All Questions
72 questions
1
vote
1
answer
150
views
CSP : Different hash for the same external library (Firefox vs Chrome)
During my implementation of a proof of concept for a CSP, I noticed that the hash value for the external library (jquery in this example) isn't the same between Firefox and Chrome and I can't figure ...
- 13
1
vote
0
answers
1k
views
Tool to Decrypt Chrome, Firefox and Edge login information [closed]
Im new to python but Ive created a couple of programs that can collect the user credentials for Google Chrome, Mozilla Firefox and Microsoft Edge and decrypt them then save the decrypted output to ....
- 11
5
votes
1
answer
266
views
Is chrome not blocking all third party cookies?
I opened a website 99acres.com in incognito windows on two browsers on a Macbook. Following are the settings:
Chrome
Version: 100.0.4896.75 (latest)
Third Party cookies: Disabled
Firefox
Version: ...
- 151
0
votes
0
answers
20
views
Store login credentials securely with JavaScript [duplicate]
Today I have a web application that needs to store the user's email and password, so that when he opens the login screen, the authentication is done automatically.
For this, our application saves the ...
- 174
0
votes
0
answers
52
views
How Firefox and Google password managers protect your password [duplicate]
Based in this post in Google Chrome help they claim that they encrypt my username and password with a secret key known only to my device.
What is the algorithm used to generate this secret which is ...
- 21
0
votes
2
answers
221
views
What's the risk of keyboard languages being sent via Content-Language header?
The Android versions of Firefox and Chrome/Chromium and all derivatives (Ungoogled Chromium, Bromite, Brave) by default insert all the user's configured keyboard input languages into the Accept-...
- 301
6
votes
1
answer
975
views
How did Firefox get my passwords?
I just installed Firefox browser, while I have previously used Google Chrome as my main browser. I am using Windows 10.
During the installation and setup process for Firefox, I was given the option to ...
- 172
1
vote
1
answer
187
views
Are saved passwords in browsers secure, when stored online?
Where are saved passwords stored if you login to a browser, so they sync whenever you login to that browser on another device. Where and how do Google, Firefox etc. save the passwords? Obviously its ...
- 11
0
votes
0
answers
677
views
Global variables accessible to other websites opened in same tab
Today I found a security issue with Chrome (or maybe other browsers I haven't tested yet).
What happens is that once you open a site and then open another site in the same tab, the previous site's ...
- 121
2
votes
0
answers
282
views
What is the threat-model of a malicious browser-extension accessing the data of *another browser-extension* that is security-critical?
Modern password-managers are moving towards a "fully-in-the-browser" model (see: historical RCE on LastPass, and now 1Password is also moving towards 1Password X as "the future" ...
- 285
1
vote
0
answers
701
views
CA certificate somehow not taken by browsers on android [closed]
This is a follow up question related to this answer.
In short: I am importing the self signed Root CA certificate into android system via
Settings -> Security -> Trusted Credentials -> ...
- 131
0
votes
1
answer
953
views
DNS spoofing protection in Chrome and Firefox
I'm using hostapd to setup a wireless access point and dnsmasq as a DNS/DHCP server. I defined in dnsmasq to reply with the IP of the access point (10.0.10.1) when it receives a query for www....
38
votes
1
answer
7k
views
Can a browser extension (Chrome, Firefox, etc.) read the web console log?
I realized that my bank handles sensitive information in the web console log, so my concern is if any browser extension could read the log?
- 499
0
votes
2
answers
1k
views
Why does Firefox (version 71.0 (64-bit)) indicate “weak encryption” but Google Chrome (Version 79.0.3945.88) does not?
I read that Mozilla uses its own trust certificate store but does "weak encryption" have anything to do with whether the browser trusts the certificate?
Has it got anything to do with the signature ...
- 103
8
votes
3
answers
2k
views
Browser setups to stay safe from malware and unwanted stuff
I have to set up a browser to surf the internet. I'm trying to stay safe from malware as much as possible. (I already know that there's no way to stay 100% safe.)
My idea is to use Firefox with these ...
- 83
2
votes
1
answer
523
views
Browser copy function overridden silently, is this security risk?
I came across a site which overrides copy functionality and injects current page url as paste value. I was trying to select couple of words and instead it copied the page link. Simple developer tools ...
- 207
10
votes
2
answers
6k
views
Did google chrome kill public key pinning?
I've read many articles talking about google chrome killing public key pinning in Chrome 67 (May 2018). See here, here, and here.
However, I haven't found any information about whether or not they ...
- 31.7k
6
votes
1
answer
324
views
Information obtained from executing Javascript math functions in browser
I came across interesting piece of javascript across few sites. It's executing Javascript math functions such as abs, acos, random etc. thousands of times - or four thousand times in my case, though ...
- 207
2
votes
1
answer
242
views
How to defend myself against potential malicious browser add-ons?
So previously I asked a question about what type of private data can addons extract from my browser :
Can a malicious add-on access internet history and such in Chrome/Firefox?
and it turns out if ...
- 363
20
votes
2
answers
3k
views
Can a malicious add-on access internet history and other sensitive info in Chrome/Firefox?
How does Chrome/Firefox make sure add-ons are safe? Do they have any protection against a malicious add-on?
How much access can add-ons have? Can they access internet history or maybe even cookies ...
- 363
12
votes
2
answers
7k
views
How to prevent Firefox and Chrome from opening ports in the firewall?
I have noticed that Firefox and Chrome have opened ports for unsolicited inbound traffic in the Windows firewall. This happened with Windows 7 x64 and Windows 10. (Here, I am talking about the ...
- 599
3
votes
0
answers
848
views
HTML link with "noopener" and/or "noreferrer" in Chrome/Chromium results in unexpected behaviour
There are several attacks possible when embedding links with target="_blank". This is where rel="noopener" and rel="noreferrer" should help.
I am expecting that clicking the following link
<a ...
- 131
11
votes
1
answer
1k
views
Danger of browser extension without any permissions?
Assuming that an extension for Firefox or Chrome does not request any WebExtensions permission, what harm could this extension do?
Or put another way: What (potentially malicious) actions can an ...
- 29.8k
10
votes
2
answers
3k
views
Why do Chrome and Firefox report a different server certificate and issuer than OpenSSL?
When I visit https://somesite.org using Chrome or Firefox and inspect the server certificate, everything looks OK to me.
I see SSL Server Certificate, CN, O, OU that appears to match somesite.org ...
- 269
3
votes
1
answer
382
views
How to Send Decoded URI?
I'm working in Burp and received an interesting response when sending a decoded string as a GET request. Copying/pasting the same string into a browser, the string is automatically encoded by the ...
- 33
4
votes
1
answer
807
views
Are browsers still vulnerable to IDN homograph attacks?
Is it not possible for Chrome and Firefox to protect against this > https://www.аррӏе.com/
Navigating to that above (fake) apple website using Firefox 59.0.2 doesn't actually take me to the apple ...
- 41
8
votes
2
answers
5k
views
Can malicious Javascript in local HTML -file send files to internet in Firefox/Chrome?
Download example.html -file from random website to my computer desktop
Open example.html -file from desktop with Google Chrome
Now Chrome executes javascript from example.html -file that searches ...
- 181
3
votes
3
answers
3k
views
How to confirm if a site is using Device Fingerprinting
Is it possible to confirm if a site is using Device Fingerprinting? When the site owner uses JavaScript, is there something we can look for in the script to confirm if a website is using device ...
- 225
64
votes
6
answers
13k
views
Are there objective reasons to not allow Google Chrome extensions, but to allow Firefox extensions?
Recently, the company I work for has forbidden usage of any extensions in Chrome. They also do not allow account sync. This affected virtually all Web developers since they use Chrome to test their ...
- 2,193
0
votes
2
answers
6k
views
Chrome and Firefox showing errors even after importing latest CA certificate for Burp Suite
I am using Chrome 61.0.3163.100 and Firefox 39 on Windows 7 32-bit with Burp Suite v1.7.
I have imported latest CA certificate for Burp Suite. In spite of which it's not working for sites with HSTS ...
- 345
1
vote
0
answers
460
views
Check if a Websocket connection origins from a Chrome extension [closed]
I am writing an application that communicates with a Chrome extension via websocket connection. I wonder if there is a way to detect whether the connection actually origins from the extension. The ...
- 252
1
vote
1
answer
3k
views
Can my computer be compromised by uBlock/Adblock filter list?
uBlock is open source and suppose I trust the author. But filter lists are something that is maintained by other people. Is it possible to add something to a filter list to compromise computer/browser,...
- 715
2
votes
4
answers
5k
views
Should I be concerned about Wayback Machine trying to load scripts from unauthenticated sources?
I regularly use Wayback Machine to help find archived versions of webpages that have been taken down or are other otherwise unavailable.
While using the site, I noticed a peculiar warning in Google ...
- 1,535
3
votes
1
answer
18k
views
How to force browser to trust a self-signed cert
In our Intranet. we have a site (https://site1) configured with SSL using a generated certificate for a different site URL (https://site2).
Chrome/FF/IE/Edge browsers are showing invalid certificate ...
- 151
3
votes
1
answer
218
views
How secure is our privacy when using third party addons and extensions?
I use many addons and extensions in my browsers some of it is for ad blocking, taking screen shots and VPNs. This question came to my mind while using free VPN addons. I usually uses VPN addons for ...
- 569
1
vote
1
answer
502
views
Is there a way to differentiate the certificates that came as part of the certificate chain from the ones already in the trust store?
OpenSSL shows the following certificate chain for example.com:443.
$ openssl s_client -connect example.com:443 < /dev/null | head -10
depth=1 /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert ...
- 968
0
votes
1
answer
756
views
Why does OpenSSL show different CAs for mail.google.com:443 than what Chrome/Firefox shows? [duplicate]
Why does openssl show different certificate chain for mail.google.com:443 than what Chrome/Firefox shows?
$ openssl s_client -connect mail.google.com:443 < /dev/null | head -10
depth=2 /C=US/O=...
- 968
5
votes
2
answers
738
views
LastPass vulnerability: Should LastPass users change all their passwords?
Reading about the recent vulnerability in LastPass extensions for FireFox and Chrome. The published exploit allows arbitrary code execution. The vulnerability also allowed access to stored passwords. ...
- 6,923
3
votes
2
answers
3k
views
Does using incognito mode protect from browser fingerprinting techniques?
As far as I understand Chrome's and Firefox's incognito modes mean nothing is persisted. Cookies, Offline Storage, IndexedDB, cache, everything is flushed when you exit.
Does this still leave a way (...
- 361
3
votes
0
answers
171
views
Mechanisms of built-in password managers in browser
I am researching for auto-fill mechanisms in built-in web-browsers password managers.
Using windows hosts file i am redirecting browser query to my web-server where i am storing the full copy of ...
4
votes
3
answers
4k
views
Why do browsers not reliable block pop-ups?
On both Chrome and Firefox I am unable to reliably block popups without extensions. Though both browsers come with such settings, there seems to be ways to circumvent this behavior.
Now why is that? ...
- 287
3
votes
1
answer
952
views
What are the major security differences between Chromium and Firefox? [closed]
I'm not sure how to get an informed, unbiased comparison between the security models of Firefox and Chromium. I've tried to google it, but all I find are uninformed anecdotes from random news sites, ...
- 31
1
vote
1
answer
747
views
How to tell my HTTPS connection to a site uses PFS?
Does the browser have a UI for displaying the details about the TLS connection to the website, besides the "secure/insecure" icon?
- 8,644
2
votes
3
answers
2k
views
How secure is the native browser password autofill?
Safari, Chrome, Firefox, Edge, and IE all either have a suggest-password feature, or password archival feature.
How secure are these passwords when stored on a computer?
If replicated, how secure ...
- 51.1k
2
votes
2
answers
4k
views
Script injection on all browsers
I have something injecting a script into all web browsers that I have tried - Firefox, IE, Edge, Chrome - and it doesn't look like an extension (since it is doing so in different web browsers). I ...
1
vote
2
answers
259
views
Can I trust browsers not to snoop into my activities?
Is there anything stopping web browsers from snooping into our activities? I don't mean web history or any of that generic stuff (Chrome already collects them, right?), but is it technically possible ...
- 613
16
votes
1
answer
546
views
Preventing a site from appearing in the 'Most Visited' or 'speed dial' section of a web browser
Are there any established ways of preventing a website from appearing as an icon on the 'Most Visited' / 'Speed dial' / start page of a web browser?
One example of this is the tab that opens by ...
- 602
3
votes
2
answers
201
views
Why would a modern browser allow internal resources to be loaded from an external page
Recently someone announced that several Arris surfboard models lacked any form of authentication to perform functions such as reboot and factory reset a modem with a single http call.
Read more on ...
- 133
4
votes
2
answers
309
views
Can going to a bad website on firefox, or installing a malcious firefox plugin, infect other parts of my home folder on a Linux system?
BTW, I don't mean root, just a plain user. I'm worried because I'm scared that if I do such things I could infect my Chromium folder. I got a huge case of OCD.
- 171
4
votes
1
answer
2k
views
Firefox & Chrome Strong Ciphers
Of the following ciphers for RSA authentication, Firefox and Chrome do not use stronger than ECDHE-RSA-AES128-SHA256.
ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD
...
- 1,813