Tag Info

New answers tagged

2

These answers are great. But I often have to give a simplified answer without all the jargon. HTTP - It is not encrypted and the data sent over the line could be easily read. HTTPS - It is encrypted and verified by a trusted party the data is being handled by the correct source. HTTPS (Self Signed) - It is encrypted but there is no verification by a ...


18

Security difference First, let's talk about SSL (now called TLS by the way), which adds the 'S' at the end of HTTPS and is in charge of "securing the communication". The clue to answer this question is indeed to fully understand what we mean by "securing the communication". SSL, no matter if it is a self-signed certificate which is being used or one signed ...


4

Without warnings for things like self-signed or expired certs, inappropriate cipher suite selections, and other bad HTTPS configurations, the presentation of a website's state of security to the user becomes binary - either you have HTTPS on the site, or you don't. This would hide a number of nuances which can significantly affect exactly how much the "S" in ...


32

The purpose of the warning is that by using HTTPS, there is an expectation of proper security, but a self-signed or expired certificate has vulnerabilities that the user needs to be aware of. The "risk" is that one thinks they are properly secured, but they are not fully secured, as opposed to HTTP, where one knows there is no encryption at all. There ...


1

Nothing is sure that apple.com website has been the vector attack. The problem could be coming from any tag, window or web pageyou opened using Interet Explorer. Given the warning message you got, I highly suspect your IE browser is vulnerable to a recent (July 2015) critical issue (Microsoft Security Bulletin MS15-065 - Critical) concerning IE versions ...


1

As the warning message you got, the website you visited is likely to perform a drive-by download attack that does not require necessarily the user's interaction with the webpage. But using lynx command will NOT lead you to be a victim of such attacks because all types of drive-by download attacks succeed only by either exploiting, via malicious crafted ...


1

While the alert is alarming, based on the information provided, it does not appear to be of concern. When IE restarted, it attempted to reopen the page it was last on, which was apple.com. res://ieframe.dll/... is how IE reloads the last page it was on. Malware Bytes caught this dll loading and alerted on it.


0

While no software is 100% safe too use chances are high that using something like lynx, curl or wget does not lead to an infection because these tools are not able to deal with Javascript, Flash, Java etc at all and thus the typical attack vectors will not work. But it might also be that you don't see with these tools the same information you get when ...


3

You are greatly reducing your surface of attack by using lynx or similar, for example they don't run Javascript nor try to decode and display images so any vulnerabilities in these components don't affect it. But in theory, you are still vulnerable. Even in Lynx there are still components that parse HTML, interact with the network, keep track of cookies, ...


3

A shim or polyfill does not get installed into a browser but gets delivered as part of a web page to provide functionality for this page. It is just normal active content (JavaScript, Flash...) which only gets named as shim or polyfill because it serves the specific purpose described by these names. It has no special permissions or restrictions compared to ...


3

A developer chooses to write a polyfill because it fulfills his personal need. From this personal aspect may come all problems you may imagine, namely malicious JavaScript code. Can a shim be installed in IE, FF, or Chrome without user knowledge? Surely. Drive-by download attacks which consist in malware delivery without the knownledge/consent of the ...


1

You must always clear your cookies. Except in one case. A cookie is just a text file where some information in plaintext format is stored. But you can not get an answer if you do not know the type of cookies that exist: Transient Cookies (called also session cookies, non-persistent cookies or in-memory cookies): they are stored in the RAM and they are ...


1

A shim or polyfill isn't anything particularly special. It's just javascript code - the name is used to describe the task that it performs (i.e backfilling expected behaviour into older or incompatible browsers) To answer your questions: Can a shim be installed in IE, FF, or Chrome without user knowledge? As shims and polyfills are just Javascript ...


2

Cookies by themselves do not create any vulnerability. The goal to delete cookies is merely to improve privacy by keeping websites from tracking your activity. A common way to track users, for instance, is when you visit several websites which include contents from some defined third-party tracking service (this content may be advertisement for the ...


2

In theory, yes, the webrtc standard let's a website determine your local ip address, so it can create a direct connection for you to a another web-browser, allowing direct connections between browsers to set up video streaming for example. This website has a proof of concept showing you your internal and external ip address: ...


4

You must not rely on browsers respecting the content-type header for security. A quick look at CVE-2010-1420 should give you an idea. Content-sniffing mechanism implemented in browsers can be manipulated by attackers to trigger XSS attacks (Secure Content Sniffing For Web Browsers: A Survey). Survey of content sniffing behaviors According to this ...


0

It is admitted that drive-by download attacks occur only thanks to the user's interaction as it was the case, for instance, with the HDD Plus virus where visitors of the compromised website needed to double click at least on rad.msn.com banners. But actually there have been drive-by download attacks that run successfully on IE, Safari, Chrome and Firefox ...


0

Not an answer (@raz got that) but some errors in your "understanding" too large for comments IMO: Browser will send a request to the server to get some resource. Server checks if the protocol of the request is HTTPS, if so then it will send its certificate (this certificate is already signed by some CA (Certificate Authority, like Digicert)) in the ...


2

Firefox The battery API is enabled by default. It can be easily disabled without using third-party addons. Go to about:config, accept the warning, look up the dom.battery.enabled boolean and set it to false. Changes take effect immediately on subsequent page loads. To deploy these settings in an enterprise environment you can use the user.js file which ...


1

As of 2015 this is how you prevent your website from sending the Referer header: Just add this to the head section of the web page: <meta name="referrer" content="no-referrer" /> This works both for links and for Ajax requests made by JavaScript code on the page. Other valid meta options include: <meta name="referrer" content="unsafe-url" ...


2

A mature wiki software like Wikimedia usually does not allow normal users to embed any scripts in wiki articles. But still, wikis are prime targets for search engine spammers. The structure of wikis is very search-engine friendly which means that wikis often get quite a lot of page rank which in turn exends to any websites linked from them. Also, anything ...


2

Because it's not needed. All protocols which are commonly used to download files either have a buildin mechanism to ensure integrity of the data stream or rely on a lower-level protocol (like TCP) to provide this. This is a reliable precation against accidental corruption of files in transfer. When it comes to intentional corruption of files by a ...


2

I've never before seen anything like this. Is this the only case or has this been known to happen? The scenario you experienced could be innocuous as highlighted in @RоryMcCune' answer as well as it can be a nefarious attempt/attack. Let me explain this last scenario. There is one interesting scenario about your question: as @RоryMcCune said, what ...


1

I think I have a better understanding of what you asking now: Having "a trust this computer" is not really a security weakness. This feature is to tell the company that this is a common computer you log in from and more of a user convenience. In order to have malicious software perform this check in your place, they would need to perform Session Hijacking. ...


1

There are different types of two factor authentication. Some types will protect against the threat you describe, others will not. Here are some common types of 2FA that will keep you protected against the key logger: Texting a one time use code to a mobile phone. Emailing a one time use code with the assumption that the user will not check the email on ...


13

Wikipedia and big popular sites are mostly safe, as any security holes are found quickly, usually long before the site gets its momentum. Smaller blogs/forums which allow user content are more vulnerable. I used to visit a Russian tech blog several years ago, and the posting form allowed some HTML formatting. Someone managed to include JavaScript code from ...


44

Assuming that you are coming from a BT connection, it's possible that this is part of the BT parental controls program. There is a discussion of a similar looking pop-up here , which seems to tie into what you're seeing, and also a thread here on the BT site which has a link to a process to turn off that setting. To test this theory you could log into ...


0

In general, a browser cannot detect your local IP or any information about your LAN. Thus any javascript code running in your browser cannot communicate to the web site any information about your computer or your LAN. HOWEVER... most browser plug-ins and Flash or Active-X controls can access data that is normally restricted by the browser. For that reason, ...


5

To keep you up-to date, you can read about the freshly MFSA2015-78 where Firefox sandboxing mechanism is bypassed by violating the same origin policy. The problem fixed by Mozilla Firefox on the 6th of August 2015. This vulnerability allows attackers to bypass the same-origin policy and execute malicious JS code remotely that will be interpreted in the ...


10

There is no magic in there: the user will see what the web server sends, and the web server will send what you tell it to send. You said that both URLs will share the same IP using a DNS CNAME entry, so you will encounter a different behavior depending on the browser supports SNI or not. SNI is supported by all decently recent browsers and allows them to ...


1

I'm not aware of any security issue of reusing the same tab for different web sites, i.e. I don't think it is better or worse to reuse a tab vs. close and open a new tab. But apart from reusing only a single tab it can be a security issue if you use the same browser application or the same browser profile or even the same operating system for sensitive and ...


1

Firefox doesn't have an option to turn of iframes in about:config, see this bug report. It's also not that likely that it will get that option anytime soon, seeing that this issue was first reported 15 years ago. You could disable iframes without plugins by using custom CSS (iframe { display: none !important; }). This would be done via an CSS file in ...


1

Is there any prior research that describes how a cookie, or cookie alternative would be used to provide such a guarantee? I don't think you can provide such a guarantee, except by perhaps saying so in your privacy policy and then following that policy. The scope would be restricted to a one, or a very limited set of URLs, Setting scope can be ...


1

JavaScript itself is not dangerous, the complexity of modern browsers and consequentially the bugs introduce are. But of course JavaScript is one common way to exploit these bugs. Limiting the usage and/or execution of scripts increases the security, there are different ways to do that. Browser configuration allows you to completely deactivate scripts or ...


1

I don't think this will provide any benefit. On a secure web application, the less you depend on client data, the better. I can see some issues: This will surely create a vulnerability named Session Fixation: an attacker can create a session, lure your client to a special page, and have the session data on his hands. The server has no means to know if a ...


0

Based on what you have outlined, your solution seems overly complex and I'm not sure why you wouldn't just encrypt the data rather than hashing it. There may be limitations in what you can store in the remote app that may require encoding the encrypted data (similar to what needs to be done when sending encrypted email). This would eliminate the need to ...


0

Your question reminds me of an answer to a question quite related to this subject where it is mentioned (I do not want to link to it directly): Assuming that you can use TOR or a VPN or an openshell anywhere to tunnel away your IP address, the "safest" practice in my opinion would be to fire up a virtual machine, install a stock Windows Seven on it, ...


2

Well I can only provide anecdotal evidence for this, but I have seen a site that I was reviewing make use of Panopticlick style functionality for tracking, so it definitely does occur. It appeared to be part of their overall user tracking / analytics set-up


2

The browser will generate a session key and encrypt it using server's public key. But which encryption algorithm (or commonly called as cipher algorithm) will be used by the browser? How is cipher selection determined, and will browser and server both use the same cipher/key size for encryption and decryption? The browser will send a ...


1

Super short answer: The server and client negotiate what algorithm they support and subsequently use. It is communicated during the handshake.


5

EDIT - Updated based on comments from @AdmSelec below and info from GlobalSign Whilst usually when that error pops up it'll likely relate to SHA-1 hashing, in this case it appears more likely that it relates to a bug in Chromium on OSX (details here). Whilst the screenshot displayed doesn't show the certificate itself it does show information on the ...


3

Aviator has had actual security (not privacy) issues and is nominated for this year's Pwnie awards. In general, browsers will not share your history with websites you visit. There have been vulnerabilities in multiple browsers that would allow a website to get your browsing history or guess if you have visited some specific websites or not. The ...


0

Using a VPN service that has a trusted nature like Private Internet Acces, as they don't log user's activities ( well, many claim that but this VPN has gathered a good reviews from privacy advocates including Rick Falkvinge,EFF etc with automated email masking services like Blur from Abine Inc. can help you a lot. You can't be anonymous using these but up to ...



Top 50 recent answers are included