Questions tagged [web-browser]

A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

Filter by
Sorted by
Tagged with
0
votes
0answers
33 views

How safe is the built in browser on the iOS Facebook app?

There is no option in the iOS Facebook app to open URLs in an external browser by default (although you can open a link, and then choose to open it in Safari). How safe (mainly from a privacy ...
0
votes
0answers
60 views

Are web worker / service worker secure environments to store a password, credit card information, access tokens?

If there is a case where I wish to store sensitive data like a password, credit card information, or access tokens: Are web workers / service workers a secure environment, where such data can not be ...
0
votes
1answer
91 views

Why does Chrome display “Managed by Organisation”? [closed]

My wife inadvertently clicked on a flash player update and suddenly my chrome browser displays that it is being managed by an Organisation. I tried deleting chrome and reinstalling it but nothing ...
0
votes
0answers
49 views

Can someone explain the 'IE No Open' X-Download-Options Header, as enforced by Helmet.js?

I've been preparing to deploy an Express server using Helmet.js for some added security. I've been reading through their docs to make sure I understand what I am doing here, and I don't understand one ...
1
vote
0answers
55 views

Why are DNS prefetch requests sent in clear text with DNS over HTTPS enabled?

I am trying to understand how DNS-over-HTTPS (DoH) works in both Chrome and Firefox browsers. To do so, I have enabled DoH on each browser and set the DNS provider to Cloudflare DNS servers (1.1.1.1 ...
0
votes
0answers
60 views

Clear Browser Cache of Certificates Used for Authentication

We are using cert based authentication where the client sends a cert to the server, which is validated for authentication for a web application. This all works well. The problem happens when the user ...
-1
votes
1answer
50 views

LinkedIn connection marked unsafe

From time to time my LinkedIn connection gets marked as unsafe: no green lock next to the URL. First, I believed this was a browser issue, but after I switched to another browser, the warning did not ...
0
votes
1answer
41 views

Is it possible for a website to get information about you through its upload feature?

Reddit has a new image upload feature that takes a very long time to work after you click submit-- as long as 30 seconds. It isn't caused by the upload itself; that happens very quickly. I don't know ...
2
votes
1answer
44 views

Is possible to implement a Web Cryptography API custom provider?

I'm reading some basic info about Web Cryptography API and I'm wondering if is possible to implement some crypto provider (C/C++ library or something) with some extra algorithms or is mandatory to use ...
1
vote
1answer
66 views

Which approach is technically more effective to hinder user tracking - fingerprint generalization or randomization?

Tor's approach to countering fingerprinting is to make as many users "appear the same" as possible. Let us call this "generalization". While Brave tries to randomize all fingerprints of each and every ...
0
votes
0answers
36 views

Restricting website usage for Google Maps API doesn't prevent it from being used in the browser?

Say I've restricted my Google Maps API key to the website example.com/*. This would mean that no other website domains could use my API key to make requests to maps.googleapis.com. However, using the ...
0
votes
0answers
35 views

Taking advantage of subdomains for refresh token rotation in SPAs

Say I have three components in a system: An identity service, hosted at identity.mydomain.com A single page application, served from app.mydomain.com An API, protected by requiring a bearer token ...
0
votes
1answer
44 views

Credential theft by browser conferencing software?

While using the webex conference software, I noticed that simply pressing a "share content" button allows me to share my full screen. There was no security confirmation from my webbrowser (chrome): I ...
0
votes
0answers
86 views

Chrome extension differences: Urban Shield VS Urban Free VPN proxy Unblocker

What's the difference between these two Chrome extensions, which provide VPN functionality for browsing via Chrome: Urban Shield: https://chrome.google.com/webstore/detail/urban-shield/...
1
vote
1answer
37 views

Why did browser authors not make 127.0.0.1/localhost-hosted webpages skip the referrer?

For a long time, I was so convinced that 127.0.0.1/localhost-hosted webpages, that is, with URLs such as: http://127.0.0.1/MySecretControlPanel/sensitive.php?stuff=goes&here=dude ... did not ...
0
votes
0answers
34 views

Domain Joined computer doesn't browser properly with any website with Let's Encrypt CA cert

Navigating to any website with Let's Encrypt CA cert and even after enabling the HTTPS Everywhere addon, I'm getting "Your connection is not private". Getting this error from all the browser except ...
10
votes
3answers
242 views

Risks of Long-life Session

Most "big" websites seem to have enormous sessions. From looking through the cookies, Stack Exchange seems to have a one-week rolling session, GitHub has 45 days, and Gmail seems to have a never-...
1
vote
3answers
105 views

I entered my password manager password in the browser URL field [duplicate]

I saw various questions on a similar note but not quite the same as my situation: I entered my password manager's password into the browser URL bar and hit enter. Has this breached the confidentiality ...
0
votes
1answer
64 views

Playing a shared video file or viewing a pdf file in “incognito/private mode”

I know how incognito/private tab works. But I'm not sure private mode works as expected in this situation: If someone uses Chrome "incognito/private mode" on Android device and plays a video file or ...
1
vote
1answer
40 views

Do browsers still send cookies if I choose to visit an unsafe site warned by browsers?

For example, assume I get a NET::ERR_CERT_AUTHORITY_INVALID warning in Chrome, when visiting a website. If I still choose to visit that site, do cookies still get sent as usual (when the site is safe, ...
1
vote
3answers
104 views

Username in browser history (url) - is this a security problem?

We have a client complaining that there is PII in the browser history (as in the persistent history you get to through your browser's menu - Ctrl + H in Chrome). For example, the URL for editing a ...
1
vote
1answer
94 views

Encryption and decryption in the browser on the client's side – is it safe?

There is a possibility to download the file with one’s PII from the dedicated web server. The file might be decrypted by filling the two factors. These two factors are delivered via email and SMS. The ...
0
votes
1answer
49 views

How do I restrict network access to websites using a monitoring system?

I am making a Java Project a LAB MONITORING SYSTEM for my University practical exams. Where a teacher or admin can monitor some selected computers and can give permissions to what the user at that ...
2
votes
1answer
97 views

URL Contains Sensitive Data - Alternative Besides Switching To Post?

One of my company's clients recently produced an application security assessment report, noting a list of violations based on OWASP's top 10 list of web application security risks. One of the ...
2
votes
1answer
73 views

What measures can be taken to make a site safe again after a hostile service worker is installed in users' browsers?

So my understanding of Service Workers is that once installed they grant you full control over requests to a domain. If an attacker managed to include their service worker in your site, then for ...
0
votes
0answers
72 views

How to bypass origin based csrf protection?

I'm trying to do some csrf attack test on a site. I found that the site protect itself from csrf by checking the http Origin header. But I guess maybe under some conditions I can bypass the ...
0
votes
0answers
43 views

What are the various defense mechanisms against audio fingerprinting

L. Cuccovillo in his paper Audio tampering detection via microphone classification talks about identification of the uniqueness in the output generated by the microphones which can act as a ...
1
vote
1answer
123 views

How to store private keys in browsers after Apple's decision to wipe script-writeable storage?

We have a web application that puts a private key in LocalStorage, which enables users to sign off certain messages. It's been working fine until today we saw this announcement from Apple. The TLDR; ...
0
votes
2answers
66 views

Saving authorization token in browser [duplicate]

I have a REST API which returns an auth token when the user is logged in successfully. This token needs to be sent in different routes for authorisation. This is working fine is my android app. But I ...
0
votes
0answers
359 views

Can my employer see my browsing history with work account on my personal device

I was using Edge on my personal device at home browsing stuff and realised I was logged in on Bing.com with my Microsoft work account. I cleared my browser's browsing history and also Bing's browsing ...
4
votes
1answer
196 views

Is there any way to access the contents of a cross domain iframe

I found that a subdomain of a site leaks all cookies of the site due to improper error handling. Now, I found that this site does not have X-Frame Options Header in it. So, I put this subdomain in the ...
0
votes
1answer
100 views

Flash Vulnerabilities

What type of risks do I expose myself to by enabling flash in the browser? Web developers or online game developers who can use those vulnerabilities to crash my computer or exploit it by downloading ...
0
votes
0answers
28 views

how this default Session ID can be malicious or cause unintended results in application

I was looking the docs on what damages can be done by hackers if default Session ID is revealed in web application.
0
votes
1answer
70 views

How can i cause a redirect in browser?

I'm able to edit a parameter which is then reflected inside a link. I'd like to know how and if it's possible to cause a redirect. In shorts when i edit the parameter example like this example=/test....
0
votes
0answers
42 views

Are browsers vulnerable to Authorization Code Interception Attacks?

RFC7636 states "The operating systems must allow a custom URI scheme to be registered by multiple applications." Are web apps vulnerable to this attack? Could a web app link open a malicious app via a ...
0
votes
1answer
70 views

How do browsers detect authentication type?

To elaborate, HTTP basic auth is pretty straightforward - we can skip that. Auth with client certs is cumbersome and unpopular - skip that too. What I am really interested in is: With form-based auth,...
0
votes
0answers
27 views

How does a web browser obtain the public key of a certificate author? [duplicate]

As far as I know, when a web browser verifies the signature in a SSL certificate, it uses the public key of the certificate author (CA) which has signed the certificate. Does the web browser contacts ...
-2
votes
2answers
123 views

How will disabling location share from browser prevent website from obtaining my IP and locating me?

I am a bit confused of how does the "sharing your location" feature works in browsers. Assume I am using Chrome, I have the following questions: When a website prompt the pop-up request "this website ...
0
votes
1answer
103 views

How does a web client check the signing authority of a server certificate? [duplicate]

In HTTP The Definitive Guide When you establish a secure web transaction through HTTPS, modern browsers automatically fetch the digital certificate for the server being connected to. If the ...
0
votes
1answer
109 views

Youtube/Firefox access to my history

I recently noticed something weird. From time to time I watch on YouTube (Firefox) something political. In my case 'lastweektonight'(left) and 'StevenCrowder'(right), (because it is fun to see, where ...
0
votes
2answers
139 views

index.html integrity

Is it possible to make browsers verify that index.html matches some checksum? Context: With subresource integrity, you can specify SHA hashes for URLs, so that you know that you are getting the ...
2
votes
1answer
114 views

Is this sufficient to verify a website's domain?

I'm building a browser extension that will run some javascript, which contains some sensitive information (essentially injecting authentication info). Therefore I want to make sure it only executes it ...
2
votes
2answers
146 views

using NoScript - what approach to use with randomnly named CDN scripts?

I ran across this on namecheap.com. This question isn't about namecheap.com itself, which I have no problem trusting. Rather, what approach do you recommend in dealing with CDN scripts that have ...
0
votes
2answers
99 views

Why not sandbox websites instead of using Same-Origin-Policy?

Why do Browsers implement a Same-Origin-Policy (SOP) to prevent open websites in the browser from executing scripts that may access / modify data of other open websites in the used browser? Another ...
0
votes
0answers
79 views

How can I access a website without it being able to determine any information about my device, network or location?

Basically I want to be able to access a website without it being able to determine any of the things it dermined about me (my device, location, connection etc) when I accessed it last, no matter how ...
1
vote
0answers
26 views

SSO and browser vs. server

We've got implementations in a browser-based system right now that does both SAML and OpenID-connect login support, but does them differently and was looking for advice on the risks. Our SAML ...
0
votes
0answers
158 views

How safe is using private tor obfs4 bridges?

If you live in an oppressed country like China etc. then you must use tor bridges but if all the ISPs blocked all tor bridges (public ones) then you need to use private bridges which are not ...
0
votes
1answer
76 views

What attacks can be done from a “sketchy” internet site

I've heard that tabs in modern web browsers are fairly well sandboxed, so what kind of attacks could a malicious site do to your computer and/or web browser assuming you don't do anything obviously ...
-1
votes
1answer
226 views

Can WebAssembly execution be disabled in browsers?

I've recently found out about this new technology, which recently became a World Wide Web Consortium recommendation and also that now almost all main browsers support it and it is enabled by default, ...
2
votes
2answers
354 views

“Tor Profile” folder in Brave Browser cache

I am using Brave Browser Version 1.0.0 Chromium: 78.0.3904.97 (Official Build) (64-bit) on Ubuntu 18.04. The browser has an option, open new private window with Tor . When looking into cache files ...

1
2 3 4 5
29