Questions tagged [web-browser]

A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

Filter by
Sorted by
Tagged with
3
votes
1answer
91 views

How to restrict LAN addresses in a browser?

How to prevent Chrome to connect addresses from LAN to prevent CSRF attacks like this? <img src="http://192.168.0.1/some_action"> Info for other browsers is welcome here too.
1
vote
1answer
66 views

Is there any 100% transparent way to set up client side TLS certs from a web browser?

Edit #2: It seems the answer to Q#1 is "No" (which suggests I would need to look for some other solution, which is something I can do on my own, please don't spend time making suggestions ...
0
votes
0answers
27 views

When you do a search for something on a search engine do the websites that the search engine retrieves know your IP address and browser fingerprint?

Without actually clicking on those websites does the website know your ip address/ browser fingerprint?
0
votes
0answers
57 views

How do I assure that a site that I visit does not know I have been there before? [duplicate]

If I use the same machine (my PC) but with a different IP address and a different browser that I have never used to visit a site, will that site still be able to identify me? I don't understand the ...
0
votes
0answers
26 views

Are my browser's stored passwords safe when my Windows 10 User Account has no password? [closed]

From what I've learnt, most browsers which allow you to save passwords for particular forms and websites (e. g. Google Chrome and Chromium-based web-browsers), encode password based on your Windows ...
0
votes
0answers
43 views

Web Browser Forgetting Between Users

I am planning to go door-to-door and host events in which people use a computer to login to the Arizona Secretary of State website, enter sensitive information (like address, social security number, ...
0
votes
0answers
5 views

Tor Browser Logging [migrated]

Trying to troubleshoot browser crashes and would like to locate log files and also enable verbose logging. What directory would I find this in and how to increase log verbosity of the Tor Browser? ...
4
votes
2answers
170 views

Source code being injected into every website

I had a client contact me today because a website I developed (that deals with sensitive information) wasn't loading correctly on one computer on Chrome. After poking around for a while it appears to ...
2
votes
2answers
121 views

Does a professional website know that person A switches the Chrome “user” and logged into its website with another email address?

Let's say I have account A on site example.com that has a policy of strictly one account per real person. I then create a new Gmail address, use that Gmail address to open a new Chrome user (not ...
0
votes
1answer
69 views

Allowing the execution of arbitrary code in python

Let's say the user has installed a python interpreter on their machine/browser, for example, using something like https://github.com/iodide-project/pyodide. I understand not allowing someone to enter ...
0
votes
1answer
54 views

Can just clicking on a malicious link lead to hacking of my device? [duplicate]

I was not sure about it and I got some answers from internet but didn't get the logical reasoning behind it. If I just click on a malicious link it might open a new tab, or it might download something....
1
vote
1answer
98 views

Why there is a need for a master key?

According to this source about TLS, there are 3 stages (I'm over simplifying): Set up. Server client hello and select TLS version + Cipher Server Sends. The server sends Certificate = Public Key + ...
0
votes
1answer
28 views

Account switcher in browser implementation and secure design

I am trying to understand how websites implement in-browser account switcher. e.g you can login to twitter using multiple accounts. On the bottom left when you click your currently logged in account, ...
0
votes
1answer
89 views

How can I access a website without it being able to identify me as a previous visitor?

Phone is rooted Basically I want to be able to access a website without it being able to determine any of the things it dermined about me (my device, ip address etc) when I accessed it last, no matter ...
2
votes
0answers
62 views

What is the threat-model of a malicious browser-extension accessing the data of *another browser-extension* that is security-critical?

Modern password-managers are moving towards a "fully-in-the-browser" model (see: historical RCE on LastPass, and now 1Password is also moving towards 1Password X as "the future" ...
8
votes
2answers
1k views

Chrome allow insecure localhost

I have just stumbled upon what is a very helpful flag in chrome (for developers): chrome://flags/#allow-insecure-localhost The flag is described as: Allow invalid certificates for resources loaded ...
4
votes
3answers
151 views

Is there any proof in support of these basic security guidelines?

The Tech Solidarity organization provides a list of basic security guidelines, described by Jeff Atwood as ... pure gold and has been vetted by many industry professionals ... From that same ...
1
vote
1answer
45 views

Is it secure to use window.origin with postMessage?

When using postMessage it's important to define a targetOrigin to ensure we don't leak data to other sites. It's equally important to check the origin when receiving a message to prevent other sites ...
1
vote
1answer
55 views

Tab under behaviour blocking

I have recently been reading about scenarios where browser might block automatic redirects. One scenario that i came across is what chrome calls as "tab-under". When the user clicks on a ...
2
votes
2answers
77 views

Reverse tabnabbing: why not redirect the user in the new tab itself instead of the parent tab?

I have recently been reading about reverse tabnabbing, where a child window can change the url of the parent window if it has access to window.opener (which it has by default unless you explicitly ...
0
votes
0answers
28 views

Browser extension or tool to actively see what information website is requesting?

For browser fingerprinting reasons I want to know if there is there a tool that can actively display what information a website is attempting to access. I know technically the network tab from google ...
1
vote
0answers
40 views

Would Indistinguishability obfuscation make Javascript cryptography viable?

I know Javascript Cryptography is considered harmful because: Secure delivery of Javascript to browsers is a chicken-egg problem. Browser Javascript is hostile to cryptography. The "view-source&...
6
votes
2answers
140 views

If Postgres trusts localhost connections, is it dangerous to visit random websites?

If I have a locally running Postgres configured to trust all connections from localhost, does it mean any website I visit has the ability to make a localhost-to-localhost connection to Postgres with ...
0
votes
0answers
82 views

How to prevent my ISP from seeing what sites I visit without a VPN

I use opera browser, and while the built-in VPN has been working relatively well it's been preventing me from joining discord voice calls and using omegle. Is there a way to hide my activity from my ...
1
vote
1answer
62 views

Best way to learn every way I am tracked online? [closed]

Is there a course or resource for a person with basic networking skills to see all ways a website like FB or Google can track and identify users + how to spoof them and look natural? Not for malicious ...
0
votes
0answers
59 views

How to prevent browser fingerprinting accoss VM's whilst remaining natural?

I am using a couple VM's fitted with proxies and find that browser fingerprinting across VM's causes me many issues. I also have issue with the browser created inside VM leaking that I am using VM. ...
0
votes
2answers
39 views

DataURL Browser Cache Security Implications

What are the security implications that come with loading an image in dataURL format <img src="dataURL" />? After signing into my website the browser loads an image in dataURL format ...
0
votes
0answers
25 views

How can I make my extensive web surfing secure? [duplicate]

First and foremost, I'm not asking for a software recommendation. I need a direction in which I should start moving. I often need to search the internet and open many tabs in my browser. Sometimes I ...
-1
votes
2answers
141 views

Why does Pale Moon fetch remote images when loading a “file:///” HTML page?

When I order groceries, I get an e-mail receipt. I save this HTML file and save it. Then I load it in Pale Moon some other time, so that its URL is file:///C:/blablablabla/receipt.html. When I do this,...
0
votes
0answers
67 views

How is Firefox importing credentials from other browsers without the need for the admin password?

Im currently looking into the security of different browser password storing mechanisms. My main focus lies on the new Chromium based Microsoft Edge browser. As far as I can see, Chromium based ...
1
vote
4answers
144 views

Isn't Youtube supposed to forget what I did during an incognito session?

When I go into incognito session and then use Youtube, I always thought that it's like coming to the site as a totally new person. How surprising it was when one day I watched a cabaret (not a very ...
0
votes
0answers
36 views

How to easily browse through browser's image cache using autopsy?

I'm looking for a way to find images in all web browser cache folders. I can see a list of all images, and I can navigate folders. however, it is very time consuming if I have multiple data sources in ...
2
votes
1answer
204 views

Man in the middle using HTTPs downgrade to HTTP

In general browsers attempt to establish a HTTPs-Connection if possible. How would you force a browser to fallback to HTTP when somebody enters asdf.xyz in the search bar of his/her browser without ...
0
votes
1answer
59 views

Does Opera Android track me?

I used to think that this browser is safe and does not track me. Then I did little experiment - i went to specific webpage on Opera and next day I found ads for it on Facebook app. How did it happen? ...
0
votes
0answers
74 views

When do browsers block automatic redirects?

I am trying to understand various reasons where the browser would block redirects to another site. This lead me to have an understanding of why do sites have an interstitial redirect page which says ...
0
votes
0answers
57 views

XSS via Ajax request?

I'm currently honing in on my web exploitation skills and came across this JavaScript function here: Event.observe(window, 'load', function() { new Ajax.Request('/dir/dir', { method: 'post',...
26
votes
5answers
8k views

Can a website steal passwords saved in my browser?

Today I was on Steam and someone sent me a link and asked me to vote for him in some online gaming league. I clicked on it and the browser told me that this could be an unsafe link so I didn't proceed ...
1
vote
0answers
76 views

Why is web scraping software recognized as human?

I know that there are many open source projects that focus on web scraping and automation testing. The prominent ones are Puppeteer and Selenium. But these projects are not recognized as bots in ...
1
vote
0answers
57 views

My college manages my Google account, can they view my browsing history if I use a personal device on a home network while logged in?

I have found multiple sources telling me otherwise, but most are outdated by a year or two. If I am logged into my G-suite managed account on google, and search something up on a home network and ...
0
votes
0answers
23 views

How can the CSRF happen if browsers do not allow cross-origin requests by default? [duplicate]

How can the CSRF happen if browsers do not allow cross-origin requests by default? Brief CSRF overview, which is relevant for the question. CSRF is a type of attack (i.e. cross-site request forgery). ...
0
votes
0answers
28 views

Browser with flexibility for tool integration

Browsers don't allow a JavaScript to spoof/modify 'Host' header. It's a part of a browser's security. For a regular user that is a feature, for me that is a limitation in a context of my tool which ...
0
votes
1answer
96 views

CSRF Security Independent From Front-End

I'm trying to figure out if I completely understand CSRF security properly. Based on: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html In all ...
0
votes
0answers
51 views

communicate with security device from browser to encrypt/decrypt data

I would like to build a feature in my website that will store certain information. But i would like this data to be encrypted and decrypted by the user via a USB security device, such as the NitroKey. ...
11
votes
2answers
433 views

Solution to the ‘Browser Crypto Chicken-and-Egg Problem’?

From time to time, questions come up in this board concerning web applications that utilize client-side cryptography (or ‘in-browser’ cryptography), where these applications claim to be designed in ...
1
vote
1answer
135 views

Can I view a user's browser history if the history/cache has been cleared?

A client wants to track a specific employee's browsing habits. Assuming that the employee knows how to clear their browser history, is there any way to recover the history so it can be read by ...
1
vote
2answers
148 views

Open Backdoor in web browser using xss?

I am trying to learn about of xss attack and so I far, I understood that a successful attack result in the attacker capable of injecting malicious js in the victim's browser. If my understanding is ...
0
votes
1answer
77 views

What is the list of known host domains where subdomains come from different providers?

I recall that there is a list of hosting domains that are known to have subdomains from different sources, as for example wix.com and appspot.com, built into browsers. For such domains, subdomains do ...
0
votes
0answers
55 views

Passing confidential data to an IFrame

There are two different web applications Host and App which are hosted separatedly, i.e. in particular on different domains. App is not designed to be accessed directly. Rather users are expected to ...
4
votes
2answers
210 views

Does this registry entry for implementing custom protocol handlers in Windows present a security risk?

Background Some features are not yet available on the web platform and thus require cooperation with a native application in order to provide them. One method for a web application and a native ...
1
vote
1answer
149 views

“Your connection is not private” for specific website, once when opening a new tab

Like many, since March, I've been working from home and using the company's VPN to do my work. Recently, if I open a new tab in Chrome, and navigate to "news.bbc.co.uk", I got the ...

1
2 3 4 5
30