Tag Info

New answers tagged

6

Chrome: Open Chrome Type chrome://net-internals/#hsts in the address bar of chrome Query domain: if it appears as a result, it is HSTS enabled Firefox: Open file explorer Copy paste %APPDATA%\Mozilla\Firefox\Profiles\ in the address bar of file explorer (for Linux it is ~/.mozilla/firefox) Double click the folder you see (if you have multiple FF ...


1

How can I add certificate pinning for other domains to my web browser (e.g. FireFox)? I don't think it's got a GUI in Firefox. For Chrome see Tom's answer. Is there a reason why there is no option to "Pin this certificate to this URI" when viewing the details of a certificate in a web browser? Yes. It's support hell when it's time for a key ...


1

You can do it in Google Chrome with chrome://net-internals/#hsts : In that screen you can consult the pinning state of a website (HSTS, HPKP and preloaded) but you can add certificate pinning for any domains too : In the Add domain section, you can specify for any domain : If you want to force HSTS If you want to pin some certificate : you need to ...


2

To answer the first two bullet points: Firefox has its own list of trusted CAs. You can add certificates in Menu Button>Options>Advanced>Certificates(tab)>View Certificates>Authorities(tab). This is for Firefox version 38. Yes Google is trying to shame people into moving from SHA1 to a more secure hash such as SHA2. Here is the chromium blog post about it. ...


0

Nice juicy answers but none of them has answered the question. How is this possible? The answer is it's possible with your permission. Is there JavaScript code that can get the MAC address? Well.. Java can The webpage that you have visited most likely has asked for your permission to run a Java application and you must have agreed. A Java ...


0

A Javascript Crypto API spec that all browsers must (hopefully) support. Am i correct? Hopefully all browsers should support it, though currently it's still work in progress. The specification does not mandate that the API be implemented in JavaScript. Developers are free to choose their underlying implementation, it could be JS, or a built in part of ...


0

Unfortunately, the answer is simply "nobody knows". Let's make some large assumptions: Endpoint is not currently compromised. Financial Institution to transact with is not currently compromised. No exploits known today (tomorrow another story) for home router OS, OS, installed applications, and firmware. Then the most secure app / browser in your list ...


4

The challenge with any non-mainstream browser is that writing a browser engine from scratch is a complex and expensive process, and maintaining a fork of a browser and tracking upstream is also a complex process, especially once the fork starts to deviate significantly from the base project. If you look at the problems that WhiteHat aviator encountered ...


1

You can try to update your web browser and maybe plugins. If your browser supports it, you can disable weak ciphers and apply custom order to ciphersuite. This can help you in this: https://www.ssllabs.com/ Everything else must be done at the server side.


3

The website is using SHA1 certificates to provide security. The new Chrome browser is showing it as a weak algorithm, because most of the organizations are already migrated to SHA2 certificates. It is just a warning, it does not mean that it would be a non-secured connection.


2

Google Chrome Click on the padlock at the left of the address bar Mozilla Firefox Click on the padlock at the left of the address bar Then click 'more information' Internet Explorer The padlock is to the right of the address bar, but it won't help. Instead (On a blank bit of the page) right click Properties It would be neat if Internet ...


1

Mixed-content warnings occur when an HTTPS page is asked to load a resource over HTTP. This is dangerous because the insecure resources and vulnerable to alteration by an active attacker or eavesdropping by a passive attacker, which violates the user's expectation of security for an HTTPS page. An anchor <a> link does not cause any resource to be ...


1

This is sort of how JA-SIG CAS (enterprise SSO) works. To apply that architecture to your instance, setup the following on WebsiteB: Have WebsiteB generate a unique token in the link such as in the query string and make sure it uses SSL. Store the token information in a database (or similar method). Be sure to include a timestamp for when it was issued ...


0

If you setup log management and send event logs as syslogs, as seen in the following document -- then you can monitor for IoCs (or hunt through the events). http://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262 For example, if Flash crashes, EMET alerts, or your AV describes a particular ...


0

Trusting the server is unavoidable, and you have to trust the server anyway if the crypto is server based. MITM attacks also apply to server based crypto, and I see no reason why a malicious plugin couldn't also attack server based crypto. The main difference is that you're relying on the client end to do the encryption, where you have less control of the ...


1

What you are proposing is the same architecture that is used in online password managers like Lastpass and online Bitcoin wallets like Blockchain. You have named the two big threats: Javascript tampering and a compromised computer. You deal with the threat of Javascript tampering by securing the server and convincing the users that your Javascript is ...


3

If the linked resource is an image or a script, often the main concern is not that an attacker could read it, but that an attacker could hijack the request and inject a modified version of the resource to change the look or behavior of the page - scripts especially, as they could be modified to do something malicious like redirecting the user to another ...


-1

HTTPS secures your connection to the server. The content you transfer over the HTTPS is encrypted. On the other hand HTTP is plaint text, which means the content you transfer over HTTP is not encrypted. Now if someone is sniffing your traffic, then in case of HTTPS the attacker can only see the encrypted data, but in case of HTTP the attacker can see the ...


2

Tor could be a solution for you, if you could compromise some of the browsing speed. Tor tries to implement many countermeasures for your anonymity theft. I would recommend that just using Tor is not enough please read the Tor FAQ for further details. Update: Apart from that I would say you have to change your browsing habits too in order to stay ...


-3

It's a fake, and is trying either to get you to click on the "OK" button so that it can run something nastier, or to lead you to some scammer's site. The good news is that there are limits on what code that runs on page-load can do in modern browsers, because it isn't started by the user. Just popping up an alert-box isn't much of a risk. It's awkward, in ...


1

To protect yourself from such invasive advertising, I would recommend you to install an ad blocker. It might be ethically questionable to use it on all websites, because that way you are depriving website owners of their income. But when a website uses malicious advertisement, using it is reasonable self-defense. Another way to protect yourself from such ...


3

Its a fake alert for scaring users, it will later download fake antivirus program and show you fake scan results. These results will be very alarming and exaggerated displaying various types of virus present on the system and will ask users to buy the product in order to clean the system. Don't fall prey to such scams and never buy any of these products. ...


4

This message is just utilizing the alert function from javascript which is used to display a message to the user. One thing you need to understand is that once this tab has been opened you have already browsed to the "scam" site, the message is shown by the scam site. No harm can be done from the message itself and not from clicking OK. It doesn't matter ...


3

What you describe is a wrong, spam practice but it does not cause other inconvenience over the spam aspect. Browsers allow JavaScript code initiated by a user click to add bookmarks in order to allow websites to propose friendly "Bookmark this site" buttons. However such functionality can be exploited in order to store unwanted bookmarks in visitors browser ...



Top 50 recent answers are included