Hot answers tagged

33

but the implication in the other question is that videos in question have been downloaded and played by media software on the target computer. No it is not. The implication is that there need to be a bug in the code handling the data. For instance the ffmpeg library is used in browsers like Chrome or Firefox and it had several serious bugs in the ...


11

A web browsers video system is just another video player, so the same problems apply which were mentioned in the linked question. The smaller set of supported video codecs greatly reduces the attack surface, but doesn't make bugs in the decoders for these formats inconceivable. The Adobe Flash plugin is renowned for its plethora of security bugs in the past ...


5

Effectively they can see everything you do that's not encrypted or sent through a tunnel and in many cases they can see what type of traffic that is too via DNS. I'll list a few examples: What sites you frequent. When you're active on-line. What operating systems you use and in many cases what software you use. How often you patch your computer. The ...


4

Generally, it is ill-advised to implementing your own session handling. If you can, you would be better off by using a well known and well tested implementation. These are the issues I see in your procedure. User requests password reset How will you handle misuse of this function - will you send one email per reset attempt, or will you implement a ...


4

If you insist on talking HTTP through telnet, a proper HTTP server won't answer you before you're sent two consecutive line feeds, effectively ending your request: GET / HTTP/1.0 <empty line> If the service starts answering you before sending the empty line, it's not speaking proper HTTP, and may be something else entirely. I'd suggest using a tool ...


4

Yes, the VPN provider is able to see your data. If the data are not encrypted (i.e. HTTPS) the provider will be able to get to the clear text and will also be able to manipulate the data. The usual protections of HTTPS apply, i.e. the provider will see which site you visit but not the clear text data itself because they are encrypted. The provider will also ...


1

Is it possible to send HTTP packet via spoofed IP? No you can't. HTTP is a protocol on top of TCP and doing IP spoofing with TCP is nearly impossible due to the internals of the protocol. You would not only need to send a single spoofed packet like in UDP but you would actually need to reply the packets of the peer with the matching sequence numbers ...


1

This could give rise to an information leakage vulnerability. Say your whole site is served over HTTPS, without DNS prefetching disabled. There may be certain pages on your site that reference other external resources. For example, imagine a banking website that customers can login to, and that the page for managing mortgages has some external links unique ...



Only top voted, non community-wiki answers of a minimum length are eligible