Questions tagged [web-browser]

A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

Filter by
Sorted by
Tagged with
0
votes
0answers
40 views

Prevent browsers from providing time zone info to webservers

I use Cloudflare's Warp VPN all the time for regular browsing and yet I recently found that Patreon can tell the country I'm physically located in. It baffled me how it could do so; Patreon could tell ...
0
votes
1answer
50 views

What can happen when you click on a bad link? [duplicate]

I sleepily clicked on this bad link yesterday (DONT CLICK Unless you know what you're doing: https://6to.me/idsoni7kjv with a "?fbclid=" param - presumably identifying me) I'm wondering how ...
0
votes
1answer
28 views

How can 2FA help prevent formjacking?

This article by Avira (part of NortonLifeLock) claims that 2FA (2-Factor Authentication) may be sufficient to protect against formjacking: Enable 2-Factor Authentication: Create strong and complex ...
27
votes
4answers
9k views

Do websites know which previous website I visited?

Suppose I am using a web browser to look at example.com. Now, from the same web browser tab, I enter example.org in the address bar and go to that completely different website operated by another ...
0
votes
2answers
144 views

Virtual Yubikey [closed]

If reports are to be believed, Google and others are starting to force 2FA on user accounts starting late ~2021: https://www.theverge.com/2021/10/5/22710421/google-security-2fa-inactive-account-...
-1
votes
2answers
75 views

Keep encryption password in javascript file hidden from browser debug tool

I'm sort of new to Frontend programming. I'm trying to build a PWA, it stores data (client data i.e: address, name, phones) to be ready in an offline state, for which I'm using localForage. I've ...
4
votes
1answer
261 views

Does using view page source on a possibly malicious site carry any real risks?

As far as I know, View page source does not execute any JavaScript, but is that good enough? Could there in theory be any vulnerabilities in the HTML parser or something similar? Have there been any ...
1
vote
0answers
65 views

GPU vs integrated graphics hardware, browser canvas fingerprinting, and multi- or dual-boot systems

My goal is to ensure that two operating systems installed side-by-side on the same device are unable to return the same canvas fingerprint, when a modern browser is allowed to run javascript without ...
1
vote
3answers
171 views

Does SOP prevent a class of CSRF attacks?

Just want to settle a debate I'm having with someone. Suppose there is no SOP. Via an XSS exploit, code can run on website A.com and submit an XHR request to B.com. Suppose B.com stores an auth token ...
0
votes
1answer
53 views

How to resist JA3 fingerprinting while browsing using common browsers (e.g. Firefox, Chrome, etc)

Background. Context. I use Firefox, Google Chrome, or Chromium on Linux. Question. How to have my browser resist the JA3 fingerprint, so that sites don't identify me by it? Thoughts. I guess it may ...
0
votes
1answer
78 views

How to detect whether request to a URL from a system is made through a browser or through a software/malware

I am using FortiAnalyzer-VM64 v6.4.2 GA build2122. Many requests are logged in my firewall/UTM log that are to malicious websites. Although these requests are blocked by the UTM, the problem is that I ...
0
votes
3answers
171 views

Github knows where I have used my password

How can the operator of Github detect whether or not my password applied on their website is commonly used by me on other websites? I have received a warning message from them forcing me to change my ...
1
vote
1answer
57 views

Does enabling SharedArrayBuffers via service worker headers create Spectre vulnerability?

In browsers, use of SharedArrayBuffer is restricted to sites with the following HTTP headers because otherwise it exposes vulnerabilities to Spectre and Meltdown. Cross-Origin-Embedder-Policy: require-...
0
votes
3answers
118 views

Can I use some modified browser for gaining upper hand on a front-end?

Browsers follow certain standards to securely render webpages and execute scripts. But it's all in browser. An example is that I can't access stuff inside a JS module from the browser console. What if ...
2
votes
2answers
170 views

Realistically, how likely it is to have a computer compromised from browsing random websites?

Another question inspired by a recent discussion in the 'The DMZ' chatroom. Long story short: IT guys are worried that accountants' workstations may become compromised because accountants watch cat ...
0
votes
0answers
66 views

What is the possible impact of inserting user input into image src?

A website takes user input and pass into img src. What is the possible impact that I can do with it? <img src="https://website.com/static/{user-input}"> I did think of some options: ...
0
votes
0answers
69 views

How do developers prevent a third party from looking at exposed information on a javascript console? For example on a public computer

If a user was using your application on a public computer and were to log out of your website without closing the tab, the next person to use this computer could snoop through the console and look for ...
0
votes
1answer
68 views

Analyzing potential threats from re-directs

I just clicked a link on pinterest to take me to the source website. Upon clicking, it took me to the following 5 links: https://s3.amazonaws.com/bishkek0303/decorative-graphic-design-element-in-...
0
votes
1answer
151 views

What are the ways to browse the web without exposing a a manually operated computer's IP address?

I figure these as the ways to browse the web without exposing a manually operated computer's IP address: Proxy (such as "download from us" proxy) VPN TOR Using a remote GUI operating system ...
0
votes
1answer
60 views

What technologies used in a web browser, if any, can be used to push a binary from a server to a client machine?

This question is about if any technologies used by a web browser (HTTP, TCP, JavaScript, etc.) can be used to push a binary file from the web server to a random folder on the client. This is for a ...
0
votes
1answer
103 views

Is it possible to protect browser credentials from malicious processes?

What items should be considered to create a browser that prevents all access to stored credentials by a malicious process? Hardware attacks being out of scope. Are there public projects addressing ...
1
vote
1answer
115 views

Is 2FA based on Google Authenticator Real?

I was reading this response on SE about 2FA: Well, I hate to break this to you, but Google Authenticator plus password isn't really two-factor authentication. Proper 2FA is two separate items out of ...
0
votes
1answer
205 views

Why are there no modern web browsers that allow extension access to SSL information about the site you are browsing?

In all my Googling, I found one version of FireFox that allowed it temporarily a long time ago, it has been discussed on the Chromium development forums for years, but yet, as of today, there is still ...
0
votes
0answers
64 views

Confirm User Account Without Exposing IP of Server?

Right now, when a user signs up for a new account on my site, the server sends the user a email verification link. When the user clicks the verification link, the link redirects to my server to ...
1
vote
1answer
91 views

Can a program log your browser activity with taskbar names?

There's this old reddit thread where the OP notes that Discord's desktop client regularly logs the processes on your computer using QueryNameInformationFile, then claims that Discord "proceeds to ...
3
votes
1answer
180 views

Is it better to disable X-XSS-Protection header or set the header as X-XSS-Protection: 0?

Because X-XSS-Protection header is now not supported by major browsers I wonder what option is better, to delete this header or to set the header as X-XSS-Protection: 0? Because browsers do not ...
1
vote
0answers
32 views

Is checking to see if any parameters contain "__proto___" an effective way to mitigate Prototype Pollution vulnerability?

let key = keys[j] === '' ? (currentParams as any).length : keys[j]; if (key === '__proto__') { throw new Error('Prototype pollution detected.'); } It at least defeats basic url-encoding,...
3
votes
2answers
284 views

A runtime sometimes converts string arguments (or string returns) from WTF-16 to UTF-16 between functions in a call stack. Is this a security concern?

Suppose that we have this code (in TypeScript syntax): function one(str: string): string { // do something with the string return str } function two() { let s = getSomeString() // returns some ...
0
votes
2answers
239 views

Why are web browsers insecure?

Currently in the news is yet another hack, this time from NSO and it is reported that an attack vector is via a web link. This is far from unique, as we have got used to advice to not click on "...
0
votes
1answer
128 views

What are the risks when using proxy such as Fiddler

I would like to understand a point. When I use fiddler it creates a local proxy to analyze the traffic, so far everything is fine. However when Fiddler is launched and I browse an HTTPS site the ...
0
votes
0answers
22 views

Why does Firefox claim a site has a "Potential Security Risk"? [duplicate]

When trying to go to https://www.pfizerpapconnect.com, the Firefox web browser claims there is a "Potential Security Risk" and pops up a page recommending to not proceed. Is there a real ...
1
vote
1answer
108 views

How could I know if a website is fingerprinting you via WebGL?

I would like to know if a website is fingerprinting me via WebGL, first of all, knowing if the site is doing it Knowing when they send the request to my browser Knowing what value I am reporting to ...
1
vote
1answer
111 views

Is wiping cookies, blocking trackers and not logging in sufficient to prevent profiling?

I use Firefox as my browser. My privacy settings are strict. I block All third-party cookies, and always delete all cookies when Firefox is closed. Tracking content (in all windows); Cryptominers; ...
0
votes
1answer
47 views

Public Key Pinning Attack? [duplicate]

I'm somewhat knowledgeable in the concept of Public Key Pinning (HPKP) and I see a potential attack where a server admin could pin a particular cert and thus demanding user's browsers to only honour ...
0
votes
1answer
41 views

Does moving webAuthn API from browser to OS improves security of registration process?

Usually, for all types of authentications, we trust the registration process and assume there is no attack is happening Like in the case of FIDO2 registration. However, as the registration process is ...
5
votes
1answer
173 views

Is it safe to allow CSS filter: url(data:<SVG SOURCE HERE>)?

We have a web service where logged in users can create web page content and write custom CSS for their pages. All the HTML goes through a whitelist parser and doesn't allow any executable content. All ...
0
votes
0answers
46 views

How risky it is if a server allows client Javascript access to say an access token in header?

After authenticated by Google, a client browser attaches the idToken from Google to an application API server. Assuming google-auth-library auto-refresh an expired token, it now needs to send it back ...
0
votes
1answer
248 views

What is the workflow from client to server for SSL enabled sites?

I have a basic question on workflow of SSL enabled sites from client browser to server. My understanding is when the browser has to access some https enabled site, the browser contacts some CAs. I am ...
1
vote
2answers
193 views

Browser fingerprint is unique while running a VM of a clean install of Windows 10

So I used Qemu on Ubuntu 20 to emulate a computer running windows 10. I kept all of Qemu default values. Then, while installing the Windows 10 iso, I kept all the default values once again. Finally, I ...
0
votes
0answers
61 views

Ad popups showing on personal website deployed on VPS

I have a Spring-MVC webapp deployed on a Hostinger VPS server (OS: Ubuntu 18.04, Apache2 + Tomcat servers). For some reason, every now and then, clicking on random regions within the web pages of my ...
0
votes
3answers
85 views

On what types of web content is a Content-Security-Policy useful?

The W3C spec for Content-Security-Policy or Mozilla CSP docs would be the definitive source for this answer, but it does not seem covered, so I'm asking here for answers based on people's experience. ...
0
votes
2answers
149 views

How does a browser stop malware from executing? [duplicate]

When it comes to infections with viruses, in almost all cases the initial infection requires some sort of user interaction - apart from those cases where a plug-in has some sort of security flaw which ...
1
vote
1answer
179 views

Is it still possible to get a virus simply by visiting a website? [closed]

I know this is a duplicate question, but there aren't any recent updates on the answers given to this question(here and here) and after a few years, I'm sure browser security has improved drastically. ...
7
votes
2answers
249 views

Simple way to safely paste text from website into terminal

It's fairly well known that it's very dangerous to copy-paste text from a website into a terminal, as it can include extra text, control codes, and newlines that aren't visible when you're copying it, ...
0
votes
1answer
92 views

Identifying unique visitor using only info that can be gathered through the browser?

There is a site that allows a voter to vote for their favorite nominee once a day for a certain amount of days. While entering a vote, the only info given is the ballot choice you choose and nothing ...
0
votes
1answer
88 views

Is every plain flow into a dangerous sink exploitable?

Given a flow of information (for example from the URL) into a sink on a certain site, and given that this information is plain, i.e. is not sanitized, does this mean that if an attacker could control ...
0
votes
0answers
81 views

Sending meaningless Addresses requests to a series of malicious IPs

i was testing somethings on browsers(It has nothing to do with what I am going to say) and accidentally i faced a case that when i browse meaningless addresses like abc/ signortest/ word/ the request ...
0
votes
3answers
115 views

Can a compromized browser know your ISP's IP even if using a VPN?

Let's say you use a reliable VPN like ProtonVPN to browse the Internet. In theory, can a compromized browser betray you? Does it has access to your ISP's IP? As a bigger picture, if you want to upload ...
5
votes
1answer
529 views

How did Firefox get my passwords?

I just installed Firefox browser, while I have previously used Google Chrome as my main browser. I am using Windows 10. During the installation and setup process for Firefox, I was given the option to ...
1
vote
1answer
105 views

How can I protect browser cached files to be accessed in a case of a stolen hard drive?

For the usual reasons we want to cache certain resources browser side, e.g. list of products bought in the past. Context is a web application, accessed via the internet. This list is confidential in ...

1
2 3 4 5
32