Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [chrome]

Popular web browser by Google, see chrome.google.com for more information.

6
votes
1answer
517 views

Different IPv4 numbers from different browsers, same computer

If I search on Google the words "my ip" using Firefox, Google returns a IP that belongs to my ISP: About 447,000,000 results (0.46 seconds) 200.x.x.x Your public IP address But, if I made the same ...
0
votes
2answers
132 views

Are there any consequences of clicking on a URL to a facebook.com link?

So I stupidly clicked on a suspicious link on a Facebook post today. Guest account for shame. In my defense, it was a link to facebook.com itself, but it loaded a Facebook page, then seemed to ...
2
votes
3answers
845 views

Can Google Chrome read/scan my ProtonMail inbox page?

If I used Google Chrome to visit ProtonMail website, it would not be difficult for Google to read my emails since it would just need to scan/read the content of the page. Messages are encrypted just ...
2
votes
1answer
364 views

AirVPN, DNS Leaks on Windows 8.1, but not Ubuntu

I've noticed when I visit dnsleaktest.com using Windows 8.1 & Chrome a bunch of UK IP addresses (Belonging to my ISP) are displayed alongside the Netherlands IP address I should be appearing as (...
2
votes
1answer
1k views

chrome app (javascript) - storing encryption password in memory

I'm building a chrome app that encrypts user messages on the client. The encryption is performed using the forge js library. I want to ask for the encryption password once, and use it to encrypt all ...
6
votes
2answers
1k views

Chrome: Watch for modified https-certificates

I read a lot about security of https and possible MITM attacks lately. For me it seems there is only possible way to make a https-MITM attack: When a MITM exchanges the shipped https-certificate and ...
2
votes
1answer
971 views

Single button click mobile direct carrier billing fraud

A friend of mine had just had the following happen: He visited a website with the mobile phone using Chrome Mobile on Android An advertisment poped up that covered the whole page There was no close ...
4
votes
1answer
559 views

OneDrive marked unsafe by Google Chrome due to unsafe scripts

The OneDrive user's drive page asks to load the following script (which is typically blocked by Chrome to be unsafe) <html> <head> <title>Bing</title> </head> <...
3
votes
3answers
2k views

Can Chrome sync be infected?

Can Chrome sync be infected by malware? I cannot imagine how, but a particular unproven example that comes in mind is to change the "preferences", so that a malicious proxy server is added. Another ...
6
votes
1answer
301 views

Third-Party-Cookies Tracking - Google Chrome

I've read an article about third-party-cookies which explained that in Google Chrome disabling third-party-cookies will not stop the browser from sending third-party-cookies. So when I visit Facebook ...
10
votes
1answer
18k views

How to make Firefox ignore the X-XSS-Protection response header?

I have two questions: How can I make Firefox ignore the X-XSS-Protection header? I have a website which sends an X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it ...
3
votes
2answers
436 views

Is using Chrome and Tor Browser at the same time secure?

I question this recently because as I was using the Tor Browser, while in the same time my Google-Chrome was opened, and I right-clicked on a word to search it in 'Disconect', when the page loaded I ...
16
votes
3answers
3k views

Why do Firefox and Chrome “leak” critical security information out of the browser and how can I stop it?

In studying SSL / TLS handshakes and encryption, I found a method that describes how to export the SSL / TLS session keys from Firefox to an user or environmental variable outside the browser, and ...
2
votes
2answers
700 views

I delete cookies file in chrome but i'm still logged in after I restart Chrome

I'm using linux and google chrome as browser. I know that cookeis are stored at /home/my_name/.config/google-chrome/Default/Cookies. I deleted this file but it seems like when I restart Chrome and ...
0
votes
1answer
392 views

Do any browsers support Server Name Indication (SNI) but NOT SHA-2? [closed]

Yes, I know that SHA-2 signature validation is typically done by the operating system (with Mozilla Firefox/NSS and Chrome as of v39 being the exception).
2
votes
1answer
257 views

Chrome/FF not negotiating advanced ciphers?

Ran into a weird problem trying to lock down our AWS ELBs today, specifically trying to deprecate all support for SHA-1. Having removed options like AES256-SHA ECDHE-RSA-AES256-SHA (among others) ...
0
votes
0answers
35 views

Security implications of an “obsolete” cipher as indicated by Chrome [duplicate]

I guess this has been asked before, but what are the security implications of the below message? I've seen ciphers such as AES_128_GCM being labeled as "modern". Is this mitigated server side (load ...
2
votes
1answer
151 views

Why did Google sign every auxiliary app inside “Google Chrome.app” (OS X version) except for one?

$ codesign -dvv /Applications/Google\ Chrome.app/Contents/Versions\ /46.0.2490.80/Google\ Chrome\ Framework.framework/Resources/app_mode_loader.app/ /Applications/Google Chrome.app/Contents/Versions\ ...
1
vote
1answer
995 views

Security of cross-origin XMLHttpRequest Javascript

I am building a Chrome extension that will be making cross origin "get" and "post" requests to a few third party websites. I have been researching this process for hours and I am becoming increasingly ...
1
vote
1answer
1k views

How to prevent chromeipass from auto-filling credentials?

ChromeIPass (addon for Keepass on Chrome) wants to unlock the database every time it detects credential fields, even if I don't even have an account on that site. This is the default setting (october ...
1
vote
1answer
88 views

Protecting users with browser extension. Is it possible, if the machine is already infected?

Assume a trojan acquired admin privilege on a Windows 7 machine. How easy is it for the trojan to replace/hijack/modify a browser extension without user knowing it? Is it possible? I am thinking of ...
3
votes
3answers
3k views

Is it possible for a web page to log your keystrokes?

Is it possible to have a web page in Chrome open, and it can run a web app of sorts on the webpage, and have that web page log your keystrokes?
2
votes
0answers
278 views

HTML Injection on iOS?

I had an uncommon issue with both Safari and Chrome on an iPhone 6 running iOS 9.0.1 last night - a number of sites were displayed with altered links and/or additional links (clearly from a third-...
8
votes
1answer
9k views

Why is secp521r1 no longer supported in Chrome, others?

Found a few issue threads, notably for Chrome (Chromium issue #478225), and the browser does appear to have dropped support for the secp521r1 curve (can test your browser using SSLLabs). There were ...
1
vote
1answer
639 views

Chrome + EMET= How Strong Realistic Protection Against Browser-Based Threats?

tl;dr: How secure is a combination of a sort-of hardened Google Chrome + Microsoft Enhanced Mitigation Experience Toolkit 5.1 against browser-based threats that I do not expect to be highly ...
0
votes
1answer
164 views

Possible sources of repeated Adware infections

In the last couple of months I have had the same thing happen on separate occasions to two Android phones, a Mac laptop and a Windows desktop computer. In all cases, something infects Chrome making ...
2
votes
1answer
3k views

Can SHA256 signature support be deduced from TLS cipher suites or any other part of ClientHello (if no signature_algorithm sent)?

Websites aiming to maintain maximum compatibility with (legacy) browsers may wish to serve SHA2-signed certificate chains to those user agents that support them, and SHA1 to those that don't. The TLS ...
4
votes
3answers
278 views

Addons in Chrome

When installing any add on in Chrome, a set of permissions is needed to be granted to the add on. Many addons(including popular ones like Pocket and Adblock) have Read and change all the data on the ...
2
votes
3answers
1k views

Vulnerabilities despite FIDO U2F?

FIDO U2F seems much more secure than one-time-passwords (OTP), especially TOTP, because of the challenge-response architecture. In what ways is a U2F user still vulnerable? I presume if a user's ...
6
votes
1answer
2k views

Should Flash be disabled, or are sandboxes secure enough?

Flash is a hot bed of vulnerabilities. Chrome contains a built in version of Flash, running in sandboxed mode. Obviously, this method is safer than running Flash as a plugin in either Firefox or IE. ...
3
votes
1answer
371 views

Getting a certificate warning for one email but not another

When I log into outlook.com using Chrome browser, I get a certificate warning for one account but not another. One says my connection is private, the other says it "may not be private". Here are the ...
1
vote
0answers
236 views

How to know which extension or software is causing ads in Chrome? [closed]

Starting yesterday, I noticed that something weird is going on with my laptop. After unlocking my laptop I found that the empty Chrome pages that I opened are getting redirected to ads. I am running ...
3
votes
1answer
365 views

Could the causes of CVE-2015-2502 vulnerability be common to Firefox and Chrome?

On Tuesday August 18, 2015, Microsoft published an advisory pointing out a 0-day vulnerability (CVE-2015-2502) that can be exploited by an attacker to perform a remote code execution on Internet ...
7
votes
1answer
1k views

Is Chrome for Android leaking my phone number?

I accidently clicked on an advertisement, and opened it with chrome. It was one of those things where you can subscribe to an App Store for £4.50 a week for apps which are usually free anyway. ...
2
votes
2answers
17k views

Difference between X-Forwarded-For IP, X-Real-IP, VPNs and TOR

I have this Google Chrome Privacy Preserving Extension that I am working on. Where I can spoof the header information e.g user agents and else. When I spoof X-Forwarded-For IP and go to http://...
8
votes
2answers
2k views

Are X.509 nameConstraints on certificates supported on OS X?

I have the following "chain" of certificates on a test machine right now: A self-signed CA cert, in my Keychain and trusted & trusted by Firefox. A CA cert with with the following, X509v3 Name ...
1
vote
2answers
277 views

Should I update my SHA-1 certificates? If so, how?

Q: Should I update my SHA-1 certificates? If so, how? Recently I noticed the "https:" has a red strike-through and warning in Chrome, but only on certain websites. Apparently this has been ...
4
votes
1answer
414 views

Can't get rid of “Your connection to website is encrypted with obsolete cryptography”

In my Nginx config I have: ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:...
0
votes
1answer
108 views

Should a Web Search with Evernote results be a concern?

While using a Chromium based browser (Chromodo) and doing a regular Google search, Evernote is now appearing on the side with "related results in your notes". Does anyone know how they are doing it?...
5
votes
3answers
296 views

Is my Google session safe when my computer is logged out or locked?

I've recently uploaded all the family photos to my Google Drive account. I have a strong password and 2 step verification enabled on my Google account. My home computer is (naturally) trusted and ...
7
votes
3answers
1k views

Ali Express hijacking my Chrome

So randomly every now and then, when I click on a link - instead of opening it normaly, a new tab is opened and some website with "tracking" in the name (I haven't caught the full name yet, it's quite ...
3
votes
1answer
10k views

Chrome showing SSL warning about SHA-1 when the sites don't use SHA-1

My version of Chrome on an iMac (latest 43.0.2357.130 (64-bit)) is showing an SSL warning for well-known sites (Hackernews, GitHub, DigitalOcean): This site uses a weak security configuration (SHA-...
2
votes
2answers
3k views

Using VPN in the UAE - safe or trackable?

I'm currently in the United Arab Emirates, and I am wondering if Etisalat or the UAE can track what I am doing if I use the ZenMate VPN addon to Chrome?
10
votes
1answer
435 views

What technologies does ChromeOS use to secure saved passwords?

I have read that Chrome will use the system's native credential tools to manage saved passwords (e.g. KeyChain on OSX, libsecret on Linux/GNOME etc). Does anyone know what tools are used on ChromeOS?
0
votes
2answers
2k views

Authenticating Hotmail's certificate and connection security

I've recently received the following error message from hotmail.com (or live.com) after I have logged in using Chrome browser, consistent using different accounts and computers (regardless of 2FA or ...
9
votes
1answer
5k views

are chrome extensions in the Chrome store generally safe?

Should I ever be worried about installing any chrome extension from the Chrome store? A lot of the Chrome extensions I have, have the permission "Read and change all your data on the websites you ...
10
votes
2answers
24k views

Obsolete cryptography (SHA1) warning although certificate uses SHA256

I ordered a certificate with SHA256 from Comodo and was wondering why Chrome shows this message: Your connection is encrypted with obsolete cryptography. The connection is encrypted using ...
0
votes
1answer
657 views

Google Chrome obsolete cryptography

I have a apache server running and following configuration for ssl: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" SSLProtocol -all +TLSv1.2 SSLCompression Off ...
17
votes
2answers
7k views

Securing Google Chrome Browser against the Logjam exploit on Windows

Is there a way to fix Chrome against the Logjam TLS exploit on Windows? I have updated my Chrome to the latest version yet the https://weakdh.org/ website warns me that "web browser is vulnerable to ...
1
vote
1answer
122 views

Give Someone Access to Secure Website? [closed]

I have someone I hired on a Freelancing website working for me - so far he has worked for me for about two weeks and is doing a good job. In order for him to complete his work he will need access to ...