Tag Info

New answers tagged

4

When you use a re-webber proxy (a website where you enter a URL and it shows you the content of that url in its own context), using TLS between you and the end-website becomes impossible, even when the proxy would want to provide it. When you enter https://google.com in the proxy you linked, you get redirected to ...


0

Aside from possible flaws with SSL, you can make sure the certificate belongs to the site you're visiting. If SSL is secure, then your data should be secure as well. I'm not too certain on the feasibility of faking certificates, but generally what I've read is if it's signed by the proper authority then it's real. I would do some research first, although I ...


2

[Disclosure: I, too, work for a password manager company] Long ago, I tried to develop my own password management solution using PGP/GnuPG. As I thought more about it, I found it unsatisfactory and eventually switched to the one that I have now come to work for. Here are some things you should consider before trying to roll your own password management ...


1

I think you might be mixing a couple of risks up here. If you are surfing a site and purchasing goods from them, then they will inevitably have access to any data you enter into their site. This would include the username/password that they use on the site and likely any payment card details that you use to pay for things on their site. This is because ...


0

SSL not only ensures that the transaction is ciphered. It also verifies the identity of the website you are visiting. So, if this is a known website, stealing your confidential information wouldn't be that smart for their reputation. Just type this kind of confidential information on websites you trust using HTTPS protocol (also make sure its identity is ...


2

Full Disclosure: I work at a password manager company. I won't say which because I'm not going to mention any of them by name. You are better off using one of the commercial or FOSS, already existing password managers. Why? Because a team of people who work full time (or in the FOSS managers, a team of dedicated and intelligent volunteers) on the project ...


5

I felt compelled to offer a less paranoid answer, having at times myself used "untrusted" networks for otherwise secure transactions. It is certainly true that a network where data is transported via plaintext is susceptible to man-in-the-middle (MITM) attacks. In such a network, both the data you receive and the data you send can potentially be read and ...


11

Without looking at the code: Yes, you should be worried! Nobody should tamper with your internet traffic, as this opens many possible threat scenarios. Even if you try to open any page and it is showing a page instead that is asking for the WiFi credentials this is impossible, as the router has first redirected your DNS query and then pretends to be the ...


114

Yes, you should be worried. You should contact the hotel staff, and you should not use the network any more. It is likely the router’s DNS is manipulated. It is possible that the hotel wants to make some money on the side by injecting ads. However, this script looks evil. It tries to open a dialog that tricks you into installing a trojan by displaying a ...


0

Actually in this case, the origin of Google analytic script is a.com quote from this book JavaScript: The Definitive Guide It is important to understand that the origin of the script itself is not relevant to the same-origin policy: what matters is the origin of the document in which the script is embedded.


3

No it is not safe. You are correct that the JSONP service could deliver arbitrary JavaScript, which is then executed as part of your site. Because JSONP is essentially a hack to get around the same origin policy, it is not possible for a JavaScript framework to perform sanitisation. These days, CORS is the preferred way to call external sites. An ...


0

You could use this crypto library https://clipperz.is/open_source/javascript_crypto_library/ which comes with a certified random generator, Fortuna is the name. The Math.random() function is not considered secure for cryptography purposes.


1

Michal Zalewski aka lcamtuf made some interesting posts recently and showed some pocs and explanation on how to do it with modern browsers: read first: post @ bugtraq History theft with CSS Boolean algebra Defend Your Spaceship! very impressive research imho


1

There are no built-in solutions. (But there certainly should be!) You can indeed download the data using XMLHttpRequest 2 and then verify its hash using a JavaScript SHA-256 implementation before doing something with the result (e.g. evaling it, if it is JavaScript code). This will only work if the untrusted server supports CORS. The browser cache of the ...


0

Solutions for Google XSS Chanllenge 2 : - http://www.securitytube.net/video/10388



Top 50 recent answers are included