Tag Info

Hot answers tagged

7

Chrome: Open Chrome Type chrome://net-internals/#hsts in the address bar of chrome Query domain: if it appears as a result, it is HSTS enabled Firefox: Open file explorer Copy paste %APPDATA%\Mozilla\Firefox\Profiles\ in the address bar of file explorer (for Linux it is ~/.mozilla/firefox) Double click the folder you see (if you have multiple FF ...


4

The challenge with any non-mainstream browser is that writing a browser engine from scratch is a complex and expensive process, and maintaining a fork of a browser and tracking upstream is also a complex process, especially once the fork starts to deviate significantly from the base project. If you look at the problems that WhiteHat aviator encountered ...


3

If the linked resource is an image or a script, often the main concern is not that an attacker could read it, but that an attacker could hijack the request and inject a modified version of the resource to change the look or behavior of the page - scripts especially, as they could be modified to do something malicious like redirecting the user to another ...


3

The website is using SHA1 certificates to provide security. The new Chrome browser is showing it as a weak algorithm, because most of the organizations are already migrated to SHA2 certificates. It is just a warning, it does not mean that it would be a non-secured connection.


2

Google Chrome Click on the padlock at the left of the address bar Mozilla Firefox Click on the padlock at the left of the address bar Then click 'more information' Internet Explorer The padlock is to the right of the address bar, but it won't help. Instead (On a blank bit of the page) right click Properties It would be neat if Internet ...


2

Tor could be a solution for you, if you could compromise some of the browsing speed. Tor tries to implement many countermeasures for your anonymity theft. I would recommend that just using Tor is not enough please read the Tor FAQ for further details. Update: Apart from that I would say you have to change your browsing habits too in order to stay ...


2

These are simply Subdomains created by the website owner. ww3 is often used to share load (ww1,ww2,ww3) on their servers. In you example it seems intel created www-ssl subdomain to separate normal http traffic and https traffic on subdomain level. If you want more information why somebody is doing this, just ask google or the website owner


2

To answer the first two bullet points: Firefox has its own list of trusted CAs. You can add certificates in Menu Button>Options>Advanced>Certificates(tab)>View Certificates>Authorities(tab). This is for Firefox version 38. Yes Google is trying to shame people into moving from SHA1 to a more secure hash such as SHA2. Here is the chromium blog post about it. ...


1

How can I add certificate pinning for other domains to my web browser (e.g. FireFox)? I don't think it's got a GUI in Firefox. For Chrome see Tom's answer. Is there a reason why there is no option to "Pin this certificate to this URI" when viewing the details of a certificate in a web browser? Yes. It's support hell when it's time for a key ...


1

You can do it in Google Chrome with chrome://net-internals/#hsts : In that screen you can consult the pinning state of a website (HSTS, HPKP and preloaded) but you can add certificate pinning for any domains too : In the Add domain section, you can specify for any domain : If you want to force HSTS If you want to pin some certificate : you need to ...


1

You can try to update your web browser and maybe plugins. If your browser supports it, you can disable weak ciphers and apply custom order to ciphersuite. This can help you in this: https://www.ssllabs.com/ Everything else must be done at the server side.


1

To protect yourself from such invasive advertising, I would recommend you to install an ad blocker. It might be ethically questionable to use it on all websites, because that way you are depriving website owners of their income. But when a website uses malicious advertisement, using it is reasonable self-defense. Another way to protect yourself from such ...


1

Mixed-content warnings occur when an HTTPS page is asked to load a resource over HTTP. This is dangerous because the insecure resources and vulnerable to alteration by an active attacker or eavesdropping by a passive attacker, which violates the user's expectation of security for an HTTPS page. An anchor <a> link does not cause any resource to be ...


1

This is sort of how JA-SIG CAS (enterprise SSO) works. To apply that architecture to your instance, setup the following on WebsiteB: Have WebsiteB generate a unique token in the link such as in the query string and make sure it uses SSL. Store the token information in a database (or similar method). Be sure to include a timestamp for when it was issued ...


1

What you are proposing is the same architecture that is used in online password managers like Lastpass and online Bitcoin wallets like Blockchain. You have named the two big threats: Javascript tampering and a compromised computer. You deal with the threat of Javascript tampering by securing the server and convincing the users that your Javascript is ...



Only top voted, non community-wiki answers of a minimum length are eligible