Tag Info

New answers tagged

0

You can't get a nice notification to the user without establishing the TLS connection first. This means that your server or some middlebox (load balancer) in between must still be able to talk TLS 1.0. But you then could then check the protocol version of the client inside your web application and show the nice notification there. But, if and how this can be ...


0

A good load balancer, such as a Citrix Netscaler can offload SSL and redirect traffic based on the ability to encrypt or redirect according to what is minimally acceptable.


0

That's the result of somebody sending an empty request to your server. It's not a useful attack vector by itself (as you can see from the log, your server returned a "400 Bad Request" error message), but it can be used as an "is there a webserver here?" probe. Personally, I'd ignore it. There's a lot of automated scanning going on out there, and you could ...


2

The point of RFD is abusing the trust of certain sites and if I can make arbitrary files look like they are coming from a trusted site, I get to bypass certain warnings. (Is it my browser that already trusts certain sites or is it the user or both?) I think it is only meant as in the user will look at the downloaded file and think "Oh, it did come from ...


0

Any connection made on SSL v3 and using CBC Ciphers is vulnerable to Poodle attack. Browsers (Older browsers and other clients) will negotiate SSL as we write about it. Although most have disabled SSL by default and only work with TLS. Note that there is a new Poodle on TLS vulnerability that we will not talk about in this thread. The only ...


1

Browser leaking links? Here is a screenshot of my chrome settings: You can see that the browser may: query another service about whether the link is legit query another service if the link has an error I don't know the specifics, but that means you also have to worry about those services leaking the token before the user has a chance to visit the ...


2

Since it is a one-time link, just invalidate the original token and generate a new one on the page (make it an invisible field in the form), then POST it with the password reset form. Also, do not add any extra information that may leak user identity in the email link. A SHA-256 token is enough to complete the password reset process.


0

Fundamental to anything, the use of a token/coookie is the authentication mechanism's reason it works. How this cookie is verified by a third party is the magic sauce. It's surprisingly funny how everyone keeps trying to break web 1.0s client/server model to include 3rd party intervention.


0

Secure session details per-website are stored in local cookies set by a response and sent to the server in future requests. For cross-domain example, like you described with youtube (and a comment described), the standard method is OAUTH or OAUTH2. It is the same mechanism that you may allow other websites to access your facebook or twitter details. This ...


4

Regardless of what developers use, a QA test must be performed with what your end users are using (stable branch). Depending on how bleeding edge your developers are trying to be this may be more or less difficult. What is more secure? It depends on: What features developers are using (OpenGL, SSL validation, etc.) What your trying to protect against ...


7

Typically developer versions (called beta editions in the Software Lifecyle) are used to showcase upcoming features. Some of these features haven't gone through the rigorous testing as a stable (Release) version. To illustrate this, here is Chrome's explanation documenting the differences Stable channel: This channel has the full testing of the Chrome OS ...


2

In addition to Lucas NN's excellent answer, there is also the threat of Cross Site Request Forgery. CSRF does not require there to be a current tab open in the browser, only a valid session. So if you're logged into Facebook and Facebook happens to contain a CSRF vulnerability, and you happen to visit an evil site that exploits this vulnerability, your ...


2

I will answer the question in a generic way, as well as the question was asked. If is the railway local web site that is being attacked and not you, you can not do anything to avoid this. No matter the speed of your internet or if you are using a VPN. To be clear, I am not considering a lot of factors here, because the question does not permits me.


7

Hard to answer because we can have a lot of horizons here. Short answer: I will use your bank as an example. Let's say you open a new tab and enter on your-bank.com. If your bank has not explicitly developed any code to communicate with other tabs, no other tab could say that you are browsing your bank and what you are doing there.* EXCEPT if a ...


4

This is about personal privacy for users of the site. Like buttons are advanced web beacons. Its more than just a simple image, but JavaScript that identifies if you are a logged into a social network, and tracks your behavior over a long period of time. Facebook collects this information for targeted advertising. In this security system, if you don't ...


2

There are CSRF prevention techniques that do not rely upon a session-bound CSRF token, after all there is more than on way to skin a cat. When considering a CSRF protection system, look for any shortcut that doesn't exist with the commonly used CSRF synchronization token pattern. There are three concerns with this proposed CSRF protection system. ...


-1

If the adress ID could be generated from a specified adress (for example, if the adress ID is some binary representation of lat/long of the specified adress that is then Base64-encoded and then converted back and forth via a geolocation service), then you are at same risk of CSRF as originally. But if the ID is random, then you are safe from CSRF. You need ...


4

Alice will see a warning. This is because the certificate is checked at the point where the SSL negotiation happens, which is before you get the contents of the page - whether those contents are an HTML page or a status code with a redirect. For an example of why this is important, imagine this scenario: Evul manages (e.g. by DNS cache poisoning or some ...


2

This is a pretty scary thing to be doing, as by definition, you are wanting to look at sensitive, user-submitted data on those computers. Sure, you might catch the occasional wrongdoer, but you're going to be capturing quite a lot of normal people's passwords, emails, etc. Which is probably opening a whole slew of liability to whoever owns the computer lab. ...


1

If you want to do that install Firefox. Firefox comes with its own trusted CA store and what you add there will only be available to Firefox.


1

The whole goal of HTTPS is to prevent eavesdropping so that anyone monitoring your web traffic can't see what you're sending. As useful as it is, HTTPS presents a bit of a problem to antivirus software because when you visit sites over an encrypted connection, your antivirus software cannot see what sites you're visiting or what files you're downloading, at ...


1

Google's Diagnostic page says: http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http%3A%2F%2Fgoo.gl Part of this site was listed for suspicious activity 1 time(s) over the past 90 days. URL-Shorteners are often used to obfuscate malicious links. Google's own link shortener is no exception. Maybe the safebrowsing blacklist ...


1

In spite of being possible to read/write data to SSL/TLS channels as with vanilla TCP/IP sockets, in Java or C or whatever, SSL provides you the concept of SSL session, which can be kept across several TCP/IP connections. Thus, IMHO this makes SSL a session layer protocol (I wonder why someone came up with the TLS name...).


1

You've already listed some resources so I will add another that is not a tool per-se, but a write up on how the different browsers are storing data. The write up contains a minimal python script that should help get you started. As for Safari, pre version 6.0 the credentials were only base64 encoded so it was easier to get data then. The difference with ...



Top 50 recent answers are included