Tag Info

Hot answers tagged

7

Typically developer versions (called beta editions in the Software Lifecyle) are used to showcase upcoming features. Some of these features haven't gone through the rigorous testing as a stable (Release) version. To illustrate this, here is Chrome's explanation documenting the differences Stable channel: This channel has the full testing of the Chrome OS ...


7

Hard to answer because we can have a lot of horizons here. Short answer: I will use your bank as an example. Let's say you open a new tab and enter on your-bank.com. If your bank has not explicitly developed any code to communicate with other tabs, no other tab could say that you are browsing your bank and what you are doing there.* EXCEPT if a ...


4

Regardless of what developers use, a QA test must be performed with what your end users are using (stable branch). Depending on how bleeding edge your developers are trying to be this may be more or less difficult. What is more secure? It depends on: What features developers are using (OpenGL, SSL validation, etc.) What your trying to protect against ...


4

Alice will see a warning. This is because the certificate is checked at the point where the SSL negotiation happens, which is before you get the contents of the page - whether those contents are an HTML page or a status code with a redirect. For an example of why this is important, imagine this scenario: Evul manages (e.g. by DNS cache poisoning or some ...


4

This is about personal privacy for users of the site. Like buttons are advanced web beacons. Its more than just a simple image, but JavaScript that identifies if you are a logged into a social network, and tracks your behavior over a long period of time. Facebook collects this information for targeted advertising. In this security system, if you don't ...


2

In addition to Lucas NN's excellent answer, there is also the threat of Cross Site Request Forgery. CSRF does not require there to be a current tab open in the browser, only a valid session. So if you're logged into Facebook and Facebook happens to contain a CSRF vulnerability, and you happen to visit an evil site that exploits this vulnerability, your ...


2

I will answer the question in a generic way, as well as the question was asked. If is the railway local web site that is being attacked and not you, you can not do anything to avoid this. No matter the speed of your internet or if you are using a VPN. To be clear, I am not considering a lot of factors here, because the question does not permits me.


2

There are CSRF prevention techniques that do not rely upon a session-bound CSRF token, after all there is more than on way to skin a cat. When considering a CSRF protection system, look for any shortcut that doesn't exist with the commonly used CSRF synchronization token pattern. There are three concerns with this proposed CSRF protection system. ...


2

This is a pretty scary thing to be doing, as by definition, you are wanting to look at sensitive, user-submitted data on those computers. Sure, you might catch the occasional wrongdoer, but you're going to be capturing quite a lot of normal people's passwords, emails, etc. Which is probably opening a whole slew of liability to whoever owns the computer lab. ...


2

Since it is a one-time link, just invalidate the original token and generate a new one on the page (make it an invisible field in the form), then POST it with the password reset form. Also, do not add any extra information that may leak user identity in the email link. A SHA-256 token is enough to complete the password reset process.


2

The point of RFD is abusing the trust of certain sites and if I can make arbitrary files look like they are coming from a trusted site, I get to bypass certain warnings. (Is it my browser that already trusts certain sites or is it the user or both?) I think it is only meant as in the user will look at the downloaded file and think "Oh, it did come from ...


1

The biggest challenge in developing secure (web) applications is implementing a secure (or security) development lifecycle process that is both effective and measurable. Enumerating all of the facets of such an undertaking is not possible here; but suffice it to say there are hundreds of books and white papers written to address the subject.


1

Yandex Alpha automatically imports data from several other browsers whilst installing. More docs on it here. In the case of Chrome it automatically imports: Browsing history Favorites/Bookmarks Saved passwords Search engines Cookies Extensions Advanced settings As you see in this list it automatically imports your cookie store from Chrome so ...


1

Browser leaking links? Here is a screenshot of my chrome settings: You can see that the browser may: query another service about whether the link is legit query another service if the link has an error I don't know the specifics, but that means you also have to worry about those services leaking the token before the user has a chance to visit the ...


1

If you want to do that install Firefox. Firefox comes with its own trusted CA store and what you add there will only be available to Firefox.


1

The whole goal of HTTPS is to prevent eavesdropping so that anyone monitoring your web traffic can't see what you're sending. As useful as it is, HTTPS presents a bit of a problem to antivirus software because when you visit sites over an encrypted connection, your antivirus software cannot see what sites you're visiting or what files you're downloading, at ...



Only top voted, non community-wiki answers of a minimum length are eligible