Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [web-browser]

A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

2
votes
2answers
83 views

Are some privacy add-ons superfluous when using Tor browser?

If running the Tor browser, should you still have the same privacy add-ons as you would if you were running a "regular" browser? Or will some of them be superfluous because of the built-in ...
1
vote
1answer
41 views

Understanding which privacy tools provide very similar functionality

https://amiunique.org/tools has a list of recommended privacy tools. uBlock Ghostery HTTPS Everywhere Lightbeam AdBlock Plus Disconnect Privacy Badger NoScript Self-destructing cookies However, aren'...
2
votes
1answer
81 views

Opera browser: no master password?

I've recently moved from Firefox to Opera (for performance issues). I used to protect my passwords in Firefox with a Master Password. But Opera, so it appears, lacks such feature. I use Debian 9.7 ...
0
votes
1answer
73 views

What's the security concern of browsers using the HTTP CONNECT method?

The XMLHttpRequest spec says that attempted usage of the CONNECT method should throw a security error. Is there a security issue with client-side JavaScript sending CONNECT requests to servers? It ...
0
votes
0answers
32 views

How to check if installed Trusted CAs are not dangerous? [duplicate]

I've checked my Windows 7 installed Trusted Certificate Authorities using MMC tool as below: Questions are: How can I be sure that they are genuine and are installed by Microsoft and not by a third-...
1
vote
1answer
53 views

How to verify website owner behind CloudFlare SSL?

I went to Bittrex today and noticed the SSL certificate is issued to CloudFlare, not Bittrex, as seen in the screenshot below. I'm used to seeing information on this screen which can be recognized as ...
0
votes
0answers
25 views

What information can be obtained with my public ip? [duplicate]

As I understand it, my public ip is known for everyone who communicates with me over the internet. I'm concerned about security, and my doubt is, what can a malicious agent find out about me by ...
4
votes
2answers
85 views

Can a web app fingerprint your device as identical to a native app's fingeprint

I have installed an app on Android and my account got shadowbanned. I sniffed out the traffic with fiddler and see they use a analytics service that assigns your device a fingerprint. I tried the web ...
0
votes
1answer
36 views

Smart cards and the behaviour of the browser. Is the PIN cached?

When using smart cards for certificate-based authentication, is the PIN entered by the user to authenticate his smart card to the browser is cached? OR does the certificate gets cached by the browser? ...
2
votes
0answers
25 views

Collecting PII in an iframe on any website. Is it Safe?

I am building a chrome extension that allows users to submit a form on any website. Once a user would visit a certain website, extension would open iframe on that website and ask user for some PII in ...
0
votes
1answer
78 views

Can an attacker steal information from my HTTPS page by embedding it?

If a login page, secured with https/tls redirects to another site (also secured with https/tls) with a onetime use token (expires in a minute and has a nonce) in the querystring, can this token be ...
1
vote
0answers
33 views

Privacy & tracking concerns regarding Service Workers

TL;DR Should I be concerned about sites I have visited start a service worker in my browser which happens to be listening for events "forever"? Can a dormant service worker track me? Longer ...
0
votes
0answers
24 views

Clickjacking when essential JavaScript code accesses attribute of 'top'?

Given a website which doesn't use any protection specifically against Clickjacking (no X-Frame-Options or CSP), but which does access an attribute of top in essential JavaScript code, eg: // http://...
0
votes
1answer
60 views

CSP - Unsafe-inline or unsafe-eval for specific domain is allowed or not

Following is a CSP policy, for example derived sample response headers. The implementation below allows white-listed domains only in "script-src" directive but the 'unsafe-inline' and 'unsafe-eval' ...
2
votes
1answer
49 views

Does MathML pose a security risk?

MathML seems like a promising and attractive technology. But Google Chrome doesn't support it, allegedly because it has "architectural security issues" according this wikipedia page. But it also says "...
3
votes
2answers
130 views

How can a client verify that code sent from the server has not been tampered with?

While trying to understand the recent controversy involving ProtonMail, I started to wonder if its possible to verify that the opensource JavaScript being sent from the server to the client hasn't ...
0
votes
1answer
126 views

SameSite cookie attribute and Synchronizer Token Pattern

Recently most browser have added support to the SameSite cookie attribute to prevent CSRF attacks: https://www.owasp.org/index.php/SameSite Question if it is supported should we implement ...
0
votes
1answer
93 views

Does having in-browser password managers further the risks of successful CSRF attacks?

When successful CSRF attacks are executed they have the ability to access credentials and other information between the victim and the site. Are the sites username and password that are stored in the ...
1
vote
2answers
71 views

Why do browsers disallow accessing files from local file system even if the HTML document is also on the local file system?

Many browsers do not allow you to access files on the local filesystem with JavaScript (even if the HTML document is also on the local filesystem). (source) Yes I know that the solution is to "...
1
vote
2answers
115 views

How do web browsers detect XSS attempts when the X-XSS-Protection header is enabled?

Simple question but hard to understand how web browsers make the distinction between legitimate and malicious code when mode=block is enabled? Of course, I would like to know how each rendering ...
1
vote
1answer
69 views

Websites that fill back button history with questionable pages

Occasionally I see links like the following (don't visit this on your main computer) that I am redirected to on Google. The back button will either redirect back to the page, or some other ...
0
votes
1answer
168 views

Google Chrome Linux with Activity of Unknown Device

I've recently noticed a strange comportment on my Google Chrome Browser with GMail, where suddenly appeared a connected Unknown Device, with a double connection and with the same IP than mine, looking ...
1
vote
1answer
84 views

Rationale for “install software on computer” functionality in browsers

So after someone mentioned Hangul on another SE site, I just felt like watching another few Korean lessons. Came across a video that I liked, and the author finished with the (usual) more-on-my-...
0
votes
0answers
31 views

How to legally verify a digital signature was validly created and used, and the audit trail was not forged

I am still learning about how exactly a digital signature is created, but I'm wondering about the process of making sure a digital signature was actually created by the end user. For example, say a ...
3
votes
1answer
57 views

What data related to a specific web page can be obtained outside the browser?

The browser has several built-in storages, such as local storage or indexedDB. Does it make sense to store sensitive data in them if there is a risk that some malware can access the browser's data ...
0
votes
1answer
40 views

Is there any way to encrypt form data header values which can be seen in network resources? [duplicate]

I'm able to see my credentials here in this picture which is fb's form data I don't know if that is supposed to be like that or a problem of browser But for my website, I don't want this in ruby on ...
1
vote
2answers
79 views

Encrypt but not verify sender identity https without nagging user?

I have a five or six personal websites that I would like to send over https so isps can't inject ads. They're nothing sites hosted on a $60/year shared server. If I want to buy a https certificate I ...
85
votes
8answers
14k views

What attacks are made possible by public release of my web history?

Assume that my Internet history is made public (accidentally or on purpose). And this release is over 24 hours since the visits were made. Also, assume that there aren't embarrassing sites on there: ...
57
votes
1answer
4k views

Does a client certificate identify the owner to unrelated websites?

If I install a client certificate in my browser, which websites can see any information about this client certificate or the CA that issued it? I once visited an ssl diagnostic site that immediately ...
1
vote
1answer
80 views

Can Arbitrary Code Execution be done using CSS Injection?

As part of our class project, we are studying the attacks that could be done using CSS Injection. In our threat model, attacker can manipulate any CSS file on the server. If attacker replaces original ...
9
votes
1answer
657 views

Is Stylish safe to use again?

Stylish is/was a very popular extension for the Chrome and Firefox web browsers, which let users add custom styles to certain websites. I was using it myself, until a helpful fellow told me it was ...
-1
votes
2answers
88 views

Is it possible for my school to see the apps that I use?

So I've seen that they can see stuff if you search it on Google, Bing, etc., but can they see the apps on my phone like Snapchat, Instagram, etc.? If so, can they see me using them?
71
votes
10answers
17k views

Why is JavaScript “safe” to run in the browser?

JavaScript has certain limitations such as preventing reading and writing to disk and not allowing access to other browser windows or domains. But is that all that's needed to prevent malicious code ...
0
votes
1answer
512 views

Access-Control-Allow-Origin wildcard doesnt allow sending session cookies

I always thought CORS restrictions was to disable the following scenario: I enter attacker.com, JS sends GET facebook.com, my browser adds my cookies, attacker.com has access to my facebook profile/...
0
votes
1answer
67 views

SSL session key usage when browser opens multiple sockets to same server

Does a browser tab that opens multiple SSL-secured TCP sockets to the same server use the same session ID and keys for those sockets? I’ve seen pages served using HTTP open 5 or 6 sockets at the same ...
0
votes
1answer
26 views

Displaying username in profile section of a Web Application

Is it a good idea to display the username in the user profile section of a web application, when the user is already logged in? My web application uses basic authentication and does not have any 2 ...
3
votes
1answer
88 views

Why does not Referer header use “same-origin” by default?

Same origin policy is an important part of the security model so it is "on" by default for most things, but for the referer it does not seem to be so. The default for browsers seem to be no-referrer-...
0
votes
1answer
64 views

Inject JavaScript code into websites requested by an Android app? [closed]

How can I add custom scripts to pages I'm opening on Android via Chrome, Firefox or any other internet browsing app?
4
votes
1answer
122 views

Is information still being sent from a discarded tab in my browser?

I was connected to my workplace wifi via my personal phone for 10 minutes. I did not open anything strange that could get me into trouble. I was doing some work. However, when I finished looking up ...
0
votes
1answer
86 views

Why are there no browser feature or extension to only check the domain and username to prevent phishing?

One of the recommendations to prevent phishing using look-alike domain names (like www.google.com.phishing.org or IDN homograph attacks) is to use a password manager or a physical security token like ...
3
votes
1answer
43 views

When I upload a file on browser, will the server know my file path or disk info?

I believe server can know my file name. What other info will browser tell the server? File path? Disk info?
15
votes
3answers
363 views

Are browser wrappers in software bad for users?

These days I see a lot of browser wrappers in software. For example: when you purchase something in the Steam desktop application and use PayPal, you enter your PayPal security details in a browser ...
2
votes
2answers
112 views

Do browsers XSS filters protect against DOM based XSS?

Many (but not all) browsers come with built in XSS protection that can be activated with a HTTP header: X-XSS-Protection: 1; mode=block As I understand it, it prevents reflected XSS attacks by ...
0
votes
2answers
95 views

Is chrome's prediction service for faster page loading vulnerable to attacks? is it safe to leave it on?

Chrome offers a "prediction service" for faster page loading. It might load some links on a page before you even click on them: Use a prediction service to load pages more quickly: Browsers use an ...
0
votes
2answers
108 views

Can employers log internet traffic of employees personal computers? [closed]

I have a suspicion that my employer is misusing their work monitoring and remote access software to check my online activity outside of work. I have the software installed on my personal machine as I ...
2
votes
0answers
187 views

How to extract browser login credentials from memory dump? [closed]

Does anyone know if there is a way to extract passwords for social networks like from a browser memory dump? I tried this tutorial without success. I used dumpit.exe tool to make a full dump of the ...
15
votes
3answers
4k views

Does incognito/private browsing prevent XSS attacks?

When starting an incognito/private browsing session, no cookies from other browsing profiles should exist. For example, if I am logged in to a site on my main browsing profile, then start a new ...
5
votes
1answer
689 views

Danger of browser extension without any permissions?

Assuming that an extension for Firefox or Chrome does not request any WebExtensions permission, what harm could this extension do? Or put another way: What (potentially malicious) actions can an ...
0
votes
3answers
74 views

Determine All Possible Fields in HTML Form

Is it possible to determine, from the client-side, all the valid fields for a given backend form processor, even if they are excluded from the webpage containing the form? For example: Assume a ...
84
votes
5answers
20k views

Can “Accept cookie” button in a website be malicious?

I don't remember when this "accept/cancel cookie" button started to be used in websites. Why do they insist on getting users to click on this button? Can it do any harm to user's PC or to collect ...