Questions tagged [web-browser]

A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

Filter by
Sorted by
Tagged with
0
votes
1answer
57 views

How can I protect browser cached files to be accessed in a case of a stolen hard drive?

For the usual reasons we want to cache certain resources browser side, e.g. list of products bought in the past. Context is a web application, accessed via the internet. This list is confidential in ...
0
votes
0answers
82 views

Is ProtonMail implemented a mechanism to prevent cookies stealing?

I want to check if I can steal my own ProtonMail cookies. I connect to my account, I delete the cookie named AUTH-x12334xxxaazzzrf6567788ddd (cookie name is randomized name). I refresh the page and as ...
0
votes
0answers
74 views

Can Tor browser protect me from being found out? [duplicate]

I am using my computer, but am connected to my work's WiFi. Can my company see what websites I visit when am using Tor browser?
4
votes
1answer
168 views

Is Firefox's new JavaScript support within PDF files a security concern?

Historically, we have learned that many security vulnerabilities and exploits have resulted from allowing document files to contain executable code, whether it be JavaScript, VBScript, another ...
0
votes
1answer
59 views

How do applications which are integrated using a javascript client side sdk, secure their data or disallow spam?

Take an example of google maps. google maps provides a javascript client SDK, which means any web app running javascript can access the google maps sdk. You need to use an API_KEY so that google can ...
0
votes
0answers
52 views

XSS attack being blocked by the browser

I'm trying to validate / test and XSS attack; however when I navigate to the page, the browser (tried on Chrome and Edge) tells me: A parser-blocking, cross site (i.e. different eTLD+1) script, is ...
0
votes
2answers
80 views

Local IndexedDB in Browser - is it really a security risk?

We have a web application that stores cached information in browser (both is firefox and chrome). When we subjected it to Penetration Testing, a finding was filed saying that "Senstive Data such ...
1
vote
0answers
48 views

Facebook retargeting pixel

Given a commercial website buy.com and a user with a Facebook account in facebook.com, the user has third-party cookies disabled in the browser. If a user is logged in their Facebook account and ...
0
votes
1answer
51 views

Can display a GIF in <img> tag causing Client-side DOS

SVG image can be used in DOS user browser with billion laugh attack. Can we do the same with other image types? especially GIF? Thanks everyone.
0
votes
1answer
44 views

IMAP credentials in WEB (browser) app - how to use securely

I need to send and check email (via IMAP email servers) from my web app. Storing credentials on server seems like problem as they are almost always plain text. So if I store them in client browser's ...
2
votes
1answer
86 views

Is an XSS attack possible under these constraints?

The output is: <img src="http://example.com/[input]" oncontextmenu="openUrl('http://example.com/[input]')"> Where [input] is the user input, which is sanitised through this ...
0
votes
1answer
68 views

Google Chrome, the best bet for online privacy? [closed]

You may think I'm crazy, that's why I'm here to ask. I read this page which went over the privacy and security of many if not all browsers. From his reporting, and my own logic, that the government ...
0
votes
0answers
63 views

Global variables accessible to other websites opened in same tab

Today I found a security issue with Chrome (or maybe other browsers I haven't tested yet). What happens is that once you open a site and then open another site in the same tab, the previous site's ...
1
vote
0answers
36 views

Browser session storage

Is it some secure way to store private keys in session storage? or is there any place to store that info securely?
0
votes
0answers
117 views

Can a hacker hack my phone by not installing anything on my device?

I know that a device can be compromised by a drive-by download. But could an attacker access my device without installing any malicious app? Can he access my camera by just executing a malicious ...
0
votes
0answers
28 views

Can my school see my browsing history while on campus? [duplicate]

I'm a bit paranoid right now about what my school can and can't see on my device. My school has a BYOD policy which means that I bring my own device to work. I am logged in using my personal account ...
1
vote
0answers
92 views

Can someone turn my browser into a RDP with a keylogger? [closed]

I got an email the other day telling me that when I visited a website, someone installed malware in the website with which he was able to use my browser as an RDP. Kinda paranoid right now.
0
votes
1answer
87 views

Can you get virus from previewing email attachments in Gmail?

If an email attachment such as .docx, jpeg, .xls, .pdf, etc. contains virus/malware and if I open it for preview (not opening it in Google Docs or downloading it and opening it) then can I get ...
0
votes
1answer
94 views

Is there a way to check if my site visitor has visited another site?

I want to know if the current visitor has already visited a specific site. The site is owned by someone else and is on a different domain. Is there a way?
2
votes
1answer
55 views

What happens if multiple Strict-Transport-Security headers are set in the HTTP response?

If multiple Strict-Transport-Security headers are set with different settings (e.g. different max-age values), how will the browser behave? Does the browser just follow one of them, or simply error ...
0
votes
1answer
50 views

Storing Client Data for next page?

I have a little project for authentication and I need to store an encryption key on website B which I get from the server on website A, but the server from website B should not be able to read it. Is ...
0
votes
0answers
77 views

Get HLS decryption key from browser

How can I get decryption key for AES-128 encrypted HLS stream. In the m3u8 file, the URI for key leads to a file which is of 48 bytes which is encrypted. The stream is played by browser so it must ...
0
votes
0answers
51 views

Can I skip “if” statement with chrome debugger or another javascript debugger?

I see this code in a bug bounty program The code: <!DOCTYPE html> <html> ... </html> <script> if(window.location.pathname === '/' || window.location.pathname.includes('.html')){...
0
votes
2answers
200 views

Since when does a browser have to get permission to display a web page a particular way?

From Yahoo News with an embedded TikTok posting: "To protect your security, www.tiktok.com will not allow Firefox to display the page if another site has embedded it. To see this page, you need ...
2
votes
1answer
65 views

I discovered a Client Side Template Injection (CSTI), and after?

As part of a bounty bug, I discovered a Client Side Template Injection (CSTI). I would like to create more "impressive" payload to increase the risk of the vulnerability. The framework ...
1
vote
0answers
98 views

How can I best obfuscate surveillance against my browser? [duplicate]

I mostly use the Tails browser, but I also use Firefox in Fedora with several add-ons such as TrackMeNot, HTTPS Everywhere, uBlock Origin, NoScript, and Fingerprint Detector. I would like to obfuscate ...
1
vote
1answer
121 views

Are CryptoKey Objects stored in IndexedDB stored in Plain Text on the users machine?

I'm considering storing a sysmetric encryption key in the form of a CyptoKey Object with extractable set to false in IndexedDB and I was wandering whether this is safe or not. The questions that I ...
2
votes
1answer
102 views

Wayback machine downloading a file called default.exe?

When I look up a site on wayback machine, I click through a couple of links on the site, and then instead of loading the page, it downloads a file called "default.exe". Since I was expecting ...
2
votes
0answers
73 views

Is the HTTPS lock sign displayed if reasources are loaded from insecure sites?

We all know that if you visit a secure site which uses https, all modern browsers will show a padlock sign if it has a CA certified certificate. My questions are: Suppose there is an image loaded in ...
0
votes
2answers
131 views

If an IP address is known, can all of its browsing activity be viewed by an outsider? [closed]

Internet service providers (ISP) can choose to have full information on the browsing activity of one of its subscribers. Can an outsider, who is not the ISP, but who simply knows someone's IP address, ...
1
vote
0answers
41 views

How am I supposed to trust binaries “submitted by anyone”? [duplicate]

I finally found a Chromium fork which appears to have made a serious effort to remove all the Google cancer. Sadly, I see this: https://ungoogled-software.github.io/ungoogled-chromium-binaries/ ...
64
votes
1answer
9k views

Why don't video conferencing web applications ask permission for screen sharing?

I am using Chrome 87 with Jitsi Meet 2.0, but I have noticed this behavior too with other setups. When I first enter a room, Chrome asks for the following permissions: Even if I click "Block&...
0
votes
0answers
65 views

How long does a HiddenEye keylogger script last in an Android browser?

I recently clicked on a phishing link and entered my credentials but then I changed the password. I believe the phisher used HiddenEye with a keylogger script in the webpage so how long can he capture ...
0
votes
2answers
81 views

Does an effective Content Security Policy mitigate a universal cross-site scripting vulnerability?

I am doing some background research into types of XSS and prevention and as I understand it there is not much any application can do against a universal XSS in a plugin or browser. A last line of ...
0
votes
0answers
30 views

Content from external sources still visible after applying CSP

I've added CSP layer of security in my application. Now in chrome's web inspector, I can see CSP header in every web service response: Content-Security-Policy: default-src 'self' *.intranet.myhost.com ...
4
votes
1answer
161 views

How to restrict LAN addresses in a browser?

How to prevent Chrome to connect addresses from LAN to prevent CSRF attacks like this? <img src="http://192.168.0.1/some_action"> Info for other browsers is welcome here too.
1
vote
1answer
72 views

Is there any 100% transparent way to set up client side TLS certs from a web browser?

Edit #2: It seems the answer to Q#1 is "No" (which suggests I would need to look for some other solution, which is something I can do on my own, please don't spend time making suggestions ...
0
votes
0answers
32 views

When you do a search for something on a search engine do the websites that the search engine retrieves know your IP address and browser fingerprint?

Without actually clicking on those websites does the website know your ip address/ browser fingerprint?
0
votes
0answers
59 views

How do I assure that a site that I visit does not know I have been there before? [duplicate]

If I use the same machine (my PC) but with a different IP address and a different browser that I have never used to visit a site, will that site still be able to identify me? I don't understand the ...
0
votes
0answers
47 views

Web Browser Forgetting Between Users

I am planning to go door-to-door and host events in which people use a computer to login to the Arizona Secretary of State website, enter sensitive information (like address, social security number, ...
3
votes
2answers
239 views

Source code being injected into every website

I had a client contact me today because a website I developed (that deals with sensitive information) wasn't loading correctly on one computer on Chrome. After poking around for a while it appears to ...
1
vote
2answers
130 views

Does a professional website know that person A switches the Chrome “user” and logged into its website with another email address?

Let's say I have account A on site example.com that has a policy of strictly one account per real person. I then create a new Gmail address, use that Gmail address to open a new Chrome user (not ...
0
votes
1answer
79 views

Allowing the execution of arbitrary code in python

Let's say the user has installed a python interpreter on their machine/browser, for example, using something like https://github.com/iodide-project/pyodide. I understand not allowing someone to enter ...
0
votes
1answer
64 views

Can just clicking on a malicious link lead to hacking of my device? [duplicate]

I was not sure about it and I got some answers from internet but didn't get the logical reasoning behind it. If I just click on a malicious link it might open a new tab, or it might download something....
1
vote
1answer
107 views

Why there is a need for a master key?

According to this source about TLS, there are 3 stages (I'm over simplifying): Set up. Server client hello and select TLS version + Cipher Server Sends. The server sends Certificate = Public Key + ...
0
votes
1answer
34 views

Account switcher in browser implementation and secure design

I am trying to understand how websites implement in-browser account switcher. e.g you can login to twitter using multiple accounts. On the bottom left when you click your currently logged in account, ...
0
votes
1answer
95 views

How can I access a website without it being able to identify me as a previous visitor?

Phone is rooted Basically I want to be able to access a website without it being able to determine any of the things it dermined about me (my device, ip address etc) when I accessed it last, no matter ...
2
votes
0answers
70 views

What is the threat-model of a malicious browser-extension accessing the data of *another browser-extension* that is security-critical?

Modern password-managers are moving towards a "fully-in-the-browser" model (see: historical RCE on LastPass, and now 1Password is also moving towards 1Password X as "the future" ...
9
votes
2answers
5k views

Chrome allow insecure localhost

I have just stumbled upon what is a very helpful flag in chrome (for developers): chrome://flags/#allow-insecure-localhost The flag is described as: Allow invalid certificates for resources loaded ...
4
votes
3answers
158 views

Is there any proof in support of these basic security guidelines?

The Tech Solidarity organization provides a list of basic security guidelines, described by Jeff Atwood as ... pure gold and has been vetted by many industry professionals ... From that same ...

1
2 3 4 5
31