All Questions
Tagged with browser-extensions web-browser
77 questions
2
votes
2
answers
621
views
How to determine which Chrome extension is re-directing me to ad sites
Twice now, seemingly randomly, I've been redirected to an ad site.
I believe it has occurred both times when I have a new tab open, type what I'm searching for (Google is my default search engine), ...
- 21
1
vote
1
answer
607
views
Are 2FA browser plugins sufficiently secure?
Regarding 2FA browser plugins, I follow the uneducated opinion that they usually provide sufficient security. Since a desktop computer is a unique device (even a virtual machine) and provides that ...
- 113
0
votes
0
answers
100
views
What can be leaked using a browser extension where one of the extensions loads JavaScript from a remote site?
Can one remotely log my IP, browser history, and saved passwords?
I think the IP should be easily done if one of the extensions load a remote JavaScript to run in my browser. I'm not sure about other ...
- 157
1
vote
1
answer
351
views
Can a browser-based HTTPS proxy secure browsing data while using a system-level proxy?
I use Nekoray to set up proxies for my Windows system.
When I connect to those proxies, does using a browser-based proxy with HTTPS encryption secure my transferred data through the web browser?
Can ...
- 113
1
vote
0
answers
239
views
GPU vs integrated graphics hardware, browser canvas fingerprinting, and multi- or dual-boot systems
My goal is to ensure that two operating systems installed side-by-side on the same device are unable to return the same canvas fingerprint, when a modern browser is allowed to run javascript without ...
- 1,135
0
votes
1
answer
626
views
Why are there no modern web browsers that allow extension access to SSL information about the site you are browsing?
In all my Googling, I found one version of FireFox that allowed it temporarily a long time ago, it has been discussed on the Chromium development forums for years, but yet, as of today, there is still ...
- 430
0
votes
1
answer
130
views
Does moving webAuthn API from browser to OS improves security of registration process?
Usually, for all types of authentications, we trust the registration process and assume there is no attack is happening Like in the case of FIDO2 registration. However, as the registration process is ...
- 81
0
votes
2
answers
232
views
Does an effective Content Security Policy mitigate a universal cross-site scripting vulnerability?
I am doing some background research into types of XSS and prevention and as I understand it there is not much any application can do against a universal XSS in a plugin or browser.
A last line of ...
0
votes
0
answers
116
views
Web Browser Forgetting Between Users
I am planning to go door-to-door and host events in which people use a computer to login to the Arizona Secretary of State website, enter sensitive information (like address, social security number, ...
- 51
2
votes
0
answers
282
views
What is the threat-model of a malicious browser-extension accessing the data of *another browser-extension* that is security-critical?
Modern password-managers are moving towards a "fully-in-the-browser" model (see: historical RCE on LastPass, and now 1Password is also moving towards 1Password X as "the future" ...
- 285
0
votes
1
answer
125
views
Credential theft by browser conferencing software?
While using the webex conference software, I noticed
that simply pressing a "share content" button allows me to share my full screen.
There was no security confirmation from my webbrowser (chrome):
I ...
- 103
0
votes
0
answers
126
views
Domain Joined computer doesn't browser properly with any website with Let's Encrypt CA cert
Navigating to any website with Let's Encrypt CA cert and even after enabling the HTTPS Everywhere addon,
I'm getting "Your connection is not private".
Getting this error from all the browser except ...
- 111
2
votes
1
answer
203
views
Is this sufficient to verify a website's domain?
I'm building a browser extension that will run some javascript, which contains some sensitive information (essentially injecting authentication info). Therefore I want to make sure it only executes it ...
- 1,246
38
votes
1
answer
7k
views
Can a browser extension (Chrome, Firefox, etc.) read the web console log?
I realized that my bank handles sensitive information in the web console log, so my concern is if any browser extension could read the log?
- 499
8
votes
3
answers
2k
views
Browser setups to stay safe from malware and unwanted stuff
I have to set up a browser to surf the internet. I'm trying to stay safe from malware as much as possible. (I already know that there's no way to stay 100% safe.)
My idea is to use Firefox with these ...
- 83
-1
votes
1
answer
424
views
How common is the usage of browser zero-days in the wild?
We have an overview with known but fixed vulnerabilities for this browsers: Google Chrome, Mozilla Firefox and Internet Explorer. Such lists exist for many other browsers too. We also have such ...
- 582
3
votes
2
answers
563
views
Are some privacy add-ons superfluous when using Tor browser?
If running the Tor browser, should you still have the same privacy add-ons as you would if you were running a "regular" browser? Or will some of them be superfluous because of the built-in ...
- 1,821
3
votes
1
answer
2k
views
Understanding which privacy tools provide very similar functionality
https://amiunique.org/tools has a list of recommended privacy tools.
uBlock
Ghostery
HTTPS Everywhere
Lightbeam
AdBlock Plus
Disconnect
Privacy Badger
NoScript
Self-destructing cookies
However, aren'...
- 1,821
2
votes
0
answers
176
views
Collecting PII in an iframe on any website. Is it Safe?
I am building a chrome extension that allows users to submit a form on any website. Once a user would visit a certain website, extension would open iframe on that website and ask user for some PII in ...
23
votes
2
answers
19k
views
Is Stylish safe to use again?
Stylish is/was a very popular extension for the Chrome and Firefox web browsers, which let users add custom styles to certain websites. I was using it myself, until a helpful fellow told me it was ...
- 2,285
0
votes
1
answer
203
views
Why are there no browser feature or extension to only check the domain and username to prevent phishing?
One of the recommendations to prevent phishing using look-alike domain names (like www.google.com.phishing.org or IDN homograph attacks) is to use a password manager or a physical security token like ...
- 183
11
votes
1
answer
1k
views
Danger of browser extension without any permissions?
Assuming that an extension for Firefox or Chrome does not request any WebExtensions permission, what harm could this extension do?
Or put another way: What (potentially malicious) actions can an ...
- 29.8k
4
votes
1
answer
2k
views
Is it possible for page to get your installed extensions through javascript?
When you visit a page, could that page tell what extensions you are running
if javascript is enabled?
If so then could we stop them or at least make it extremely difficult to increase our privacy?
2
votes
1
answer
155
views
Why/how is browser inserting inline SVGs at end of body?
Chrome is inserting the following SVG images at the bottom of pages:
<span style="width: 24px; height: 24px; background: url("data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiA/...
- 121
2
votes
1
answer
671
views
GET, "mailto" warning - how can I tell if a site is secure?
My password manager is giving me a warning when I go to certain sites. They say if I think I can trust the site to go ahead and use it .... this leaves me concerned I'll miss something.
The pop-up ...
- 31
1
vote
1
answer
159
views
How do modern browsers isolate different addons?
A user may have multiple addons installed on a browser. But typically, the browser is running in userspace with an unprivileged uid. I was wondering how modern browsers can, in such a setting, provide ...
- 1,693
3
votes
1
answer
157
views
Prevent reflecting page modified by browser extension
Suppose there is a trusted browser extension in a chrome browser that modifies the web page (like editing DOM, appending scripts, etc)
I don't want anyone but me to see the page modified by this ...
- 387
2
votes
1
answer
735
views
How do password managers implement secure browser integration? [closed]
Some password managers can automatically fill passwords in user's browser. But for this auto-fill to be secure, they have to make sure they are putting password in the correct input field, plus, the ...
- 1,693
2
votes
0
answers
154
views
Is it possible to "polyfill" a vulnerable Flash player to a users machine when they visit a web page?
This is about the concept of adding "necessary code" to a webpage to ensure that any client can view the "content" provided through that page. This sort of code is sometimes referred to as a polyfill.
...
- 131
64
votes
6
answers
13k
views
Are there objective reasons to not allow Google Chrome extensions, but to allow Firefox extensions?
Recently, the company I work for has forbidden usage of any extensions in Chrome. They also do not allow account sync. This affected virtually all Web developers since they use Chrome to test their ...
- 2,193
3
votes
1
answer
242
views
Web browser account security
Please note that I've looked what similar questions have been addressed, but all I found was partial discussions.
My concerns is about web browser, password managers, cookies and sessions.
My goal ...
- 131
1
vote
0
answers
163
views
Can websites collect browser data without using http requests? [closed]
Is it possible for a website to collect data such as the plugins/fonts installed without sending it thought http requests?
If so, is there any plugin for any browser that tells the user what type of ...
- 111
2
votes
1
answer
134
views
How can I programatically keep track of number of certificate warnings in browser?
I want to keep a count of how many certificate warnings have been made in the browser over a period of several weeks. I also want to keep track of whether the user ignored these warnings and just ...
- 1,576
1
vote
1
answer
175
views
Go.redirectro issue [closed]
I have a hijacker problem "Go.redirectro"
And it gave ma a horrible headache
I tried registry editor and take a file by file deep look at my drive and uh god it took me long time
Look i am a ...
- 19
1
vote
1
answer
222
views
Should I use different browsers for surfing and logging into accounts?
I use web in different ways, i.e.:
a) to log into my accounts (email, google, social, forums, etc.);
b) for downloading softwares;
c) for surfing trusted websites;
d) for surfing websites which I don'...
- 481
-1
votes
3
answers
237
views
How to protect your web application's data against an injected JavaScript?
I have a web application which interacts with two web servers. The response of the first one is stored temporarily on the browser (window.xyz=response.xyz) and when the user makes the request for ...
- 3,286
70
votes
8
answers
18k
views
Why use HTTPS Everywhere when we have HSTS supported browsers?
I know that the browser's default protocol to access any site is http:// when https:// is explicitly not mentioned, but even then if we browse to a website say www.facebook.com, the response header ...
- 882
1
vote
4
answers
181
views
To plugin or not to plugin?
Recently I did quite a research about internet browser related privacy. It hit me hard in the flesh myself, since I was part of the victims in the [WOT fiasco]1]. So I found out that usually way over ...
- 133
2
votes
1
answer
258
views
Plugins to increase security of Chrome? [closed]
What plugins are there for Chrome, that would increase security while browsing the web?
For Firefox I have used NoScript, Flashblock, and AdBlock Plus, are there equivalents to these plugins for ...
- 157
1
vote
1
answer
448
views
Browser custom protocol handlers
The possibility of running a shell command from an extension (NPAPI) has been phased out, but custom protocol handlers are still supported.
What is the practical difference if an extension can still ...
- 857
2
votes
1
answer
157
views
Malicious script compromising browser extensions
In Firefox or Chrome,
is it possible for a web page script to compromise a user installed extension?
This might involve access to extension private data or obtain the same execution privileges as ...
- 857
1
vote
1
answer
229
views
What threat does the 1Password Browser authentication mitigate?
The latest 1Password browser update for Firefox includes an authorization between the plugin, and the browser itself. This is documented on the vendors website: https://support.1password.com/browser-...
- 51.1k
1
vote
0
answers
137
views
How does bulk Advertisement opt-out work? What services exist? [closed]
There are a few online advertisement opt-out services such as:
http://www.aboutads.info/choices/#completed
http://www.networkadvertising.org/choices/#completed
http://www.youronlinechoices.com/uk/...
- 51.1k
1
vote
3
answers
1k
views
Why use HTTPS Everywhere instead of going to the HTTPS site directly?
My understanding is that HTTPS Everywhere redirects websites to an https:// version if they support it.
My question is, if websites do have an https:// supported version why aren't they using them in ...
- 53
3
votes
2
answers
416
views
Are popular browser extensions for anonymity as safe as Tor?
There are many different browser extensions that people use in order to hide their IP addresses and protect their anonymity. Can the reliability of these proxy extensions be considered as being on the ...
- 133
4
votes
2
answers
382
views
Can a Firefox extension read preferences or data stored by other extensions?
Is it possible for a Firefox extension to read preferences or data stored by other Firefox extensions?
For example, could Firefox extension A, read any preferences or data stored by Firefox extension ...
- 3,174
2
votes
2
answers
1k
views
A dedicated browser (profile) for online banking
I have a dedicated browser (Firefox) profile that I use for accessing online banking systems (and only for that). The current setup is (summarising) as follows:
I have it set to clear all history and ...
- 121
2
votes
1
answer
406
views
WebRTC attack surface area?
I'm building an app for browser-to-browser communication.
What is the attack surface area for WebRTC in 2015?
What kinds of attacks could be done? And more importantly, how do I craft something ...
- 287
0
votes
2
answers
1k
views
Chrome/ Opera continue to save & autofill passwords after installing LastPass? Good or bad? Enable/ Disable?
I started to use LastPass a few months ago and imported passwords from my browsers.
Apparently, Google Chrome and Opera (based on Chromium) still pop-up the option to store passwords in my browser ...
- 381
4
votes
2
answers
247
views
apple.com exploit attempt?
I recently browsed to apple.com; and the page crashed a few times, then after I reloaded I was given this alert after my browser attempted to redirect to res://ieframe.dll/acr_error.htm#apple.com,http:...
- 231