Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [web-browser]

A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

1
vote
0answers
45 views

How to extract browser login credentials from memory dump? [on hold]

Does anyone know if there is a way to extract passwords for social networks like from a browser memory dump? I tried this tutorial without success. I used dumpit.exe tool to make a full dump of the ...
15
votes
3answers
4k views

Does incognito/private browsing prevent XSS attacks?

When starting an incognito/private browsing session, no cookies from other browsing profiles should exist. For example, if I am logged in to a site on my main browsing profile, then start a new ...
4
votes
1answer
65 views

Danger of browser extension without any permissions?

Assuming that an extension for Firefox or Chrome does not request any WebExtensions permission, what harm could this extension do? Or put another way: What (potentially malicious) actions can an ...
-4
votes
1answer
42 views

How can I change duckduckgo to show results by pages? [on hold]

I recently changed my browser to duckduckgo. I really enjoy it so far, but I'm not a fan of the More button showing the results in one continuous page. Is there any way to change this functionality to ...
0
votes
3answers
69 views

Determine All Possible Fields in HTML Form

Is it possible to determine, from the client-side, all the valid fields for a given backend form processor, even if they are excluded from the webpage containing the form? For example: Assume a ...
82
votes
5answers
19k views

Can “Accept cookie” button in a website be malicious?

I don't remember when this "accept/cancel cookie" button started to be used in websites. Why do they insist on getting users to click on this button? Can it do any harm to user's PC or to collect ...
-1
votes
1answer
73 views

Are schools over protective? [closed]

My school says that they can see their students history, but is it possible for them to do so even though you are using your own device?
1
vote
1answer
43 views

Can my VPN provider see my browsing activities on SSL sites? [duplicate]

I gather they can probably see everything if they want to on non-SSL sites but how about on SSL sites, can they do it?
0
votes
0answers
124 views

Something is visiting every URL after I do. What is it?

For each time I visit a unique URL on my web server, a mostly random Amazon owned IP address visits that URL fairly soon after. If I have a query string, and I use the same one that it's already ...
-1
votes
1answer
35 views

Infection of malware

Lets say, My firewall is configured to block any incoming connections My browser doesnt allow any traces and scripts I have vpn on My browser always asks before downloading files My browser doesn't ...
2
votes
2answers
147 views

Is single-click phishing possible?

For Chrome, IE/Edge, Safari, Firefox, Opera released after 2018, is it possible for a phishing to succeed by just enticing a user to click a URL? Notice: The user only does a click on the URL, no ...
1
vote
2answers
132 views

Is it secure to interact with a web page before it has fully loaded?

Web pages are often displayed in the browser before they have finished fully loading (i.e. the loading indicator is still spinning, etc). Usually this is caused by a slow advert or a video, etc. But ...
1
vote
0answers
76 views

What is the essence of Google Chrome’s new controversial sign-in feature?

What is the essence of Google Chrome’s new controversial sign-in feature? How does it work and how does it differ from what was it before? What is the danger of it? Is Chromium affected?
3
votes
1answer
90 views

Invalid certificate name on go,microsoft.com

About 1 times out of 20, going to go.microsoft.com displays this page: The certificate is for www.holidaycheck.de which doesn't make sense. (Note: I'm Canadian, not Deutsch.) The other 19 times, I ...
3
votes
3answers
254 views

Security benefits of disabling Chrome Incognito mode?

The company I work for has disabled Incognito mode for Chrome (but allows InPrivate windows for Edge) and when I enquired why, I was told it was for security reasons. As a developer, I find Incognito ...
33
votes
8answers
12k views

Why should browser security be prioritized?

From this answer about browser security: time to update if you really care about security So if every other software and functions I need can work on a 32-bit OS, I guess the only reason for ...
1
vote
2answers
101 views

Why IPv6 showing on whatismyip.com?

I use Tor Browser on Whonix. Why I see IPv6 (something like 3221:23f9:c:67h:0:0:0:3) on whatismyip.com? Is that website can see my MAC Address?
2
votes
1answer
61 views

Risks of letting the browser open local/network file system listing

Browsers do not generally allow web pages to interact with client-side file system as a security measure. I would like to know what can go wrong with the following scenario: Clicking a special ...
2
votes
1answer
45 views

Is it possible for page to get your installed extensions through javascript?

When you visit a page, could that page tell what extensions you are running if javascript is enabled? If so then could we stop them or at least make it extremely difficult to increase our privacy?
31
votes
2answers
2k views

How does subresource integrity actually help?

Subresource integrity basically lets me know that a resource I'm about to download is valid, because the hash of its contents matches what I expect. But this assumes that I'm already running on some ...
2
votes
1answer
45 views

Why/how is browser inserting inline SVGs at end of body?

Chrome is inserting the following SVG images at the bottom of pages: <span style="width: 24px; height: 24px; background: url(&quot;data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiA/...
1
vote
1answer
70 views

Will a browser exploit also work after I have downloaded the website? [closed]

When I visit a website which exploits a vulnerability in my browser and I save this website to my computer and open later the offline version can my browser be hacked again?
3
votes
1answer
69 views

Is cache-control: no-cache enough for sensitive information like bank accounts, etc.?

I have read somewhere that when storing sensitive information on a website you should include cache-control: no-store for telling the browser not to store that information on the local system. But I ...
1
vote
1answer
149 views

Bad medical security

I reside in Michigan, U.S.A and just recently took over the IT of a small medical practice. There is no real security in place and I am still undoing the horrific damage and lockouts put in place by ...
64
votes
2answers
8k views

Are EU cookie consent forms safe? [closed]

Does the EU consent form system pose a new security risk? Today we have to click OK on about 20 cookie consent forms every week, where previously we could mostly dismiss internet forms as being ...
-3
votes
2answers
135 views

Do cookies violate privacy and should not be used? [duplicate]

Cookies are just a simple text file or DB (some parts encrypted). There is no way to execute them and they cannot access other user data store. Normally cookies keep some data like session ID or ...
2
votes
1answer
71 views

GET, “mailto” warning - how can I tell if a site is secure?

My password manager is giving me a warning when I go to certain sites. They say if I think I can trust the site to go ahead and use it .... this leaves me concerned I'll miss something. The pop-up ...
1
vote
3answers
134 views

How exploit this open redirect vulnerability in browser?

I have a problem. I found open redirect vulnerability by burp. Request by server look like here: GET /user/settings/ HTTP/1.1 Host: domain.com User-Agent: etc So i decided to find open redirect ...
1
vote
1answer
34 views

How do modern browsers isolate different addons?

A user may have multiple addons installed on a browser. But typically, the browser is running in userspace with an unprivileged uid. I was wondering how modern browsers can, in such a setting, provide ...
2
votes
2answers
70 views

Is RSA key-like browser authentication feasible?

I see that password based authentication is out of favor today, and Internet is moving toward RSA keys-based authentication. Coming from that fact, I am wondering if there would be a real benefit to ...
2
votes
1answer
86 views

Is there something similar to Firejail for OpenBSD?

On Linux, Firejail (https://firejail.wordpress.com/) offers an easy way to sandbox web browsers and other programs. Is there an easy way to sandbox a web browser on OpenBSD ? (reserve question: is ...
5
votes
1answer
81 views

Security implications of download attribute

The download attribute in an a element tells the browser to force the download of a file that otherwise would be interpreted by the browser. This is very convenient, since often users want to download ...
1
vote
1answer
90 views

Why is the same origin policy sensible - for requests?

This is not the same question as Why is the same origin policy so important?. That one asks only about why cookies are only ever send to origin they came from, which I understand. What I don't ...
3
votes
1answer
41 views

Prevent reflecting page modified by browser extension

Suppose there is a trusted browser extension in a chrome browser that modifies the web page (like editing DOM, appending scripts, etc) I don't want anyone but me to see the page modified by this ...
1
vote
1answer
132 views

Unprotected connection to HTTPS web-page

A couple of days ago we noticed that when we go to our online banking login page (using Opera browser as usual) there is no green lock icon there anymore. Instead, there is a grey globe icon which ...
1
vote
1answer
38 views

Can request from different software on same machine to a server be identified to be from same origin by tracking TLS handshakes?

If two different users visit an website from two different browsers via HTTPS, can they be identified by the server to be from same origin (same client machine) using information available from TLS ...
2
votes
3answers
117 views

How come <img> calls do not violate the SOP (Same Origin Policy)?

I'm a bit confused regarding the subject of Same Origin Policy. If understand correctly. SOP's purpose is to prevent one page from obtaining access to sensitive data on another web page. So for ...
25
votes
7answers
5k views

Why do browsers allow custom root CAs?

At my work all browsers have a custom root CA installed, which then allows them to snoop on all https traffic while the users get the false impression that they are browsing a secure https page. Why ...
1
vote
2answers
110 views

Are quickly closed pop-up windows in browsers a threat?

Occasionally I'll be on sites I trust, and an ad will pop up. There will be an X saying to close the ad, in a pretty standard location (upper right corner of the frame, sometimes just outside the ...
1
vote
2answers
275 views

How to remove or at least change password from browser memory dump file [duplicate]

I am working with JSP. So when a user submits a form, all the form fields say username and password gets stored in browser memory dump file in clear text. I even tried with JSP hidden fields, but ...
2
votes
0answers
78 views

How does the Ruby on Rails CSRF Protection Work?

I am not sure i completely understand how Ruby on Rails handles CSRF protection. My understanding was that a token is generated and embedded in the HTML markup as a meta tag, and at the same time ...
1
vote
1answer
42 views

What is the “validity scope” of a browser cookie?

Consider the standard CSRF protection of a Ruby on Rails application: a CSRF token is embedded in the HTML page, while at the same time stored encrypted as part of the session cookie. When making a ...
3
votes
1answer
132 views

Why Same origin policy is based on host-name and not on IP?

Same origin policy is to restrict one page to access another document from accessing data. Because they have different origin where SOP define an origin as follows. An origin is defineed as ...
1
vote
1answer
104 views

Can an exploit in my browser read login passwords without logging in again?

When I log into my email account through a browser and open an email which exploits some vulnerability in my browser would it be possible for the attacker to take over my account? Passwords for full ...
0
votes
1answer
103 views

How browser parses the escape characters in Javascript (XSS)?

I am new to XSS attacks. Recently, I was doing a project and found that one of my input field (website) is vulnerable to XSS attack. The value in website field is inserted into a href of an anchor tag ...
1
vote
1answer
56 views

How to hide folders inside webroot from being identified?

I have a library inside my webroot: https://my-website.com/wp-content/my-library-i-want-to-hide Accessing the url via a browser gives me the expected permission denied error. However, I want to make ...
2
votes
2answers
310 views

Computer began downloading hundreds of blobs then froze

While my mother was trying to sign into her bank account, the download bar in Chrome filled up with hundreds of downloads. Her computer then froze so she restarted it and it seemed to work fine, and ...
0
votes
0answers
113 views

A browsing window/Tab as a Docker container Sandbox?

I want to know if there is a possibility to use browsers' Tabs and Windows as self-contained Docker images where we can benefit from more security by separating the sessions (some web browsers ...
2
votes
1answer
131 views

How do password managers implement secure browser integration? [closed]

Some password managers can automatically fill passwords in user's browser. But for this auto-fill to be secure, they have to make sure they are putting password in the correct input field, plus, the ...
-1
votes
2answers
376 views

What kind of security comes from blocking cross-origin-requests when cors exist? [duplicate]

Modern browsers block cross-origin-requests. That means, this will be blocked: jQuery.get("https://example.net"); Why blocking those requests? it's bad when content is loaded the user hasn't ...