Tag Info

Hot answers tagged

7

There are three main areas of difference. First, password management is a feature for browser developers, while it is the entire product for the third parties. So typically, the browser managers only offer basic core features. The 3rd parties add lots of useful stuff on top to differentiate their product. For example: Storing other information apart from ...


5

For many Linux browsers (I've tested Opera, Firefox, and Konqueror), this is normal: a bare / is an invalid URL (there's no protocol), and it gets interpreted as file:///: "display a directory listing of the root directory". There's no security risk here: only you can display the contents of your computer's root directory using a file: URL, you cannot ...


4

Guess My educated guess from reading the spec: The browser will never see more than one server-certificate. Rather the cipher spec is negotiated in advance. And ONLY THEN does the server send the certificates. So if negotiation winds up with an an RSA-cert authenticated cipher suite, then the RSA cert chain will be sent. And if the negotiation winds up with ...


4

Google is not hosting ChromeSetup.bat. A requirement for this attack is that a website needs to have an endpoint with a less common Content-Type and preferably a misconfigured Content-Disposition header (namely: no 'filename' attribute). These two headers will cause the browser to download the response as a file, instead of rendering it. In the URL you ...


3

Aren't files already on my disk more trustworthy than those loaded from remote sites? No. Expected local HTML use case for normal (ie non-developer) users is they've gone to a web page, wanted to view it offline, and used the browser's Save As functionality to make a local copy. This does not imply any level of trust between the user and the operator ...


2

If any of the pages you've archived on your server contain malicious code targeting webkit vulnerabilities (remember, wkhtmltopdf runs on webkit), it's theoretically possible this will result in a security breach on your server upon running the page through wkhtmltopdf. The implication here being that malicious code that would normally target your users' ...


2

This really depends on the sites you're logged in to and how alert you are as a person. I can imagine the following scenarios (not specific to any of the sites you mentioned, but just general scenarios): Sensitive information is transmitted in the URL: For each request, a session ID is transmitted in the URL. In this case proxy servers will log the ...


1

Google's Diagnostic page says: http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http%3A%2F%2Fgoo.gl Part of this site was listed for suspicious activity 1 time(s) over the past 90 days. URL-Shorteners are often used to obfuscate malicious links. Google's own link shortener is no exception. Maybe the safebrowsing blacklist ...


1

In spite of being possible to read/write data to SSL/TLS channels as with vanilla TCP/IP sockets, in Java or C or whatever, SSL provides you the concept of SSL session, which can be kept across several TCP/IP connections. Thus, IMHO this makes SSL a session layer protocol (I wonder why someone came up with the TLS name...).


1

You've already listed some resources so I will add another that is not a tool per-se, but a write up on how the different browsers are storing data. The write up contains a minimal python script that should help get you started. As for Safari, pre version 6.0 the credentials were only base64 encoded so it was easier to get data then. The difference with ...


1

When the default DNS server of your internet provider doesn't give you the results you expect, you could set a different one in your operating systems network settings. Here is a list of IP addresses of public DNS servers. When you need help with setting a DNS server in your operating system, consult the appropriate stackexchange.


1

It turns out that the DNS system has been hijacked by yandex in cooperation with turk telekom (TTNET) which in turn results in non resolving pages end up on the yandex landing page.


1

On Windows, your Chrome saved passwords are encrypted using DPAPI. This mechanism ultimately derives a key from your Windows account password to keep the data secure, and so once you've logged in, the data can be decrypted by applications that rely on this store. So, Chrome doesn't have access to your Windows account password at all. It relies on the ...


1

The browser checks both fingerprints. The idea behind that is if it is possible to create a fake certificate with the same MD5 or SHA-1 hash, there is a much lower (almost zero) probability the same certificate second hash also matches. This could be called: Dual Hash Fingerprinting. Both MD5 and SHA-1 are considered vulnerable in theory (MD5 also in ...


1

There's actually a simple solution to this: build an application that takes a single command line parameter (the URL) and launches the browser directly with that URL after a confirmation box is shown. Set this application as the default browser. When the system sees a ShellExecute or CreateProcess with a http:// URI as the target, it passes off execution to ...



Only top voted, non community-wiki answers of a minimum length are eligible