Tag Info

New answers tagged

1

User-agent strings do provide the companies running web servers with useful information. If they're contemplating introducing web site features or content they want to know if the majority of their user base have browsers that support that technology. They can look at the user-agent strings logged in the past month or two and get a sense of what browsers ...


0

Probably has more to do with dofeqilr.com than with your specific subdomain thereof. http://www.spamhaus.org/query/dbl?domain=dofeqilr.com


7

In order to do any damage to your computer or data stored on it, the page would have to either exploit a security vulnerability in software on your computer or prompt you with an additional confirmation dialogue. The warning may be due to the page exploiting a security vulnerability for which there is not yet a patch available, so the warning should be ...


19

Yes there are known attacks of this type. The site you are trying to visit is one. That's why your browser is telling you not to visit the page. Javascript files included on pages are always executed by the browser. That's what Javascript does. Whether or not it has the necessary privileges to do something malicious is where the battle is at. It is unlikely ...


1

Well if you are using Firefox you can use NoScript but right now "Canvas Fingerprinting" is really a new buzz word but when more people know about it the more developers will make addons to counter Canvas Fingerprinting. There are several options to block Canvas fingerprinting TOR web browser. Yesscript. More info here Canvas Fingerprinting


0

More secure? Possibly. Easier? For whom? Marketers can use the vast amounts of data to fine-tune the ads they send you, even if you are not sure that you are actually interested in it. We're talking about a multi-billion dollar industry focused on understanding you to a very deep level in order to meet your needs. No one is going to give all that up for a ...


0

Yes it is possible , of course the location of your browser history depend first of your web browser and secondly of your OS. For example I know that in linux , in ubuntu distrib you can find lots of informations about mozilla web browser on the home folder of a user. All of the informations are stored in sqlite database. For see details : ...


2

Your browsing history is basically a file on the computer's disk. Depending on your attack scenario, many things are possible: For someone who has access to your computer, through a remote-controlled malware or just sitting at your desk while you're away, it is entirely possible to get that history file and read it "without a browser". If, however, you ...


0

I don't think you can solve your problem at the hosts, IP firewall or DNS blacklisting levels. These methods will fail and won't scale. If this within your financial possibilities, I'd suggest you to install a web firewall. Here are the beginning of the prerequisites to build such a web firewall. 1. Material A PC with a pretty large amount of RAM (≥ 8 ...


1

The easiest solution would be to block dns resolution to those sites in the internal dns server†. If your pcs go through a proxy, a better solution would be to block those urls in the proxy configuration. Note however that although your manager thinks that facebook or youtube shall never be used in the office, you will find that it will sometimes be needed: ...


2

On Unix systems, the user home directory is associated with the user account and any application can "sense" it by using getpwent(). It so happens that there is a long-standing tradition, in Unix applications who want to learn the user's home directory (e.g. to read or create configuration files), to first look at the HOME environment variable and use its ...


1

You seem to have the basic user data covered, but I'm not sure why try to isolate it like that. I would run each user's browser instances with an in-memory home directory/storage area. Then when the process terminates, all of the data is destroyed, no risk of leaving anything behind. Headless Webkit like PhantomJS provide flags specifically to move these ...


1

How much a website knows Assuming you are browsing on a website without any protection, a website can know a great deal of things about a computer. Further, a great deal of this information is generally stored by the website in some sort of database. Often times, websites will store a great deal of information in order to remember some information about you ...


3

[Disclosure: I, too, work for a password manager company] Long ago, I tried to develop my own password management solution using PGP/GnuPG. As I thought more about it, I found it unsatisfactory and eventually switched to the one that I have now come to work for. Here are some things you should consider before trying to roll your own password management ...


2

Full Disclosure: I work at a password manager company. I won't say which because I'm not going to mention any of them by name. You are better off using one of the commercial or FOSS, already existing password managers. Why? Because a team of people who work full time (or in the FOSS managers, a team of dedicated and intelligent volunteers) on the project ...


0

Actually in this case, the origin of Google analytic script is a.com quote from this book JavaScript: The Definitive Guide It is important to understand that the origin of the script itself is not relevant to the same-origin policy: what matters is the origin of the document in which the script is embedded.


3

No it is not safe. You are correct that the JSONP service could deliver arbitrary JavaScript, which is then executed as part of your site. Because JSONP is essentially a hack to get around the same origin policy, it is not possible for a JavaScript framework to perform sanitisation. These days, CORS is the preferred way to call external sites. An ...


1

Nothing should be changed except the downloaded Internet files. I would take a snapshot of the fresh VM and revert back every night (or sooner if it detects evidence of malware). That way, it is free to be compromised, but you limit its effect. Unless you hope to inspect changes in the VM as the method of detection that there has been malware, in which ...


2

This sounds like a Zombie Cookie. There are a large number of places a web site can store state: cookies, Flash local storage, ETags, etc. When you clear your cookies, you do not necessarily clear all these places. Web sites can store an identifier in some of these other places, and track users despite them clearing their cookies. If you use a dedicated ...


1

I doubt anyone on this site will be able to tell you exactly what sorts of information outlook.com is recording, or how precisely that information is being communicated to MS. Microsoft doesn't explain the full details of that in most cases. What I can say is that Tor on its own may not be enough. In fact, if you are doing something questionable, it might ...


3

Banks like BoA use a risk-based decision engine that examines several variables, including but not limited to: Your visible IP address Your brower's "signature," which incudes the user agent header and detectable display properties such as screen resolution The presence of a persistent cookie The presence of data in another persistent store, such as a ...


3

You say that you do not trust Microsoft and want to hide your identity from that company. However, this is gapingly inconsistent with your action of using an operating system that consists of countless of megabytes of binary executable code produced by Microsoft. Suppose that you use an operating system whose vendor you do not trust; you suspect that it ...


2

The problem is largely in the effectiveness of the dynamic analysis. How do you define malware? What does malware always do that normal programs never do? (Hint: there is no answer to this question) Well-written malware can look innocent and perfectly legitimate programs can look dangerous. Here's a simple example: the malware might try to join your ...


3

I'm not aware of any plugins specifically that do this, but in the case of the Google search engine, or something like Norton DNS or google DNS it's all done on reputation. For example if you report a page as a phishing page, then a hundred other people also report it, when that search result comes up in google it will say that the page is potentially ...


2

Simple answer: No Any attack which compromises your machine could add toolbars to your browser. However, this is a very different type of attack, and to be honest, any attacker who has full control of your machine is likely to do worse things, like making you part of a botnet, adding keystroke loggers etc.


0

Have a look at identity based encryption. Basically you could just use asymmetric encryption to achieve what you want. For example: encrypt everything you put on Facebook. Proof of concept: develop a plugin for Chrome which encrypts everything before it is uploaded to facebook with your private key. You spread your public key to your users. They use the ...


0

This depends entirely on what you need the application to do, exactly what data needs to be protected, and who is permitted to view the data. In the simplest case, where your application is merely an indexing system for documents and the document metadata can be stored in the clear, you can use client-side encryption to protect the document itself: the ...


2

Unfortunately, installing addons is not the only way. There have been a number of javascript methods over the years, many of which are no longer supported by most browsers. However there is at least 1 method still possible that works on modern IE browsers: http://msdn.microsoft.com/en-us/subscriptions/ms531418(v=vs.85).aspx There are probably others.



Top 50 recent answers are included