Tag Info

New answers tagged

0

Can you explain exactly how the other browsers fall back? I've seen the following scenarios with servers and middleboxes: try to connect with TLS 1.0 or higher, peer responds with SSLv3 and thus the connection continues with SSLv3. This usually succeeds. try to connect with TLS 1.0 or higher, peer closes connection and browser tries again with lower TLS ...


0

There's at least one proxy service (trendmicro) that sends occasional duplicates of GET requests as some sort of probe for malware. You shouldn't be alarmed, and your GET requests ought to be idempotent anyway.


3

Yes it can, for example using : Ajax A reference to an external JS or css file An iframe or even a HTTP 302 redirect. This can be used by online malware to generate trafic for a DDoS Attack. Note, all those are used for legitimate purpose on many (most) websites, and hence do not imply a malicious behavior. In response to your edit: Yes, Ajax can do ...


0

There is one risk that hasn't been mentioned here yet: when you're having both Tor Browser and a different browser open, you may accidentally confuse them and either enter identifying information in Tor Browser or perform activities which you wanted not to have tracked back to you in the other browser. There is no great technical risk, but you'll have to ...


0

It can affect any application web or otherwise which is complied with one of the vulnerable versions of openssl.. wget Linux command for example is vulnerable to client side exploits.


1

Good Question. TACK is a "dynamic pinning" solution to the broken Certificate Authority model we all depend on today. A competitor is Google's Certificate Transparency (CT). Status of TACK is No browsers currently support it. There are no browser extensions to enable it. The last posting from the developers (January, 2014) is that it is entirely up ...


2

The advice is usually in the context of avoiding phishing links: Don't click on links in emails! Bookmark your banking websites and always use the bookmark! I think using browsing history as a similar safeguard is probably fine also (within the parameters you described), as long as you've never clicked on a malicious link in the past. However, it's ...


1

This is a moving target, as there is a cat-and-mouse game as attackers discover new techniques and browsers implement new defences. In general, JavaScript: can access config information about your browser and plugins. The site you linked seems to be a good summary of the current techniques. cannot access your local files, at least, unless you explicitly ...


1

The theory, as exposed in the standard is that: server_version This field will contain the lower of that suggested by the client in the client hello and the highest supported by the server. In the ClientHello message, the client announces a single version, and this means "I support all versions up to that version". For instance, if the client says ...


2

I think I know what's happening with you. Actually, that's exactly what I do with the image in my "about me" section in my StackExchange profiles. It's a .php file that grabs some information about the visitor (IP address, browser type, whether the visitor made the smiley happy or not, etc.*). I simply rewrote the URL to show two different images that are in ...


-1

if someone is able to change the htaccess - entries on your server you're probably hacked. the png might contain malicious code; can you paste the output of $ string strangefile.png when executed on the server? might be interesting What's the worst they can do with .htaccess masking? Any way to prevent it? they have access to your server, it is ...


2

Although running Google chrome on top of Windows XP seems secure but the reason it isn't is that exploiting vulnerabilities on Windows XP is easy (many orders of magnitude) compared to Windows 7. Windows XP is lacking common memory corruption protections such as DEP and ASLR. This means that a vulnerability that might be just a denial of service for the ...


3

It's a risk. XP has had enough holes over the years that it's hard to imagine there aren't some un-found holes in what remains. I'd recommend getting off XP if possible. If not, at least keep your ear to the ground. If a researcher finds more vulnerabilities that Microsoft is now unwilling to fix, you can bet they're going to hit the tech news media. ...


0

The "HOST" header is part of the http protocol, vulnerable applications are vulnerable because they insert the value of this header into the application code without proper validation, this means not only applications hosted on Apache/Nginx can be vulnerable. In short, the answer is yes, your application could be vulnerable no matter what kind of ...


1

You are on the right track realizing that the Xclient (in this case Firefox) will not be able to access an Xserver running under a different user (by default). The simplest solution would be to ssh -X webuser@localhost firefox (note I would explicitly NOT use the 'nobody' account - this should not be used for this purpose) - which automatically deals with ...


2

paranoid mode: install a different linux on a different machine, better, use a ro-mounted distro from cd like knoppix or so (virtualbox and kvm is your friend) run your browser from that other machine, using x-forwaring or x2go (free and good linux terminalserver/client-solution, works very nice on debian) harden this browser with noscript, adblockplus, ...


2

Have you thought about using something like Tails(https://tails.boum.org/)? As was suggested above you could use it with a Vm, but based on what it is fundamentally for you wouldn't need to keep an instance on your machine for it. There are also things like sandfox(http://igurublog.wordpress.com/downloads/script-sandfox/) that allow you to run firefox in a ...


3

AppArmor or SELinux is probably a better solution than running Firefox as a different user. As you mention, running any kind of new software (including Mandatory Access Controls like these) potentially introduces new vulnerabilities (I'm fairly sure some have been found for SELinux) but I think most agree that the tradeoff is worth it.


0

You could create account, without any privileges and used it for browsing but there are exploits that may obtain root privileges. There's nothing that can secure you.


1

THE THREAD-STARTER WROTE: But what if I'm just reading a news site? Everyone has access to that, it's all over newspapers even. What's the point of encrypting such easily accessible information? MY RESPONSE: Yes, everything on the news site is public; but would you feel comfortable with someone standing over your shoulder while your with your computer at a ...


2

Because you don't really know what can be infered from the data you emit. Since the whole NSA fuss surfaced in the news, lot of people think : "yeah, right, the NSA knows about the emails I send to my little cousin and my buying habits ? So what ?". Unfortunately we've entered the age of BigData and machine learning. This isn't just about crunching huge ...


2

Some background before I get to my answer: I find telephones fascinating and one of the most interesting phones I came across was the STU or Secure Telephony Unit which basically consisted of an a/d-d/a some audio codecs a digital encryption module and a modem and a bypass circuit all stuffed inside a telephone and was for the most part connected to ...


0

To which I would add that ubiquitous encryption makes all snooping on and interference with ordinary traffic harder and more expensive. It's a good thing to do.


1

All the main points have been covered but I thought it's worth covering this particular scenario: It was/is popular to encrypt a login page, then allow the authenticated user to continue browsing the site on an unencrypted connection (to save CPU cycles on the server). This seemingly efficient and parsimonious use of encryption is actually next to useless. ...


1

The certificate is not necessarily fraudulent (though it does expire on the 28th of March) as much as it is that the name being used to access the resource doesn't match what is on the certificate. It's common for companies to have aliases or CNAMES for services/hosts. The problem is that unless you generate a UCG or SANS cert to handle all the names then ...


2

One point that often gets missed in this discussion is the fact that SSL also encrypts the page URL that you use when accessing a website. If someone were eavesdropping on your connection, (NSA?) and you were visiting a site that wasn't provided over SSL, someone could see which pages you access and build a profile around you based on your browsing habits. ...


10

As a general rule, it's good policy to strongly encrypt all data travelling across public networks. The reason is that if only "sensitive" data is encrypted, it's very easy for eavesdroppers to target potentially useful data simply by looking for anything that's encrypted. However, if everything is encrypted by default then they have no idea what ...


27

In addition to the other good answers I would add that HTTPS ensures that when I think I'm reading bbc.com, I really am reading the content provided by bbc.com, not a hostile third-party who wants to fool me. Some news sites still present facts. People make decisions based on those facts -- decisions that have real-world consequences.


11

One reason in general I would like to add to the above answers is that even though you might not be doing something highly illegal in a western country, you should not assume that the government is not interested in what you read. Reading the following might put you on a list: Classified, documents leaked by whistle-blowers that are technically illegal A ...


53

Encryption is not just about preventing eavesdroppers from reading data, it also prevents them from changing it. Flipping images on webpages upside down is an amusing prank to play on housemates but a malicious person could inject ads, or harmful code (Java, Javascript, Flash etc.) into your webpages without you realizing it. ...


68

The issue you're dealing with, here, is that if you decide not to encrypt a connection, you're making assumptions regarding the sensitivity of the data that goes over that connection. Unfortunately, it is impossible to properly make that assumption because: You might not have fully understood all the implication of the data (for instance, if Twitter ...


8

I think that really depends on the extent of definition of "sensitive data." Passwords and credit card numbers is certainly one, but perhaps looking up on WebMD info about a rash, while a generally public info, may be something that you're sensitive about, and don't want employer or your ISP to know (employers' rights and use of work equipment arguments ...


3

Lots of news sites/newspaper sites provide accounts for additional functionality, subscriptions, etc. Forcing all web traffic through SSL reduces risk by making sure no one can ever log in on an unencrypted connection. Generally it's better to be safe than sorry. Nowadays HTTPS isn't as much as an overhead as it used to be, so why not encrypt all ...


0

Unfortunately, there is no simple way to identify which of the dozens of processes shown in Windows Task Manager corresponds to the pop-up and should be killed. In fact, in the Chrome browser I just had a pop-up which did not add to the 50 processes as an extra process. The only way to safely close the popup window is then to close the browser entirely by ...


0

Rory It doesn't answer the question directly but it relates to it! Freedom likes to know how to not be traceable from his government due to his political activities on the web. So taking the right measures along with using the proper tools will make hiding your identity even better assured. You can tell someone to use windows without an antivirus/internet ...


0

"...even when you use a VPN service, browsers... can still somehow provide your real location" That can be addressed by tunneling all traffic through the VPN connection. If only particular traffic is defined to be tunnel-bound, anything not matching will go about its normal path. Typically this likely to be destined for the Internet - thus exposing ...


1

The geolocation API which allows websites to obtain your location from your web browser is supposed to be opt-in. The standard specification says that it must not be enabled without the users permission. For that reason it can be switched on and off in the settings of most web browsers. When you don't trust your web browser to respect that preference, then ...



Top 50 recent answers are included