Tag Info

Hot answers tagged

6

Chrome: Open Chrome Type chrome://net-internals/#hsts in the address bar of chrome Query domain: if it appears as a result, it is HSTS enabled Firefox: Open file explorer Copy paste %APPDATA%\Mozilla\Firefox\Profiles\ in the address bar of file explorer (for Linux it is ~/.mozilla/firefox) Double click the folder you see (if you have multiple FF ...


4

This message is just utilizing the alert function from javascript which is used to display a message to the user. One thing you need to understand is that once this tab has been opened you have already browsed to the "scam" site, the message is shown by the scam site. No harm can be done from the message itself and not from clicking OK. It doesn't matter ...


4

The challenge with any non-mainstream browser is that writing a browser engine from scratch is a complex and expensive process, and maintaining a fork of a browser and tracking upstream is also a complex process, especially once the fork starts to deviate significantly from the base project. If you look at the problems that WhiteHat aviator encountered ...


3

Its a fake alert for scaring users, it will later download fake antivirus program and show you fake scan results. These results will be very alarming and exaggerated displaying various types of virus present on the system and will ask users to buy the product in order to clean the system. Don't fall prey to such scams and never buy any of these products. ...


3

The website is using SHA1 certificates to provide security. The new Chrome browser is showing it as a weak algorithm, because most of the organizations are already migrated to SHA2 certificates. It is just a warning, it does not mean that it would be a non-secured connection.


3

What you describe is a wrong, spam practice but it does not cause other inconvenience over the spam aspect. Browsers allow JavaScript code initiated by a user click to add bookmarks in order to allow websites to propose friendly "Bookmark this site" buttons. However such functionality can be exploited in order to store unwanted bookmarks in visitors browser ...


3

If the linked resource is an image or a script, often the main concern is not that an attacker could read it, but that an attacker could hijack the request and inject a modified version of the resource to change the look or behavior of the page - scripts especially, as they could be modified to do something malicious like redirecting the user to another ...


2

Tor could be a solution for you, if you could compromise some of the browsing speed. Tor tries to implement many countermeasures for your anonymity theft. I would recommend that just using Tor is not enough please read the Tor FAQ for further details. Update: Apart from that I would say you have to change your browsing habits too in order to stay ...


2

Google Chrome Click on the padlock at the left of the address bar Mozilla Firefox Click on the padlock at the left of the address bar Then click 'more information' Internet Explorer The padlock is to the right of the address bar, but it won't help. Instead (On a blank bit of the page) right click Properties It would be neat if Internet ...


2

To answer the first two bullet points: Firefox has its own list of trusted CAs. You can add certificates in Menu Button>Options>Advanced>Certificates(tab)>View Certificates>Authorities(tab). This is for Firefox version 38. Yes Google is trying to shame people into moving from SHA1 to a more secure hash such as SHA2. Here is the chromium blog post about it. ...


1

How can I add certificate pinning for other domains to my web browser (e.g. FireFox)? I don't think it's got a GUI in Firefox. For Chrome see Tom's answer. Is there a reason why there is no option to "Pin this certificate to this URI" when viewing the details of a certificate in a web browser? Yes. It's support hell when it's time for a key ...


1

You can do it in Google Chrome with chrome://net-internals/#hsts : In that screen you can consult the pinning state of a website (HSTS, HPKP and preloaded) but you can add certificate pinning for any domains too : In the Add domain section, you can specify for any domain : If you want to force HSTS If you want to pin some certificate : you need to ...


1

You can try to update your web browser and maybe plugins. If your browser supports it, you can disable weak ciphers and apply custom order to ciphersuite. This can help you in this: https://www.ssllabs.com/ Everything else must be done at the server side.


1

Mixed-content warnings occur when an HTTPS page is asked to load a resource over HTTP. This is dangerous because the insecure resources and vulnerable to alteration by an active attacker or eavesdropping by a passive attacker, which violates the user's expectation of security for an HTTPS page. An anchor <a> link does not cause any resource to be ...


1

This is sort of how JA-SIG CAS (enterprise SSO) works. To apply that architecture to your instance, setup the following on WebsiteB: Have WebsiteB generate a unique token in the link such as in the query string and make sure it uses SSL. Store the token information in a database (or similar method). Be sure to include a timestamp for when it was issued ...


1

What you are proposing is the same architecture that is used in online password managers like Lastpass and online Bitcoin wallets like Blockchain. You have named the two big threats: Javascript tampering and a compromised computer. You deal with the threat of Javascript tampering by securing the server and convincing the users that your Javascript is ...


1

To protect yourself from such invasive advertising, I would recommend you to install an ad blocker. It might be ethically questionable to use it on all websites, because that way you are depriving website owners of their income. But when a website uses malicious advertisement, using it is reasonable self-defense. Another way to protect yourself from such ...



Only top voted, non community-wiki answers of a minimum length are eligible