Tag Info

Hot answers tagged

5

There are several actions you can take in order to secure Firefox, how far you chose to go is of course up to you. You can make some modifications in the Firefox preferences menu: "General" "when Firefox starts"->"Show a blank page" "save files to:"Downloads" "Content" check:"Block pop-up windows" uncheck:"Enable JavaScript" "Languages"->choose ...


4

To the best of my knowledge the problem you'll encounter in the described scenario is that certificates don't usually work by IP address This may vary from site to site, so test against your desired site by browsing to it via IP and seeing if you get a valid HTTPS connection. The rest of the question is more straightforward - yes browsers will give you a ...


4

I do not think that this violates the Same-Origin Policy, because the child tab is not able to access the data in the parent tab or modify it's content. This was probable designed like this in order to allow the web developers to offer a better user experience when dealing with multiple windows. On the other side, this is definitely something a web ...


4

Can A.js call a function from B.js? No, the javascript need to be defined on your current page Can A.js modify the DOM of page B.html? Yes, but you need a reference AND have the same origin. If page A have a reference to page B, it is possible for A to modify the DOM in B. Page A can have a reference to page B if page A opened page B and saved ...


2

The font files are loaded via CSS using code similar to this: @font-face { font-family: 'Modern Brush'; font-weight: normal; font-style: normal; src: url('/url-here/') format('woff'); } I'm not convinced they have tried to hide this at all. The woff font file loaded shows up under the fonts tab in FireFug ok. The preview fails though as it doesn't ...


2

Sites like Google and Facebook implement protocols such as OAuth to accomplish what you describe and what is known as Delegated Authorization. In short, the answer to your question is no. Sites that allow you to sign in with your other accounts never see your account credentials. In simple terms, Google / Facebook are creating a limited use token that links ...


1

I recently created a js-library (https://github.com/asvd/jailed) which might be suitable for your purpose. The idea is as following: the untrusted code is executed in a restricted sandbox (restricted subprocess in Node.js, or a web-worker inside a sandboxed iframe for a web-browser); the sandbox has no access to anything, but you can "expose" a set of ...


1

In cases where a password store key is derived from the account password, it is impossible to get access by force-resetting the account password. When that's happening, the password store is encrypted with a key derived from the password. Decrypting it requires the password; the password isn't just used to tell the OS you have permission to view it (like ...



Only top voted, non community-wiki answers of a minimum length are eligible