ...


6

https://www.ssllabs.com/ssltest/analyze.html?d=uk.care.com&s=46.137.89.126 https://www.ssllabs.com/ssltest/analyze.html?d=uk.care.com&s=54.228.236.90 The padlock is yellow because you have a certificate that uses SHA-1 in the certificate chain and Google have declared war on SHA-1 certificates. Chrome uses the operating system's root CAs. If the ...


0

I have been suffering from this virus for last seven days, but in my android tablet. I have formatted my tablet three times in three days, but problem reoccurs just after installing the browser. It is correct that it alters your DNS server address. I have read a post somewhere in the xda forums that gave me hint about this: go to wifi settings and find the ...


0

If your router is affected and you're facing different issues on your devices (android has no ads, computer does) may check/change your DNS settings on both devices and on the rooter. I think you android phone uses a different DNS server as your PC. Your PC propably uses your Router as DNS Server (e.g. 196.168.1.1) and your android uses a 3rd party DNS like ...


0

This does not appear to be an OS/browser related issue. I would recommend you to read this http://www.quora.com/How-do-I-stop-AdsMatte-spam-popups-and-ads What it says: I believe all your default gateways is "192.168.1.1" Open this from your PC. If you can't open it, the the solution below must work: I believe you should know about it first(skip ...


1

I ran into this issue not too long ago. If you have done a clean OS install then it is likely that your Chrome settings have been tampered with, infected, auto-backed up, and restored once you log into Chrome again after the clean install. You can try and reset your Chrome settings. It actually took me hitting this more than once and manually inspecting my ...


4

Avoiding attacks on your site You need to validate that the string you received is valid. Remember this principle: you must white-list acceptable strings rather than black-list unacceptable ones. Ensure that the string is a syntactically-correct and escaped URL. Escaping the whole URL avoids it containing " or > which could break your site's syntax. ...


1

There are two pieces of information in the message: The site has outdated encryption. The site is probably using something less than TLS 1.2. You should probably fix it but not a big deal. The page is loading an insecure component. This can be 3rd-party widgets, ads, analytic code, social bookmark buttons, etc... I'm guessing that you only get the ...


4

According to your question Chrome was loading a plain HTTP favicon in a HTTPS page without any browser warning. Interesting. Redirecting to a plain HTTP website is not a vulnerability in itself. However, it is a security flaw if the redirect is accidental and you want your users to remain on a secure, trusted channel to your site. Script content will not ...


0

Redirection with Javascript or META tags ... You can not send a 301 status code via Javascript or META tags. Since the HTTP status code of the page will remain 200 OK ... ... Another disadvantage is that some browsers disable Javascript or META refresh. Therefore, one must include a link to the destination page in the body of the page ... URL redirection ...


1

There is indeed a vulnerability, because as you observed, an attacker could intercept the traffic on the unsecured line and change it. The reason your script didn't execute is that this came in the favicon, and Chrome (apparently) does not execute scripts in the favicon. To exploit this, you would have to get Chrome to execute the code in the favicion. ...


-1

If you don't use extensions change the name of the extension folder. ex: C:\Users\Username\AppData\Local\Google\Chrome\User Data\Default\Extensions change it to 0000extensions or what ever. seems to fix the problem, if you do not use extensions. Extensions can not be downloaded when the folder does not exist.


0

Our own servers cipher suites were correct, but Embedded resources also trigger the warnings - in our case, Mixpanel (an analytics company) uses CBC on their servers: Anything other than AES-GCM or CHACHA20_POLY1305 - ie, CBC is marked as obsolete by Chrome: In order for the message to indicate “modern cryptography”, the connection should use forward ...


0

It's not up to the client no negotiate that. The server has the last word in this. Chrome can not pick anything the server is not offering. Check your server with SSL Labs (be sure to check the "Do not show the results on the boards" checkbox) https://www.ssllabs.com/ssltest/


5

About Chrome According to https://www.google.com/chrome/browser/privacy/whitepaper.html In the event that Chrome detects SSL connection timeouts, certificate errors, or other network issues that might be caused by a captive portal (a hotel's WiFi network, for instance), Chrome will make a cookieless request to http://www.gstatic.com/generate_204 ...



Top 50 recent answers are included