Tag Info

Hot answers tagged

44

Assuming that you are coming from a BT connection, it's possible that this is part of the BT parental controls program. There is a discussion of a similar looking pop-up here , which seems to tie into what you're seeing, and also a thread here on the BT site which has a link to a process to turn off that setting. To test this theory you could log into ...


32

The purpose of the warning is that by using HTTPS, there is an expectation of proper security, but a self-signed or expired certificate has vulnerabilities that the user needs to be aware of. The "risk" is that one thinks they are properly secured, but they are not fully secured, as opposed to HTTP, where one knows there is no encryption at all. There ...


18

Security difference First, let's talk about SSL (now called TLS by the way), which adds the 'S' at the end of HTTPS and is in charge of "securing the communication". The clue to answer this question is indeed to fully understand what we mean by "securing the communication". SSL, no matter if it is a self-signed certificate which is being used or one signed ...


13

Wikipedia and big popular sites are mostly safe, as any security holes are found quickly, usually long before the site gets its momentum. Smaller blogs/forums which allow user content are more vulnerable. I used to visit a Russian tech blog several years ago, and the posting form allowed some HTML formatting. Someone managed to include JavaScript code from ...


10

There is no magic in there: the user will see what the web server sends, and the web server will send what you tell it to send. You said that both URLs will share the same IP using a DNS CNAME entry, so you will encounter a different behavior depending on the browser supports SNI or not. SNI is supported by all decently recent browsers and allows them to ...


5

To keep you up-to date, you can read about the freshly MFSA2015-78 where Firefox sandboxing mechanism is bypassed by violating the same origin policy. The problem fixed by Mozilla Firefox on the 6th of August 2015. This vulnerability allows attackers to bypass the same-origin policy and execute malicious JS code remotely that will be interpreted in the ...


5

EDIT - Updated based on comments from @AdmSelec below and info from GlobalSign Whilst usually when that error pops up it'll likely relate to SHA-1 hashing, in this case it appears more likely that it relates to a bug in Chromium on OSX (details here). Whilst the screenshot displayed doesn't show the certificate itself it does show information on the ...


4

You must not rely on browsers respecting the content-type header for security. A quick look at CVE-2010-1420 should give you an idea. Content-sniffing mechanism implemented in browsers can be manipulated by attackers to trigger XSS attacks (Secure Content Sniffing For Web Browsers: A Survey). Survey of content sniffing behaviors According to this ...


4

Without warnings for things like self-signed or expired certs, inappropriate cipher suite selections, and other bad HTTPS configurations, the presentation of a website's state of security to the user becomes binary - either you have HTTPS on the site, or you don't. This would hide a number of nuances which can significantly affect exactly how much the "S" in ...


3

You are greatly reducing your surface of attack by using lynx or similar, for example they don't run Javascript nor try to decode and display images so any vulnerabilities in these components don't affect it. But in theory, you are still vulnerable. Even in Lynx there are still components that parse HTML, interact with the network, keep track of cookies, ...


3

A shim or polyfill does not get installed into a browser but gets delivered as part of a web page to provide functionality for this page. It is just normal active content (JavaScript, Flash...) which only gets named as shim or polyfill because it serves the specific purpose described by these names. It has no special permissions or restrictions compared to ...


3

A developer chooses to write a polyfill because it fulfills his personal need. From this personal aspect may come all problems you may imagine, namely malicious JavaScript code. Can a shim be installed in IE, FF, or Chrome without user knowledge? Surely. Drive-by download attacks which consist in malware delivery without the knownledge/consent of the ...


3

Aviator has had actual security (not privacy) issues and is nominated for this year's Pwnie awards. In general, browsers will not share your history with websites you visit. There have been vulnerabilities in multiple browsers that would allow a website to get your browsing history or guess if you have visited some specific websites or not. The ...


2

Well I can only provide anecdotal evidence for this, but I have seen a site that I was reviewing make use of Panopticlick style functionality for tracking, so it definitely does occur. It appeared to be part of their overall user tracking / analytics set-up


2

The browser will generate a session key and encrypt it using server's public key. But which encryption algorithm (or commonly called as cipher algorithm) will be used by the browser? How is cipher selection determined, and will browser and server both use the same cipher/key size for encryption and decryption? The browser will send a ...


2

Firefox The battery API is enabled by default. It can be easily disabled without using third-party addons. Go to about:config, accept the warning, look up the dom.battery.enabled boolean and set it to false. Changes take effect immediately on subsequent page loads. To deploy these settings in an enterprise environment you can use the user.js file which ...


2

As of 2015 this is how you prevent your website from sending the Referer header: Just add this to the head section of the web page: <meta name="referrer" content="no-referrer" /> This works both for links and for Ajax requests made by JavaScript code on the page. Other valid meta options include: <meta name="referrer" content="unsafe-url" ...


2

A mature wiki software like Wikimedia usually does not allow normal users to embed any scripts in wiki articles. But still, wikis are prime targets for search engine spammers. The structure of wikis is very search-engine friendly which means that wikis often get quite a lot of page rank which in turn exends to any websites linked from them. Also, anything ...


2

Because it's not needed. All protocols which are commonly used to download files either have a buildin mechanism to ensure integrity of the data stream or rely on a lower-level protocol (like TCP) to provide this. This is a reliable precation against accidental corruption of files in transfer. When it comes to intentional corruption of files by a ...


2

I've never before seen anything like this. Is this the only case or has this been known to happen? The scenario you experienced could be innocuous as highlighted in @RоryMcCune' answer as well as it can be a nefarious attempt/attack. Let me explain this last scenario. There is one interesting scenario about your question: as @RоryMcCune said, what ...


2

Cookies by themselves do not create any vulnerability. The goal to delete cookies is merely to improve privacy by keeping websites from tracking your activity. A common way to track users, for instance, is when you visit several websites which include contents from some defined third-party tracking service (this content may be advertisement for the ...


2

In theory, yes, the webrtc standard let's a website determine your local ip address, so it can create a direct connection for you to a another web-browser, allowing direct connections between browsers to set up video streaming for example. This website has a proof of concept showing you your internal and external ip address: ...


2

These answers are great. But I often have to give a simplified answer without all the jargon. HTTP - It is not encrypted and the data sent over the line could be easily read. HTTPS - It is encrypted and verified by a trusted party the data is being handled by the correct source. HTTPS (Self Signed) - It is encrypted but there is no verification by a ...


1

As the warning message you got, the website you visited is likely to perform a drive-by download attack that does not require necessarily the user's interaction with the webpage. But using lynx command will NOT lead you to be a victim of such attacks because all types of drive-by download attacks succeed only by either exploiting, via malicious crafted ...


1

While the alert is alarming, based on the information provided, it does not appear to be of concern. When IE restarted, it attempted to reopen the page it was last on, which was apple.com. res://ieframe.dll/... is how IE reloads the last page it was on. Malware Bytes caught this dll loading and alerted on it.


1

You must always clear your cookies. Except in one case. A cookie is just a text file where some information in plaintext format is stored. But you can not get an answer if you do not know the type of cookies that exist: Transient Cookies (called also session cookies, non-persistent cookies or in-memory cookies): they are stored in the RAM and they are ...


1

A shim or polyfill isn't anything particularly special. It's just javascript code - the name is used to describe the task that it performs (i.e backfilling expected behaviour into older or incompatible browsers) To answer your questions: Can a shim be installed in IE, FF, or Chrome without user knowledge? As shims and polyfills are just Javascript ...


1

I think I have a better understanding of what you asking now: Having "a trust this computer" is not really a security weakness. This feature is to tell the company that this is a common computer you log in from and more of a user convenience. In order to have malicious software perform this check in your place, they would need to perform Session Hijacking. ...


1

There are different types of two factor authentication. Some types will protect against the threat you describe, others will not. Here are some common types of 2FA that will keep you protected against the key logger: Texting a one time use code to a mobile phone. Emailing a one time use code with the assumption that the user will not check the email on ...


1

I'm not aware of any security issue of reusing the same tab for different web sites, i.e. I don't think it is better or worse to reuse a tab vs. close and open a new tab. But apart from reusing only a single tab it can be a security issue if you use the same browser application or the same browser profile or even the same operating system for sensitive and ...



Only top voted, non community-wiki answers of a minimum length are eligible