Tag Info

Hot answers tagged

50

Browsers are applications for end-users. While the majority of sites is available by http (even if they just redirect to https) a significant part is not available by https. Thus your proposal would break web surfing for a very large part of the users. It would break in a way they don't understand. Automatically downgrading to http if https fails would not ...


15

I think what you are noticing is a client-side acknowledgement of your sessions with Facebook, Gmail, etc. If a sharing script originates from facebook.com and you have an active session with that hostname, they will present a streamlined share button (for example) for your account. The website linking you to the script on Facebook cannot see who you are ...


13

Well, I can presume that a few reasons exist: Websites are not automatically enabled with https support. Therefore, why should browsers be? Saying that a website is not accessible unless using a specific scheme would be over the heads of a significant number of users. Switching to https is not as simple as it sounds in some cases. Take Stack Exchange for ...


7

There's a bigger issue at play here that would prevent your suggestion. The way many web servers are currently configured, you could actually end up on the wrong website if you defaulted to https. This is not true if you default to http. For example, suppose you have 3 sites all on the same IP address: http://site.a.com http://site.b.com https://site.c.com ...


5

If code is served by a large Content Delivery Network (CDN), like Google's CDN, then it is more than likely that you will be hacked through other means. Large CDNs have a lot of money to spend on security, and a CDN is unlikely to be a weak point in your own infrastructure. Once a site hits a certain level of popularity, then it needs to serve static ...


4

In the case of Facebook, their SDK allows a website to determine whether a user is logged in: FB.getLoginStatus() allows you to determine if a user is logged in to Facebook and has authenticated your app. There are three possible states for a user: the user is logged into Facebook and has authenticated your application (connected) the user is ...


3

Validating the certificate will be the least of your problems if you're using a computer that you do not have full control over. If you are really worried about security, the bigger problems would probably be: web history buried deep within the hard drive (depending on the way information is accessed) keylogger software forgetting to log out of accounts ...


2

Frankly, yes, there is an issue. Assuming, of course, that your browser is auto-completing forms, it's possible that it will happily populate any applicable field it sees, whether you can see it or not. That's why it is important to keep your auto-complete tool clean. Packages like LastPass add a large red icon to fields it auto-completes so that it is ...


2

Hacking / \ / \ / \ Script Kidde Genius 1>Staight away start 1>Start with basics and move up the ladder. with Tutorials. 2>Program ,program and program in many ...


2

I know it seems at first to be such an enormous field that's it's just too hard to know where to start, so please ignore the abruptness of some of the responses (but do consider the intended communication). This, however is not the right forum for this particular question, as has been mentioned above. This is the place to come when you have a specific ...


2

The font files are loaded via CSS using code similar to this: @font-face { font-family: 'Modern Brush'; font-weight: normal; font-style: normal; src: url('/url-here/') format('woff'); } I'm not convinced they have tried to hide this at all. The woff font file loaded shows up under the fonts tab in FireBug ok. The preview fails though as it doesn't ...


1

On an untrusted computer, you cannot know that no one is eavesdropping. This is just a fact of security -- TLS can protect against a man-in-the-middle, but nothing whatsoever can protect you against someone with administrative access to your computer. Even if you have public key pinning for the site, which means that a rogue CA can't create a fake ...


1

I think there's a real danger of confusing a lot of users, which would make the situation even worse. Trying HTTPS everywhere isn't necessarily a bad idea, but there needs to be some sort of fallback plan for the user when HTTPS isn't available. Many users aren't interested in warning signs, they just want their content. In many cases, protecting the ...


1

The EFF has a plugin for Firefox (including Android), Chrome and Opera. It's called HTTPS Everywhere and it uses rules to make sure you end up on the right site. For example it'll rewrite example.com to https://secure.example.com/ if it knows that the https version only lives on secure.example.com. It even replaces urls inside links etc. ...


1

Any website which requires security should redirect from http:// to https:// automatically. This would make the requirement for the browser to automatically view https:// redundant, and is a simpler solution than having to redirect from https to http for sites without certs. This is something that shouldn't really be done anyway, which means the browser ...


1

Right now browsers use HTTP by default because it is what has been done for decades. It's not the browser's responsibility to ensure that the website is secure. It relies on the website to make the appropriate redirection and support HTTPS. Typing in google.com will redirect to the HTTPS version just fine. If a website supports HTTPS then it should put ...


1

The main issue with including scripts from other sites is that they (or even someone that gets to hack their server) might modify the script to include malicious code. Right now you have 2 options that have pretty big "downsides": Reimplementing addthis script would be pretty time consuming, so, I don't think you want to go that way. Also you would have ...


1

Yes, it is a security issue. The included JavaScript runs in the context of your website, which means that it has control over anything that you would have control over. External JavaScript files can harm you by among other: read cookies (eg to steal sessions) read user input (eg to read password inputs) change what the user sees (eg to display ads, ...


1

You can use Group Policy to install the certificate on the client machines. You will need to bind the certificate to your site through IIS/Apache to complete the process. Keep in mind that you will need to ensure that your internal CA is trusted by your internal clients. I think this is in fact reasonably secure, and one of the use cases that ...


1

No, since that would imply that Flash or JavaScript does have access to raw hardware, outside of its sandbox. Think opposite, that if a flash applet or JavaScript applet would have this access, it would be possible to build a keylogging website that remained Active across tabs. If you need to protect against keyloggers, I would suggest some sort of 2FA. ...


1

See also this question: Should websites be allowed to disable autocomplete on forms or fields? For me one of the issues is how a browser might be storing a password. There was an issue identified with Chrome a while back where it was trivial to reveal the passwords it was storing. There are probably issues with the other major browsers too. If you lull ...


1

The problem is that a vulnerable Flash version is a conduit into your system. There will be no way to see if your system was compromised via Flash. At best you will be able to see that you have some kind of infection/corruption in general, but you won't be able to tell how it happened.


1

Presumably it would need to not capture content loaded from other domains (like iframes or images), but that seems solvable. The easiest explanation is that for any feature to exist it has to be prioritized over all of the other features that don't exist. You have to sell it to developers and this seems like it would have privacy implications that would ...



Only top voted, non community-wiki answers of a minimum length are eligible