Tag Info

New answers tagged

1

I think this extension is quite simple and generally safe to use for two reasons: Firstly, on Q. When does HTTPS Everywhere protect me? When does it not protect me? section on HTTPS Everywhere website FAQ page HTTPS Everywhere depends entirely on the security features of the individual web sites that you use; it activates those security features, ...


0

What you might want to have is a passwordless access to the ssh service. This will stop brute force attempts on the ssh service. Of course if your machine is compromised to begin with, then you'll need a larger proverbial boat.


2

The statement is not untrue but IS possibly misleading. Certainly files are in fact cached while the in-private session is active, they are then cleared at the end. Of course, we all know this could leave a footprint. In-private sessions are not really meant to prevent someone from discovering a footprint but more to prevent inadvertent "bleed" between ...


7

No, stripping <script> tags is useless because you could still execute a javascript payload like this: <input onmouseover=prompt(document.cookie)> And bypassing the filter should also be quite easy, imagine what would happen if a payload like this sent: <scr<script>ipt> As far as what type of software they are using, well ...


0

Short answer, yes. One reason is that you're increasing your attack surface without maintaining part of it. Another is that adversaries continue to try decades-old exploits for exactly that reason. Firefox isn't a firewall or IDS/IPS designed to protect the soft insides of your system. Rich and interactive, it's designed for a pleasant experience, with ...


1

I doubt that it is possible to add custom cipher suites to Chrome or Firefox and to keep these maintained with all the rapid updates. I don't know about adding ciphers to the Windows system so that they can be used by IE, but given that even Microsoft itself has serious problems in this area I doubt that you can easily add ciphers there and keep them cheaply ...


0

No, and it doesn't seem likely to be added as a feature. See https://code.google.com/p/chromium/issues/detail?id=107793#c20 I'm just deeply concerned about the code complexity cost here, which increases the opportunity for both performance and security bugs. - rsleevi@chromium.org


0

If you can't perform any change to website A, you cannot achieve what you need... However, if you can change website a or add a new page, module, method or any server-side thing, Digital Signature algorithms are designed to do similar works. An example is in the following... In site A, encrypt a time stamp first with private key of A and then encrypt it ...


0

Comment to @user54791 and @iszi's comment: Avast shields untrusted certificates with a certificate issued by a different issuer, called "avast! Web/Mail Shield Untrusted Root". As long as this issuer stays untrusted, there is still a security warning when a HTTPS connection with an untrusted certificate is accessed. So there is no need to disable HTTPS ...


1

An old question, but adding an answer for modern times. For sensitive responses, you should set the following header: Cache-Control: no-store, must-revalidate These days, you probably don't need to worry about the HTTP 1.0 Expires header. Pragma is only for requests, not responses. To refresh the page just after session timeout (so that the login form ...


1

This is happening because as others described, the Mail/Web shield needs to be able to scan your web traffic before it is saved on your system / does any harm. Scanning encrypted SSL/TLS sockets requires that Avast can decrypt the connection. There is no other way for Avast to decrypt the connection than to generate its own certificate with a known derived ...


0

Yes, it appears optional. According to http://daniel.haxx.se/blog/2015/03/06/tls-in-http2/, it was originally part of the HTTP/2 specification, but was later moved into its own spec as an extension of HTTP/2, http://tools.ietf.org/html/draft-ietf-httpbis-alt-svc-06. It would appear that it was finally implemented in Mozilla in late 2014, and was finally ...


0

If website A and B are linked internally, you could just transport the session information, so the session key can be used to automatically login to website B - doing this without website A and B communicating internally somehow would very very difficult to secure. Basically you need a method of A telling B which client session codes are valid, without ...


2

A source code disclosure vulnerability is an involuntary disclosure of source code. Since JavaScript code runs client-side, on the browser, it's disclosure is intentional. Under this definition, only exposure of the server-side code is a source code disclosure vulnerability. The example you give actually has the GPL on it, so it's already disclosed ...


4

That is the correct behavior. In the case of client-side JavaScript, it is by design that the script source is sent to the client to be executed. So, the fact that you can manually browse to the URL for the script file is irrelevant. It gives you no more access than the application intends for you to have. A source-code disclosure vulnerability is when ...


4

The streaming server needs to know where to send the video to, thus it is aware of your IP address. Using this IP address, your estimated position can be requested from a so-called geolocation database (which connects networks to locations). This usually is not accurate to street or house level, but most of the time at least resolves the city and country ...


5

In simple terms: Your browser starts to connect to an HTTPS website, asking to use a strong cipher. The attacker intercepts this request and replaces it with one asking to use weak "export-grade" encryption. The server gets this modified request and responds to your browser with an export-grade encryption key. Your browser doesn't notice the key it got is ...


2

Yes, all your assumptions are correct there. As you are including content from addthis.com, your client-side Origin is fully trusting this domain. If there was any compromise to addthis.com, or if addthis.com decided to change the script to do something more invasive then your site would be vulnerable. For example, addthis.com may suddenly decide they want ...


1

you can make it local by giving permission on extention folder in this path C:\Users\*your user*\AppData\Local\Google\Chrome\User Data\Default\Extensions rightclick->security-> select user-> deny all


12

Looks like the certificate is only valid for opensource.apple.com, not www.opensource.apple.com: www.opensource.apple.com uses an invalid security certificate. The certificate is only valid for opensource.apple.com (Error code: ssl_error_bad_cert_domain) You can simply use the former.


5

The server sends the entire certificate chain, up to and possibly including the root certificate, all at once as part of the Server Certificate TLS handshake message: certificate_list This is a sequence (chain) of certificates. The sender's certificate MUST come first in the list. Each following certificate MUST directly certify the one ...



Top 50 recent answers are included