Tag Info

New answers tagged

3

Firefox takes hashes of various page parameters (mainly URL segments) and passes them back as part of Google's SafeBrowsing scheme. It cannot readily identify parameters or other information that you pass to the target - it's just used to check against a list of known attack domains. As per these instructions, you can turn SafeBrowse off: Firefox button ...


12

Drilling a bit deeper on the copy and paste issue: Microsoft products, particularly the Office suite, are notorious for attempting to help by adding trailing white space to items copied from, say, Outlook and pasted elsewhere. The purpose of doing this is so that you don't have to be as careful where you place the cursor when copying and pasting to avoid ...


4

It's probably a usability issue. It's very easy to unintentionally accidentally add a space to the beginning or end of a username or password, especially on certain types of devices: mobile with autocomplete, people typing via voice, people using assistive technologies that auto-insert spaces, copying and pasting passwords, etc. The other day I was ...


15

They trim passwords to deal with the (sometimes insecure) process of people copying and pasting them.


9

Because they trim whitespace. The why of that is not known, but is not unusual, and often is related to the inability for humans to discriminate - you and I know that foo bar has a space in the middle, but it's hard for us to say how many spaces are in foobar if any of them are trailing. Judging from productforums posts, this policy is not new.


1

Unfortunately that is not how it works. In your example, Content-Security-Policy:default-src *; script-src 'unsafe-inline' 'self'; Content-Security-Policy:script-src 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com/*'; 'unsafe-eval' https://maps.googleapis.com/*' are both sources. It is not stating that unsafe-eval is allowed on ...


0

If the entire network block is marked as malicious by Google, a lot of innocent sites will end up marked as malicious, as you have seen. If you are sure that the site you want to visit is not malicious, you can navigate to them and nothing bad will happen. That message is just a warning. Your web filtering software (if installed and updated) can protect ...


-3

According to Google: Of the 148000 site(s) we tested on this network over the past 90 days, 3065 site(s), including, for example, yxdown.cn/, 97sky.cn/, cr173.com/, served content that resulted in malicious software being downloaded and installed without user consent. The malicious software usually is Cross-site scripts (XSS), these are scripts that can ...


1

From Google's Privacy Policy: When you use Google services, we may collect and process information about your actual location. We use various technologies to determine location, including IP address, GPS, and other sensors that may, for example, provide Google with information on nearby devices, Wi-Fi access points and cell towers. Unfortunately, this ...


0

All of the above posts are correct in that you need to trust the third party in order to safely use external js resources. The only thing I would add on to that is make sure that you are accessing those resources over SSL and that it's an up-to-date implementation (proper cipher suite, TLS v1, etc). If you are going to trust the third party, SSL is needed ...


5

This has more to do with risk management. You do not have any contract with Facebook or Twitter. So you have a risk that they may change the contents of the JavaScript file without you knowing. This can be malicious or accidental, either way you have no control of this risk. So unless you get a contract with the external party which moves the liability to ...


0

Hosting locally will not prevent them from doing anything malicious. In this case, if you are importing a JavaScript file from external source, into your page, you will have to 100% trust the JavaScript as this script will be executed within your own origin. Hosting them locally might provide some advantage in case the source you trusted is compromise. The ...



Top 50 recent answers are included