Tag Info

New answers tagged

0

I had the AdsMatte issue as mentioned by lot of other users. I tried reinstalling OS/Browsers, tried multiple PC with different OS (including Mac) and still it would magically come back. I realised that the problem has to be outside User Machine. I wanted to long on to my router but 192.168.1.1 would always timeout. It was very frustrating. I was sure the ...


2

Even if Tails offers anonymity and coming with default built-in encryption suites for different purposes, your anonymity is already compromised since as in all schools/universities we find the same policy: to use their WiFi they need to be sure you are either a student, a teacher or an authorized person to access their Wifi. Also you must remember that ...


3

There are two general categories of vulnerability to your anonymity that I would be concerned with given that setup: Using web sites that identify you (it's a moot point if you then go log into Facebook with your real name!) Traffic analysis - if your school requires login info specific to you, then the school knows who's sending the traffic, and if they ...


1

These scammers often scare people by disguising harmless elements (such as event log entries, firewall rules, etc) into evidence of compromise and malware. For example they could tell you to execute some commands or find in advanced system properties what looks like a random number but is actually an reference to some system component common on all systems, ...


2

It is not standardized how a web browser saves the data it gets asked to store in localstorage. But it is very unlikely that it will be implemented in a way that it ends up as a valid executable file, and even when it would be, it is unlikely to be a file you or your operating system would ever execute. Security vulnerabilities in the implementation details ...


3

From point 1), if you live in those countries, with "spain...etc", if there anyway to check that the CA you are using (in firefox for example or other) is the proper company , for example google/gmail? and not the government one? You can check the certification path to find out which intermediary and root CAs signed the certificate that you are ...


1

Any time you include script from an external domain you are trusting that domain. e.g. if you site is example.com and you have the following code on your home page <script src="//example.edu/tracking_script.js"></script> then example.com is fully trusting example.edu not to do anything malicious inside tracking_script.js. example.edu will have ...


4

I'm researching the extent to which TLS_FALLBACK_SCSV protects against Cipher Suite Downgrade attacks. I understand that the correct way to protect is to remove support for the insecure cipher suites. TLS_FALLBACK_SCSV is about protocol downgrades and not about cipher suites downgrades. Don't confuse this with Logjam where the the cipher suite gets ...


0

Are there any blazing "Oh, don't do that!" security flaws in the setup summarized above? The basic protocol you are proposing is: client identifies themselves, server checks the public key and verifies that they are a valid user, server encrypts a challenge using the public key, client decrypts to get the challenge back and returns it as proof of ...


2

@ThomasPornin address your first question. Your second question, then, is "how does one configure the protocol and cipher suite in the browser?" Firefox Protocol is configured by modifying the about:config variables security.tls.version.min and security.tls.version.max. You can set the min and max to: 0: SSL 3.0 is the minimum required / maximum ...


2

In SSL, the key exchange, symmetric encryption and MAC algorithm are all grouped together into a single aggregate notion called a cipher suite. In the initial handshake, the client sends: the highest protocol version that it supports; the list of cipher suites that it supports, in order of preference; other things which are not relevant here. Then the ...


1

Both the client (browser) and the server support a set of cipher suites. The browser sends its list to the server, then the server picks from its (sorted) list something they both support. The 4 parameters don't get chosen independently. All 4 belong to one cipher suite. Which cipher suite your browser does support you can see here. Scroll down to "Cipher ...


3

No. The dialog doesn't add these properties to certificates. It has nothing to do with the currently selected item – it merely adds them to the filter-by-property listbox at the top of the main window. (That's the one that says "Intended purpose: <all>".) (The more specific name is a "certificate purpose", and the technical name is extendedKeyUsage ...


1

That is a good thing that not all properties are check by default because trust should not be enabled by default. As the Microsoft documentation says, the purpose of that property is: Certificates that server programs use to authenticate themselves to clients. Yes, not only the server needs to trust the client, but the client also can request the ...


3

There are no standard ways around, but there are ways around. What exactly you have to do to get around will depend on the browser and on the version. On this link you can find some examples to get around the protection in Google Chrome: http://blog.securitee.org/?p=37 The precondition on the examples at this blog post is that there are two GET parameters ...


3

XSS attacks are still possible now, for this you can go through OWASP's Top 10 Vulnerabilities Project 2013, which is still a top 3 vulnerability. But today modern browsers are very keen with XSS and Same-origin-policy eventhough your website has no protection to this attacks. In case of XSS every browsers are updated with XSS Filters in their newer ...


2

In addition to the great points made here, I would like to clarify: what you are essentially dealing with any time you use eval() is having to answer the following questions: Is it worth securing? How thoroughly can I secure it and is that level acceptable? How confident can I be that it will stay secure over future evolutions of the codebase and ...


2

As explained by others, one can use eval to dynamically create code which makes it harder to understand the control flow of the program. But, I don't consider eval much more evil than all the other ways to generate code at run time, like document.write(...), object.innerHTML(...) and others. While these are mostly used to change the DOM of the program they ...


10

eval() is a possible vector for cross-site scripting. Under normal circumstances, an attacker attempting XSS might want to get script <script></script> tags past whatever encoding, filters or firewalls might be in place. If eval() is there operating on user input, it eliminates the need for script tags. Eval is present in many malicious scripts ...


23

eval() executes a string of characters as code. You use eval() precisely because the string contents are not known in advance, or even generated server-side; basically, you need eval() because the JavaScript itself will generate the string from data which is available only dynamically, in the client. Thus, eval() makes sense in situations where the ...


0

O.K. After some research I found out that it could be possible using some malicious ActiveX control. For one, such a control is able to read files on your local disk. This could be used to determine the connection type, and possibly connection details, including ESSID, and potentially the SSID. I'm nowhere near producing a PoC code though. This of course ...


0

If your system is setup properly (your VPN isn't leaking, you never contacted the web site except through your VPN, you're not allowing the web site to run anything on your machine with anything but default priority and the web site isn't exploiting something in your setup to run code by itself), then no: the web site can not find out that both of your ...


-3

No. The website only knows the public IP address from where you are connecting. Obviously the public IP address is different when you go through your local router than going through a VPN. If you use a VPN, the public IP address is the address of the router used to go outside in the site where the VPN tunnel ends. It could be even in another country. It's ...


22

The hostname is transmitted in the clear. This is because HTTPS is a tunnel established after a connection to the server. The hostname is available for an eavesdropper to snoop in a number of ways: You will perform a DNS lookup and that is always in the clear; There is a TCP connection to the IP address returned by the DNS for google.com; In the case of ...


5

It depends on who manages the OpenVPN server. A VPN allows you to connect your computer to a remote network in a secure way: the traffic between your computer and that network is encrypted. This protects you from the intermediate networks (including the local one, on which you plugged in your computer) from seeing your traffic (they see a stream of ...


2

These are simply Subdomains created by the website owner. ww3 is often used to share load (ww1,ww2,ww3) on their servers. In you example it seems intel created www-ssl subdomain to separate normal http traffic and https traffic on subdomain level. If you want more information why somebody is doing this, just ask google or the website owner


-1

Imagine, that your company has some CRM, which has "friendly" (suggestive) urls. And imagine, that employees click on embedded links. Now, everyone with access to logs of linked domains can see your referers: crm.internal/list-of-customers-to-block-if-no-purchase.php crm.internal/list-of-customers-with-stupid-annoying-and-problematic-representatives.php ...



Top 50 recent answers are included