Hot answers tagged

15

Browsers do not accept verification from just any third party; if they did the whole exercise would indeed be pointless. In order to be accepted as valid, the certificate presented by the website must be digitally signed by a trusted certificate authority. The default list of trusted certificate authorities, which you can see in Chrome by going to Settings-&...


9

You better ignore that commenter entirely. Joey Spinosa is either royally confused or is trolling. There are many totally inaccurate statements in his comments; mainly from conflating Server Certificate with Certificate Authority Certificate. Claim 1: downloading files ... install these certificates of authority. Browsers never silently install a ...


8

SELinux will protect you against bugs created BY the chromium community, and their "oopses" or "hidden features" of that browser. You cannot put all eggs in one basket when it comes to security. Here, some examples where disabling selinux could not be a good idea: SELinux is preventing chrome-sandbox from write access on the file oom_score_adj - A ...


6

User agent strings are maddly complicated for historical reasons. It is a long story, but the short version is that everybody wanted to look like someone else to circumwent servers restricting access to webpages based on browsers. Yes, that used to be a thing back in the days. And now we are stuck with this sad mess. The good news is that this means that ...


6

Is there anything stopping from web browsers snooping into our activities? Nope, not really. That's a bit like asking Is there anything stopping my keyboard from recording my keystrokes? In theory, we are interacting directly with the keyboard / web browser, which in turn talks to other components for us, and we are trusting that it is acting in our ...


5

Presumably you mean the following four: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.63 Safari/537.36 most Web browsers use a User-Agent string value as follows: Mozilla/[version] ([system and browser information]) [platform] ([platform details]) [extensions]. Mozilla is a byproduct of browser wars. ...


5

Are there any frameworks that work this way? Sure. Twig or Django would be two examples. The inverse of this is clearly a far more secure default, ie. all dynamic data is escaped, unless you specifically tell the framework not to. Yes, this is a lot more secure. Is there something I'm missing? The one downside is that XSS is context-sensitive....


5

Short answer: This is extremely dangerous and must be avoided. There are a few things here that should be changed. First, user passwords must always be hashed. As I said in the comments, bcrypt is a common and appropriate hashing mechanism. Secondly, sending credentials back to a user leaves it open for abuse by an attacker - there is never a good reason ...


5

You should assume so no matter what* When your system gets compromised you must assume that it has compromised any accounts stored on the system. You should go about changing the passwords for any accounts used on that computer in any place. You have no control over the virus, and you have no control how programs store your data so you don't know if your ...


4

The way certificates work is that a certificate is sent by the web site to your computer. Your browser reads the certificate, looking for the identity of the "signing certificate." It then validates the signature of the downloaded certificate was created by the signing certificate. If the signing certificate is signed by itself, it is called a trusted ...


4

(tl;dr at bottom) Encryption is essentially free at this point, even on dial-up connections. Almost every major language has it built-in, or has a library for it, etc. The advantage of not using TLS/SSL is a very small fraction of a second start-up time, a very negligible reduction in CPU usage (a small fraction of a percent), and about 4kb of bandwidth ...


3

Given that you're attempting to defend against a Google "all-seeing-eye" attack, (and not the NSA), this is a good start. I've added a couple suggestions below. Your search engine activity will be trackable through the generation of unique links. Consider using a privacy-oriented search engine, like DuckDuckGo. You have their word they aren't trying to ...


3

Browsers will use the highest supported protocol negotiated between it and the server, even if SSLv3 is enabled. Newer browsers have SSL disabled, so will not be vulnerable to downgrade attacks. Also see here TLS/SSL support history of web browsers.


3

Since browsers and plugins like flash are not bug-free there is a non-zero risk that you can be attacked with malware just by visiting a web site or that your credentials gets stolen. These can be silent attacks (drive-by-downloads, cross-site-scripting, CSRF...) or social attacks (downloads of fake software updates, scareware, fake login,...). You will find ...


2

You should be okay. It is one of the oldest tricks in the book. The practice is refereed to as Malvertising. The idea is to make it appear the machine is compromised or having issues. They then usually direct you to a fix or a recommended program. However those are actually the real malware. And they may be ransomware, adware, bots, a remote admin tool, or ...


2

Yes - beneficial, although it doesn't fix everything. Being hacked through your browser is one of the most common ways you'll be hit. If the browser is running as a user that doesn't have access to your private files, your web cam and such, then the impact of a hack is much less. There are still risks. If the hacker uses a local privilege escalation ...


2

You should use secure WebSockets protocol in your product. Given (extremely little) information you provided about the details of your game*. Only general answer is possible to the question**: What is the worst thing that could happen if I don't enable wss? If you design and build a system disregarding common security precautions: at best nothing ...


2

You are correct on your first statement. Unless s/he is a trusted CA, your browser will still bitch that the cert is not trusted. And you'll know you're being MiTM'd. For the second paragraph, you're reaching a bit.The hacker would have to compromise DNS for ALL CAs and have a way to validate the bogus certs. Highly unlikely.


2

You did answer your own question already: Is this something exploited through vulnerabilities ... Buffer Overrun Buffer overflows are not intended behaviour, but indeed exploitable vulnerabilities. Browsers vendors will fix B.O. when they find it => they do protect from it. The problem is, as with all vulnerabilities, someone has to recognize ...


2

I know of two examples of differences in browser security: The SameSite cookie flag is a countermeasure against CSRF. Currently Chrome and Opera are the only browsers that support it. For an extreme example, there is Chromodo, a customized version of Chrome that disables some important security features. So it definitely matters which browser you are ...


2

There are methods of stealing browser-saved passwords so you need to assume that your browser is always vulnerable. At a very minimum, you should set a browser master password and enable encryption to stored passwords. You can also look into using something like KeePass which allows you to store encrypted passwords where you choose (i.e. hard drives, ...


1

i tried many php scripts like http://attacker.com/omg.php and it doesn't runs the script on my domain .. The problem here would not be a server side vulnerability but more of a reflective XSS vulnerability that runs on the browser not on the server which is why the php file did not work. Taken from OWASP (see here): Reflected Cross-site Scripting (XSS)...


1

For most major browsers that are used in the tech community, the only thing stopping them from being evil is the fact that they rely on open source code, and are widely poked and prodded. Unfortunately, these browsers also include add-ons and extensions, which are less likely to be well-vetted and so even more likely to be causing insecurity. It is indeed ...


1

Here, the vulnerability does not talk about some program running on your machine. The problem is data being overwritten at the wrong place. You can find the details of the vulnerability here: http://blog.talosintel.com/2016/06/pdfium.html#more As mentioned in the webpage: If in the above call to opj_calloc, which is a calloc wrapper, numcomps value ...


1

Going to web-pages can be dangerous. The most immediate danger is getting your browser hooked. These hooks act as anchors in your browser and allow the attacker to have some basic control over your browser. This can lead to further exploitation and, if the attacker plays it right, can end in you getting owned. If disabling JavaScript entirely isn't an ...


1

There are two parts on http://stegosploit.info/ The first one is about hosting the javascript exploit in an image file loaded through canvas. As such, it's not really interesting since in order to be exploited, the attacker would already need to be able to insert javascript into the webpage. The second part involves also including the html into the image ...


1

To answer the question: The website admin must be in on the exploit. The encoding technique is there to obfuscate the actual exploit scripts, thus flying under the radar from current detection methods. It still requires HTML/Javascript to be on the webpage in order to decode and run the exploit. That is to say, if I had encoded an exploit into ...


1

Yes, it is a problem, maybe even a big problem, but "XSS" probably isn't the right term. What could possibly go wrong? remote code execution using svg, especially older browsers off-site images leak your user's IP address (aka lat/lon), userAgent, and net performance malicious images themselves been vectors, lots of 0days in the past A special or even ...


1

No, in modern browsers no XSS is possible via the style or src attribute of an <img> tag. So neither of these would execute the JS code in any up-to-date browser: <img src="javascript:alert(1)"> <img src="x.jpg" style=background-image:url('javascript:alert(2)')"> Support for Javascript in CSS attributes has long been abandoned. You can ...


1

Similar to XKCD Authorization, however replace "stealing the laptop when logged in" with "executing processes in the context of my user". So, yes, they might not be able to get at your user account itself in your case, so local files would be protected, but they could get access to all your active sessions within your browser. Add in a priv escalation ...



Only top voted, non community-wiki answers of a minimum length are eligible