Hot answers tagged

53

In theory, if all servers and connections to them were perfectly secure (impossible) and trustworthy (not true), neither one would be more "secure" than the other - mainly because the developer(s) of the website are in full control of the content of the site. Since Flash and the JS is served to clients, the server would have to serve malicious content to the ...


30

In addition to WillS' excellent answer, a couple more differences that affect security: Flash is a product, while HTML5/Javascript is a specification. With a product (and especially a closed-source one), you always depend on the vendor to play a game of whack-a-mole (which Adobe is doing admirably, but long term it is a losing battle). A specification can ...


22

A popup was used to show the alert. Does this mean that the popup feature introduces vulnerabilities? Then by that line of reasoning JavaScript is the source of all problems. There are people who actually think that JS is an important vector for attacks and block it on untrusted websites with extensions like NoScript. Many features can be misused, and is ...


7

EME doesn't "allow" proprietary code, that's a misinformation of Wikipedia based on this four years old post , a post which does not provide real information, just the assumption that at some point a full DRM solution will be integrated into the browser. The EME is just an API to interact with the license server and the Content Decryption Module. This CDM ...


6

Yes, in the past there have been lots of exploits that only relied on malicious HTML and CSS code. You are right in that parsing a complex, turing-complete language is potentially more error-prone, giving an attacker more tools to craft an exploit. Yet, there are many different ways in which the implementation of the used CSS parser or other modules ...


6

Firefox The battery API is enabled by default. It can be easily disabled without using third-party addons. Go to about:config, accept the warning, look up the dom.battery.enabled boolean and set it to false. Changes take effect immediately on subsequent page loads. To deploy these settings in an enterprise environment you can use the user.js file which ...


5

In this post in the chromium forum there are alternatives mentioned Within the browser space, alternatives exist such as: Use the device's native management capabilities if an enterprise use case. On Windows, this is Group Policy. On iOS/Android, this is the mobile device management suites. On OS X, this is Enterprise settings. On ChromeOS, ...


4

Honestly, the core question is whether vibration of the phone will give an application/website significantly more authority than without the vibration. Now, obviously I lack any research into this specific issue, but we can note that applications do not use vibrations as a way to convene authority. If anything it would feel wrong for an application to ...


2

Apparently the sessionStorage is not really cleared when closing the tab. It is easily revived by clicking on "Reopen closed tab" I've written more about it in here: http://blog.guya.net/2015/08/25/the-never-ending-browser-sessions/


1

Panopticlick is looking for things that make you different to other visitors. In this case, fewer people use canvas blockers than don't, so you become more unique if you use one. However, this only means that it is easier to tell you apart from another user - not that they can tell who you are. Think of it being like a security camera which can only see ...


1

I would like to start this post by mentioning that I expect a downvote from the OP, and possibly a flag, as this question is in fact part of an elaborate straw man which was originally an argument which resulted in my posting of this question. No need to get into that here. But I will certainly answer the question. I would also like to note that Steffen has ...


1

Your question is broad and I will try to answer part of it. In my opinion the move to the web, disabling of Flash and Java etc does not make the whole system safer. It just shifts the fragility and exploits to other kinds of attacks. While we currently have lots of attacks at the OS level and application level (buffer overflows etc) we will have more logic ...


1

I found a way to prevent the use of this API using javascript. Worked for me in chrome and firefox (Desktop version). (function(navi){ var nnav = new Proxy(navi,{ get:function(t,p){ if(p == "getBattery" || p == "battery"){ return void(0); } if(t[p] instanceof Function){ return t[p].bind(navi); ...


1

Is HTML5 vibration feature a security vulnerability? Should mobile browsers enable such a feature on websites by default? At least in the scenario you describe, no. The vibration feature here facilitates a social engineering attack, but is used as intended and designed. In a more general sense, there may well be other security vulnerabilities related to ...



Only top voted, non community-wiki answers of a minimum length are eligible