Questions tagged [chrome]
Popular web browser by Google, see chrome.google.com for more information.
83 questions
84
votes
2
answers
28k
views
Worst case scenario, what can a Chrome extension do with "Your data on all websites" and "Your tabs and browsing activity"?
Chrome extensions, and just like other browsers, appear to often get quite some extensive access to your browser data. In fact, most extensions I've installed require access to:
Your data on all ...
- 1,285
65
votes
5
answers
169k
views
Google Chrome "Your connection to website is encrypted with obsolete cryptography"
Google Chrome is showing new information in the certificate section.
Is this a big deal? If so how can I fix it on the server end?
EDIT: Thanks for the answers but I'm not skilled in cryptography so ...
- 813
159
votes
4
answers
122k
views
What exactly does it mean when Chrome reports 'no certificate transparency information was supplied by the server?'
When visiting Gmail in Chrome, if I click on the lock icon in the address bar and go to the connection tab, I receive a message 'no certificate transparency information was supplied by the server' (...
- 1,806
56
votes
5
answers
24k
views
IMG tag vulnerability
Is it safe to display images from arbitrary domains? I.e. let's say I have an image on my page:
<img src="http://badguy.com/image.gif" />
What if image.gif will return some js attack vector, ...
- 2,877
32
votes
3
answers
5k
views
Are official browser add-ons really safe?
Almost any browser addon/extension that I install on my Chrome or Firefox (be it Firebug, RESTClient, ...) warns me, saying:
It [the add-on] can:
Access your data on all website
Access ...
- 841
25
votes
2
answers
4k
views
Is there a way to make the browser remove the login-password from it's memory immediately, like Chrome seems to do on accounts.google.com?
I did some testing, and found that a memory dump of Chrome doesn't hold the password of gmail.com/Google after logging in to that site (the login happens on accounts.google.com).
(My System is ...
- 850
19
votes
5
answers
3k
views
Is Google Chrome a more secure browser?
I was amazed that IE 8, Safari, Firefox were hacked so fast at Pwn2Own 2010. Is Chrome really so good or was it not tested?
Has anyone other results of independent investigations about security of ...
- 1,292
15
votes
1
answer
12k
views
Why would Chrome not display a padlock icon at all on an SSL site?
I have an internal website running on SSL, but when going through it in Chrome, I don't get a padlock icon at all:
However, clicking it does show that the site is encrypted. There are a bunch of ...
- 411
11
votes
4
answers
12k
views
Man-in-the-middle Blue Coat proxy SSL or what?
I have just discovered that my workplace has enabled some new features in the Blue Coat network proxy. It seems like all HTTPS certificates in Chrome on Windows are being issued by this internal ...
- 123
22
votes
6
answers
16k
views
Is Chrome completely secure against Reflected XSS?
I notice that Chrome does not execute scrips that are part of the web request,
http://vulnerable_site?pageTitle=<script>alert('xss')</script>
With such links since the script is as part ...
- 305
21
votes
1
answer
25k
views
Why is secp521r1 no longer supported in Chrome, others?
Found a few issue threads, notably for Chrome (Chromium issue #478225), and the browser does appear to have dropped support for the secp521r1 curve (can test your browser using SSLLabs). There were ...
- 2,412
13
votes
1
answer
21k
views
Does Google Chrome protect against cross site scripting (XSS)?
In Firefox I've been using the NoScript extension to protect myself from certain kinds of malware attacks. NoScript is well known as a very powerful extension for Firefox and introduced protection ...
user10356
7
votes
1
answer
12k
views
How to add AltName from csr file to crt file using "openssl x509 -req"?
I'm a webdeveloper and want to test my websites locally with a self signed SSL certificate.
Everything was working great until a few days ago, when chrome started complaining about a missing AltName ...
- 231
4
votes
2
answers
1k
views
How to configure Chrome to stop external websites accessing my router?
Yet another serious router vulnerability has been disclosed: https://www.exploit-db.com/exploits/40889/
This is a command execution vulnerability through the web interface. I'm not too concerned ...
- 34.7k
3
votes
1
answer
3k
views
Did changes in Google Chrome 80 weaken cookie and password encryption?
According to Arun on StackOverflow “Starting Chrome 80 version, cookies are encrypted using the AES256-GCM algorithm, and the AES encryption key is encrypted with the DPAPI encryption system, and the ...
user115400
143
votes
9
answers
99k
views
How secure is Chrome storing a password?
Whenever I enter a login into a new site, Chrome asks me if it should store the login details. I used to believe this was fairly secure. If someone found my computer unlocked, they could get past the ...
- 1,383
43
votes
1
answer
76k
views
Chrome >50: Where can I see the negotiated cipher suite?
This is about Chrome 50 and later. When visiting an https site, where can I find the negotiated cipher suite?
I know where to find this info in previous versions of Chrome but I'm not able to find it ...
- 1,438
34
votes
3
answers
10k
views
Does "Not Secure" mean HTTP?
I work for a corporation and we are all given a kind of employee login system whose URL goes like this in the image below. (Sorry, I cannot disclose the full URL.)
I thought "Not Secure" had ...
- 728
28
votes
4
answers
21k
views
What Trusted Root Certification Authorities should I trust? [duplicate]
After two recent Slashdot articles (#1 #2) about questionable Root Certificates installed on machines, I decided to take a closer look at what I have installed on my machines.
(I use current versions ...
- 383
24
votes
2
answers
4k
views
Why do Chrome extensions need access to 'all my data' and 'browsing activity'?
Often I install simple add-ons for Google Chrome. However, they almost all need what appears to me as excessive access to my data. For instance, I install an extension that allows me to click on any ...
user5672
22
votes
5
answers
19k
views
Does Google collect and store data about activity done in Incognito mode?
Suppose that someone browses non-Youtube videos (like on Vimeo) in Google Chrome's Incognito mode.
Does Google collect and store any data about this activity ("watched videos on Vimeo" ...
- 339
20
votes
2
answers
3k
views
Can a malicious add-on access internet history and other sensitive info in Chrome/Firefox?
How does Chrome/Firefox make sure add-ons are safe? Do they have any protection against a malicious add-on?
How much access can add-ons have? Can they access internet history or maybe even cookies ...
- 363
19
votes
3
answers
5k
views
Why do Firefox and Chrome "leak" critical security information out of the browser and how can I stop it?
In studying SSL / TLS handshakes and encryption, I found a method that describes how to export the SSL / TLS session keys from Firefox to an user or environmental variable outside the browser, and ...
- 2,052
18
votes
4
answers
29k
views
Remove RC4 from SSL/TLS ciphers in Chromium
Recently I started to live without RC4 within my Firefox session. Discussion about it can be found here. While it is quite easy in Firefox (Enter about:config and then rc4), I found no possibility to ...
- 1,701
12
votes
1
answer
9k
views
TLS 39 month certificate limit and Chrome's NET::ERR_CERT_VALIDITY_TOO_LONG error
Late last year the CA/Browser Forum decided to limit the maximum valid term of TLS/SSL certificates issued after 1 April 2015. After this time, as the official guidelines put it..
CAs SHALL NOT ...
- 223
11
votes
2
answers
27k
views
Obsolete cryptography (SHA1) warning although certificate uses SHA256
I ordered a certificate with SHA256 from Comodo and was wondering why Chrome shows this message:
Your connection is encrypted with obsolete cryptography.
The connection is encrypted using AES_256_CBC,...
- 223
10
votes
2
answers
6k
views
Did google chrome kill public key pinning?
I've read many articles talking about google chrome killing public key pinning in Chrome 67 (May 2018). See here, here, and here.
However, I haven't found any information about whether or not they ...
- 31.7k
9
votes
3
answers
35k
views
Username and password stored under form data in Chrome Dev Tools
When I record the network tab in Chrome Developer Tools when logging in to my site I find that the username and password are stored in plaintext under form data.
You can also find it in Safari, ...
- 213
6
votes
3
answers
13k
views
Is QUIC (Quick UDP Internet Connections) safe to allow through firewall?
Our firewall currently blocks QUIC (UDP 443) traffic which seems to be enabled by default in Google Chrome. Is it safe to allow QUIC or should I wait until it is implemented in all the major browsers?
...
- 81
6
votes
2
answers
6k
views
Password management in Firefox, Chrome and Safari
I just read a couple of very interesting discussions on Chrome password security strategy.
Chrome’s insane password security strategy
Showing stored passwords - Tim Berners-Lee
The following is how ...
- 161
5
votes
1
answer
4k
views
Different SSL states as seen by Safari, Chrome and Firefox
Today, I visited some sites of the German DHL group.
While Chrome and Safari complain about an invalid certificate of
Firefox accepts it.
Which one is right, which one is wrong?
Which decision ...
- 315
4
votes
3
answers
436
views
Could Google Chrome's lack of a download confirmation dialog be a security vulnerability?
Suppose the user is playing a game like flappy bird that requires constant tapping in the lower left area of the screen (where the downloaded file needs to be clicked).
Then while the user is ...
- 487
4
votes
2
answers
2k
views
How do I protect my passwords from WebBrowserPassView?
I just got shocked with what can be achieved with WebBrowserPassView. It basically shows every password I've saved in my browser (Chrome).
I guess other users on my PC could get my passwords that ...
- 141
4
votes
1
answer
18k
views
Is bit.ly a malware distributor?
I clicked this link
http://girlsguidetosurvival.wordpress.com/
Chrome gave me this warning -
Attackers currently on bit.ly might attempt to install dangerous
programs on your computer that ...
- 173
4
votes
3
answers
20k
views
Chrome showing cryptography as 'obsolete' [duplicate]
Similar to this question, Chrome is showing the connection cryptography as obsolete. Opera, IE and Firefox seem perfectly fine with the connection.
My guess would be the message authentication is ...
- 157
3
votes
1
answer
18k
views
How to force browser to trust a self-signed cert
In our Intranet. we have a site (https://site1) configured with SSL using a generated certificate for a different site URL (https://site2).
Chrome/FF/IE/Edge browsers are showing invalid certificate ...
- 151
1
vote
1
answer
835
views
Chrome + EMET= How Strong Realistic Protection Against Browser-Based Threats?
tl;dr: How secure is a combination of a sort-of hardened Google Chrome + Microsoft Enhanced Mitigation Experience Toolkit 5.1 against browser-based threats that I do not expect to be highly ...
- 2,815
31
votes
1
answer
9k
views
"google.com" is not HSTS protected?
Issue:
Oftentimes people enter google.com directly in the browser's address bar without including either the http:// or https:// prefixes.
Using Chrome DevTools on a fresh incognito session, I ran the ...
- 704
20
votes
1
answer
3k
views
How to verify Google sign-in screen is legit? (Linux Desktop) [duplicate]
I've installed an Electron app "Google Play Music Desktop Player" which presents a Google login screen:
This is in a standalone window with no URL displayed. Although I have no reason not to trust ...
- 303
18
votes
2
answers
8k
views
Securing Google Chrome Browser against the Logjam exploit on Windows
Is there a way to fix Chrome against the Logjam TLS exploit on Windows? I have updated my Chrome to the latest version yet the https://weakdh.org/ website warns me that "web browser is vulnerable to ...
- 1,023
13
votes
2
answers
4k
views
Are X.509 nameConstraints on certificates supported on OS X?
I have the following "chain" of certificates on a test machine right now:
A self-signed CA cert, in my Keychain and trusted & trusted by Firefox.
A CA cert with with the following,
X509v3 Name ...
- 1,096
11
votes
1
answer
1k
views
Danger of browser extension without any permissions?
Assuming that an extension for Firefox or Chrome does not request any WebExtensions permission, what harm could this extension do?
Or put another way: What (potentially malicious) actions can an ...
- 29.8k
10
votes
1
answer
6k
views
are chrome extensions in the Chrome store generally safe?
Should I ever be worried about installing any chrome extension from the Chrome store?
A lot of the Chrome extensions I have, have the permission "Read and change all your data on the websites you ...
- 1,590
10
votes
1
answer
3k
views
How do I securely embed an <img> tag using a user-given URL?
If I hypothetically wanted to allow users to use an avatar from an arbitrary URL like this:
<img class="avatar" src="{user input}" />
There are many problems that I can think of:
There are ...
- 203
10
votes
1
answer
2k
views
How do I check the code of a Chrome extension to make sure it's not stealing my info?
I've been reading more and more about just how much access browser extensions can have to your data. This is a little unsettling, so I'm curious if there is a way to Vet these extensions and make sure ...
- 1,771
10
votes
2
answers
173k
views
What is s3.amazonaws.com, and why is Chrome blocking it?
Lately, whenever I click on a download link in Google Chrome, it redirects to another link starting with s3.amazonaws.com, which in turn gets blocked either by Chrome or by my Antivirus (Comodo ...
- 205
9
votes
3
answers
17k
views
Chrome does not show green bar with EV SSL but firefox and IE does
I just installed a EV SSL certificate on my server. It has been done correctly and is working, the issue is that Chrome does not show the company name in the green address bar, just shows the green ...
- 91
9
votes
2
answers
10k
views
My site has Certificate Transparency enabled but Chrome is still showing NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED
I have a site called www.goflyla.com and I purchased the SSL cert from RapidSSL with Certificate Transparency enabled.
SSLLabs give a green line saying Certificate Transparency: Yes (certificate):
...
- 91
8
votes
3
answers
2k
views
Browser setups to stay safe from malware and unwanted stuff
I have to set up a browser to surf the internet. I'm trying to stay safe from malware as much as possible. (I already know that there's no way to stay 100% safe.)
My idea is to use Firefox with these ...
- 83
8
votes
4
answers
1k
views
What are the effects of the Chrome Web Developer extension hijack?
Today, the owner of the rather popular Web Developer toolbar noticed it had been hijacked and replaced with a malicious version. He disabled it, but the malicious version (diff) had been in the wild ...
- 2,993