Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [chrome]

Popular web browser by Google, see chrome.google.com for more information.

187
votes
3answers
34k views

Don't understand how my mum's Gmail account was hacked

My mum (on Gmail, using Chrome) received an email from a friend's Hotmail address. She opened the email (very obviously a phishing email) and clicked a link in it. This opened a webpage with loads of ...
156
votes
4answers
116k views

What exactly does it mean when Chrome reports 'no certificate transparency information was supplied by the server?'

When visiting Gmail in Chrome, if I click on the lock icon in the address bar and go to the connection tab, I receive a message 'no certificate transparency information was supplied by the server' (...
126
votes
9answers
34k views

What stops Google from saving all the information on my computer through Google Chrome?

I noticed that in Google Chrome, if I type in file:///C:/Users/MyUsername/Desktop/ it shows me all of the folders on my Desktop, and I can type open up PDFs and such in chrome just by typing in the ...
126
votes
9answers
55k views

How secure is Chrome storing a password?

Whenever I enter a login into a new site, Chrome asks me if it should store the login details. I used to believe this was fairly secure. If someone found my computer unlocked, they could get past the ...
89
votes
4answers
11k views

Chrome generated passwords not high entropy?

On Chrome, if you open a sign up page, it will offer to fill and remember the password field. I did this and got the following sequence of passwords offered as generated: suCipAytAyswed0 ...
76
votes
13answers
27k views

Should I allow browsers to remember my passwords and synchronize them?

I wonder, how wise is it to allow Chrome and Firefox to a) remember the passwords b) synchronize them? My gut tells me that if it's not man in the middle who can intercept them, but Google and Mozilla ...
65
votes
6answers
12k views

Are there objective reasons to not allow Google Chrome extensions, but to allow Firefox extensions?

Recently, the company I work for has forbidden usage of any extensions in Chrome. They also do not allow account sync. This affected virtually all Web developers since they use Chrome to test their ...
65
votes
4answers
147k views

Google Chrome “Your connection to website is encrypted with obsolete cryptography”

Google Chrome is showing new information in the certificate section. Is this a big deal? If so how can I fix it on the server end? EDIT: Thanks for the answers but I'm not skilled in cryptography so ...
49
votes
5answers
13k views

IMG tag vulnerability

Is it safe to display images from arbitrary domains? I.e. let's say I have an image on my page: <img src="http://badguy.com/image.gif" /> What if image.gif will return some js attack vector, ...
45
votes
2answers
15k views

Worst case scenario, what can a Chrome extension do with “Your data on all websites” and “Your tabs and browsing activity”?

Chrome extensions, and just like other browsers, appear to often get quite some extensive access to your browser data. In fact, most extensions I've installed require access to: Your data on all ...
32
votes
3answers
8k views

Does “Not Secure” mean HTTP?

I work for a corporation and we are all given a kind of employee login system whose URL goes like this in the image below. (Sorry, I cannot disclose the full URL.) I thought "Not Secure" had ...
31
votes
6answers
8k views

Chrome: Your connection is private but someone might be able to change the look of the page

I happened to come across this (govt) website which should be HTTPS-secured, but Chrome does not show the green lock. Instead it shows this: What does it mean? How can attackers leverage this ...
30
votes
3answers
3k views

Are official browser add-ons really safe?

Almost any browser addon/extension that I install on my Chrome or Firefox (be it Firebug, RESTClient, ...) warns me, saying: It [the add-on] can: Access your data on all website Access ...
29
votes
1answer
4k views

Conflicting security messages about “chrome://settings” page; is it secure or not?

Accessing the chrome://settings page, I see two things contradicting each other: The ribbon below the address bar shows "You're viewing a secure Chromium Page." On the other hand, the security ...
27
votes
4answers
17k views

What Trusted Root Certification Authorities should I trust? [duplicate]

After two recent Slashdot articles (#1 #2) about questionable Root Certificates installed on machines, I decided to take a closer look at what I have installed on my machines. (I use current versions ...
25
votes
2answers
6k views

Why I am getting Facebook login pop up for every site?

My Chrome browser keeps prompting me for Facebook authentication, even though I have never logged on to Facebook from my PC. I am using Chrome browser from my company where they have a strong proxy ...
25
votes
3answers
7k views

How is Google Chrome managing authentication to sites?

In Chrome, every tab is its own process. Yet, logging in to a site, say, Facebook, persists across tabs. For that matter, in many cases, it persists across OS reboots. This seems inherently very very ...
22
votes
2answers
1k views

Is there a way to make the browser remove the login-password from it's memory immediately, like Chrome seems to do on accounts.google.com?

I did some testing, and found that a memory dump of Chrome doesn't hold the password of gmail.com/Google after logging in to that site (the login happens on accounts.google.com). (My System is ...
20
votes
6answers
12k views

Is Chrome completely secure against Reflected XSS?

I notice that Chrome does not execute scrips that are part of the web request, http://vulnerable_site?pageTitle=<script>alert('xss')</script> With such links since the script is as part ...
19
votes
1answer
36k views

Chrome >50: Where can I see the negotiated cipher suite?

This is about Chrome 50 and later. When visiting an https site, where can I find the negotiated cipher suite? I know where to find this info in previous versions of Chrome but I'm not able to find it ...
19
votes
2answers
3k views

Why do Chrome extensions need access to 'all my data' and 'browsing activity'?

Often I install simple add-ons for Google Chrome. However, they almost all need what appears to me as excessive access to my data. For instance, I install an extension that allows me to click on any ...
18
votes
4answers
27k views

Remove RC4 from SSL/TLS ciphers in Chromium

Recently I started to live without RC4 within my Firefox session. Discussion about it can be found here. While it is quite easy in Firefox (Enter about:config and then rc4), I found no possibility to ...
18
votes
6answers
3k views

Is Google Chrome a more secure browser?

I was amazed that IE 8, Safari, Firefox were hacked so fast at Pwn2Own 2010. Is Chrome really so good or was it not tested? Has anyone other results of independent investigations about security of ...
18
votes
3answers
29k views

Checking domains HSTS status

The Google Chrome browser offers a quick way to check a domain's HSTS (HTTP Strict Transport Security) status via the page chrome://net-internals/#hsts (section Query domain). The query result looks ...
17
votes
2answers
7k views

Securing Google Chrome Browser against the Logjam exploit on Windows

Is there a way to fix Chrome against the Logjam TLS exploit on Windows? I have updated my Chrome to the latest version yet the https://weakdh.org/ website warns me that "web browser is vulnerable to ...
17
votes
1answer
775 views

How to verify Google sign-in screen is legit? (Linux Desktop) [duplicate]

I've installed an Electron app "Google Play Music Desktop Player" which presents a Google login screen: This is in a standalone window with no URL displayed. Although I have no reason not to trust ...
16
votes
1answer
11k views

Why would Chrome not display a padlock icon at all on an SSL site?

I have an internal website running on SSL, but when going through it in Chrome, I don't get a padlock icon at all: However, clicking it does show that the site is encrypted. There are a bunch of ...
16
votes
3answers
3k views

Why do Firefox and Chrome “leak” critical security information out of the browser and how can I stop it?

In studying SSL / TLS handshakes and encryption, I found a method that describes how to export the SSL / TLS session keys from Firefox to an user or environmental variable outside the browser, and ...
16
votes
1answer
293 views

Preventing a site from appearing in the 'Most Visited' or 'speed dial' section of a web browser

Are there any established ways of preventing a website from appearing as an icon on the 'Most Visited' / 'Speed dial' / start page of a web browser? One example of this is the tab that opens by ...
15
votes
6answers
67k views

How to prevent installation of Google Chrome extensions

How can I prevent the installation of Chrome extensions on desktop?
14
votes
3answers
143k views

HTTPS icon red and crossed out - Chrome browser

What does it actually mean when the HTTPS icon is red and crossed out in Chrome? Does this mean that the site is vulnerable to a Man in the Middle Attack? Is it safe or not?
13
votes
2answers
2k views

Google Chrome says “Your connection to example.com is encrypted using an obsolete cipher suite.”

I get following info when I click on lock icon on address bar: I have couple of questions: Q1. What are the security concerns here? Q2. Even after 'obsolete cipher suit' message, Chrome is able to ...
13
votes
1answer
18k views

Does Google Chrome protect against cross site scripting (XSS)?

In Firefox I've been using the NoScript extension to protect myself from certain kinds of malware attacks. NoScript is well known as a very powerful extension for Firefox and introduced protection ...
12
votes
2answers
2k views

How safe is it to use developer's version of the browsers [closed]

I have heard that the developer versions of browsers (chrome and firefox) are less secure than stable versions of them. Is it true? Is there any sense in using developer editions of browsers for ...
12
votes
1answer
325 views

How private is the data I type in Chrome address bar?

Sometimes, I paste some data in a Chrome tab address bar as a temporary storage. It usually happens when I want to save more then one thing in the clipboard. It's handy because I am always with Chrome ...
12
votes
1answer
1k views

Comparison between Firefox password manager and chrome password manager

As a follow up to Is saving passwords in Chrome as safe as using LastPass if you leave it signed in?, I would like to know how firefox's password manager compares, if you have a master password and ...
12
votes
2answers
2k views

Any tool for scanning vulnerabilities in browser extensions?

I am scanning browser extensions of Chrome and Firefox for vulnerabilities. Is there any tool which would help me do this?
11
votes
1answer
5k views

Why does Chrome send four browsers in the user-agent header?

I am using Chrome in linux with Version 51.0.2704.63 (64-bit). I recorded a HTTP request of Chrome and here is part of the recording: User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (...
11
votes
2answers
2k views

Why do Chrome and Firefox report a different server certificate and issuer than OpenSSL?

When I visit https://somesite.org using Chrome or Firefox and inspect the server certificate, everything looks OK to me. I see SSL Server Certificate, CN, O, OU that appears to match somesite.org ...
11
votes
1answer
3k views

Distinguish between Wi-Fi Captive portal and MitM attack

Not sure whether this should be asked in Super User or here. How does Chrome distinguish between a Wi-Fi access point intercepting with a captive portal and a man-in-the-middle attack on HTTPS? Are ...
10
votes
2answers
24k views

Obsolete cryptography (SHA1) warning although certificate uses SHA256

I ordered a certificate with SHA256 from Comodo and was wondering why Chrome shows this message: Your connection is encrypted with obsolete cryptography. The connection is encrypted using ...
10
votes
1answer
4k views

Is Vimium (Chrome extension) really safe?

I really like the Chrome extension Vimium. It significantly speeds up surfing for power users. However, when you install it, Chrome warns you because this extension injects JS code on every page you ...
10
votes
1answer
18k views

How to make Firefox ignore the X-XSS-Protection response header?

I have two questions: How can I make Firefox ignore the X-XSS-Protection header? I have a website which sends an X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it ...
10
votes
1answer
435 views

What technologies does ChromeOS use to secure saved passwords?

I have read that Chrome will use the system's native credential tools to manage saved passwords (e.g. KeyChain on OSX, libsecret on Linux/GNOME etc). Does anyone know what tools are used on ChromeOS?
9
votes
2answers
14k views

Is there any way to get Chrome 27 to trust a self-signed cert? [closed]

I'm running latest gen Chrome (27) and preparing a demo that requires using a self-signed cert to support HTTPS on a local IIS website. The cert has been created with the correct common name for the ...
9
votes
4answers
10k views

Man-in-the-middle Blue Coat proxy SSL or what?

I have just discovered that my workplace has enabled some new features in the Blue Coat network proxy. It seems like all HTTPS certificates in Chrome on Windows are being issued by this internal ...
9
votes
2answers
996 views

Why does Chrome tell me this certificate is valid when it can't be verified?

Update: Now Chrome rejects this website for me. It seems the trusting is just cached somewhere? I guess this question isn't as interesting as I thought, but it'd be nice if someone could clarify it. ...
9
votes
1answer
5k views

are chrome extensions in the Chrome store generally safe?

Should I ever be worried about installing any chrome extension from the Chrome store? A lot of the Chrome extensions I have, have the permission "Read and change all your data on the websites you ...
9
votes
2answers
9k views

My site has Certificate Transparency enabled but Chrome is still showing NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED

I have a site called www.goflyla.com and I purchased the SSL cert from RapidSSL with Certificate Transparency enabled. SSLLabs give a green line saying Certificate Transparency: Yes (certificate): ...
9
votes
1answer
7k views

Are my passwords saved in Google Chrome safe when I'm logged out?

I understand that Chrome uses the OS's password storage mechanism to protect passwords on your computer. 1 I also understand that these passwords can be (in my case, are) protected with a passphrase ...