Hot answers tagged

54

There are a lot of advantages. Here are some: Auto-completion of previously visited URLs you forgot, which can speed up the web surfing process tremendously. You might have remembered parts of a URL or website title, and your browser can usually pick those up if you typed them in. I love this feature. This can offer extra security. As mentioned by ...


53

A scenario such banks might want to protect you from could be this: you visit your banking website and do your banking stuff. after you are finished you log out and then navigate to some other website to look at cat pictures or whatever. you leave your computer with the cat picture website open. Because there is nothing incriminating on your screen, you ...


25

There's a couple of things going on here: Bankings sites will use cache-control headers to forbid cacheing of the pages. So when you click back the browser has to reload the page from the server. Some parts of the site may have a strict flow of pages, e.g. you enter transaction details, enter your SMS code, view transaction confirmation. These require ...


12

The HTML standard is that unvisited links and previously-visited links are styled differently. By default in most browsers, an unvisited link is blue and a visited link is pink, but nearly every web page these days overrides that. In order to do this, you have to have a list of previously visited links so that you know what style to use for every link on ...


7

One obvious answer is when the website contains applications that you can download - it can then offer the content appropriate for your operating system. If I go to www.videolan.org with Javascript turned off, the download link goes to the Windows binary, but if I turn Javascript on, it goes to the appropriate binary for the system I'm actually using.


7

This isn't as common now, but quite some time ago a lot of websites were just HTML wrappers around classic terminal (IBM 3270 and the like) applications which were being scraped statefully, and this was especially prevalent in legacy industries where the whole idea of a separation between view and model is very, very new. It's possible that a lot of banking ...


6

Because it fits the majority Surveys (e.g. http://www.aleecia.com/authors-drafts/tprc-behav-AV.pdf) show that something like ~25% of people have ever used incognito mode and ~50% of people have ever cleared browser history. Needless to say, many of them don't do that all the time, so at any given moment a majority of users prefer to use a mode that does ...


6

Checking the root certificates of my browser I see that almost all Root CAs are using SHA-1 or below. The signing algorithm used for the trusted root certificates is unimportant. Signatures are used to establish trust. By definition, a trusted root certificate is one which you implicitly trust based on provenance (e.g., where it came from and how it ...


4

Pre-fetching as I understand it in Google Chrome performs things like DNS lookups and static content caching. In order to determine what static content to download, some parsing of the HTML document it pre-fetches must be conducted and it is known that browsers have been vulnerable to malicious HTML payloads in the past (Internet Explorer CSS and HTML ...


4

Why is it designed to trust all root CA to issue certs for any domain name? This has historical reasons and maybe for reasons to promote competition. At the beginning you had only a few root CA with very high prices. Now the prices are down because all CA can issue a certificate for anybody. If each CA would only be able to sign certificates for a ...


4

Relying on DNSSEC would essentially amount to transferring our trust from the CA's to the registrars (e.g. firms like GoDaddy), the TLD's (e.g. VeriSign), and the root (e.g. ICANN). I'm not sure we can trust these entities any more than we can trust the CA's. See Moxie Marlinspike's blog post for a great write-up on this subject: ...


4

HSTS, the HTTP Strict Transport Security mechanism, is defined by RFC 6797. The relevant section is section 12.1, No User Recourse, which states (in part) that (my emphasis): Failing secure connection establishment on any warnings or errors (per Section 8.4 ("Errors in Secure Transport Establishment")) should be done with "no user recourse". This ...


4

One of the primary concerns to limiting Internet access revolves around downloadable threats. Malware that may be part of a botnet. Viruses Rootkits etc.. These threats can obviously compromise security and is a common methodology used by attackers to gain entry to an environment. If you get an agent based executable installed to your workstation that ...


3

When you connect to your company's "remote access site", your computer is launching a Virtual Private Network (VPN) connection. This first installs a virtual network adapter called a 'tunnel' which is then configured to securely connect to your company's VPN server; at the company server, the other end of the tunnel emits your packets onto the corporate ...


3

Why do Firefox and Chrome allow such easy leaking of these session keys? To make it easier for developers to analyze their network captures. The first time I used this feature was when trying to understand what protocol is exactly used by the web-based noVNC. Using this functionality, I was able to decrypt the traffic in Wireshark. I read some ...


2

What you are referring to is a split tunneling. Split tunneling allows you to directly access the internet from your device, while the device has the VPN connected to the remote location. There are a number of pro's and con's to split tunneling - in terms of security and other logistics. See ...


2

If you're reading your mail in a browser, then the browser can read your mail. This means that Firefox or Google or Microsoft or Apple or Opera or whoever makes your browser can read your email. But it's worth pointing out that Google is no more likely than any other browser maker to want to read your mail. They don't have a reason to. Plus, open source ...


2

Should I then use Chrome or another browser to check my inbox? The problem is probably less the browser since this browser is used by lots of others and such behavior might be detected. More of a problem are likely browser extensions you have installed, malware injected into the browser or any software which does SSL interception. SSL interception is ...


2

What serious security threats are there that solely rely on the client JavaScript code that the browser allows? One risk are buggy implementations which can be used to crash the browser or execute code by using heap spraying attacks or similar. These can be kind of mitigated within modern browsers by using ASLR, DEP, sandboxes and similar techniques. ...


2

Typically, if you know ahead of time that you're going to want to revisit a page in the future, you'd add it to your favourites/bookmarks. The history feature is there for when you suddenly realise you want to revisit a page you were on yesterday / a week ago / a month ago. It is too late to turn the feature on. Yes, from a security perspective it seems ...


2

Is this a security benefit It serves no real security purpose, but it serves a privacy purpose. By blocking the referrer then the sites you visit will not know what site you were previously on (maybe my visit to a clothing website was due to a link I found on a deviant sexual forum discussing how the clothing company has a sale on?). A lot of ...


2

You could learn a lot of interesting information about the users system this way. This information could be used to find the correct exploit for the user, or just be collected or used as part of a system fingerprint to identify users (Even with another used browser). Detecting the OS would be extremely simple, but also the detection of used versions of ...


2

You can set a cookie when the user requests watchvideo.php, containing a hash of values identifying the client, like user agent, IP address, and so: <?php $ip = $_SERVER['REMOTE_ADDR']; $browser = implode(':', $_SERVER['HTTP_USER_AGENT']); $userFingerprint = md5($browser . $ip); setcookie('userdata', $userFingerprint, time() + 10); //expires in 10 ...


2

No, the Same Origin Policy also protects against: Cross domain manipulation in the DOM (e.g. a page manipulating another page from another origin loaded in an IFrame). The response from AJAX requests being read when the origins don't match. Images loaded from other origins from being read into an HTML5 canvas. So my question is: would we really need ...


2

You can test on your own: https://diafygi.github.io/webrtc-ips/ - or at least try to use google next time.


1

Agree with what Drewbenn commented. It appears that your account was opened in a significantly different geographical location. Netflix recently made changes to what type of traffic they will permit to stream. Without knowing more about where you opened your account and where you now reside it's difficult to pin that down as the problem. See below: ...


1

You should check whether your current IP is on a proxy list. Since your IP address is assigned dynamically, it could be that the former owner got himself onto a proxy list - these lists get generically blocked by many pages. It is, however, easier, just to get a new IP and try again.


1

Check on another device to see if the same behaviour occurs. I don't believe removal of malware is the scope of this forum. However, I'd recommend you do an virus scan, check your BHOs and Addins on your browser.


1

Almost all web browsers implement caching, so they technically have to manage a list of what is in the cache anyway. While the history feature nowadays might be implemented separately, and while you could build a cache that does not make deriving a history from it without analysing the cached content trivial (by using hashes instead of URLs as cache keys), ...


1

You could use browser fingerprinting, most browsers are unique in the plugins they use, version of those plugins, screen resolution (if you use your browser in full size) etc. You can check your browser fingerprint here



Only top voted, non community-wiki answers of a minimum length are eligible