Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [web-browser]

A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

0
votes
1answer
35 views

CSP - Unsafe-inline or unsafe-eval for specific domain is allowed or not

Following is a CSP policy, for example derived sample response headers. The implementation below allows white-listed domains only in "script-src" directive but the 'unsafe-inline' and 'unsafe-eval' ...
2
votes
1answer
40 views

Does MathML pose a security risk?

MathML seems like a promising and attractive technology. But Google Chrome doesn't support it, allegedly because it has "architectural security issues" according this wikipedia page. But it also says "...
3
votes
2answers
122 views

How can a client verify that code sent from the server has not been tampered with?

While trying to understand the recent controversy involving ProtonMail, I started to wonder if its possible to verify that the opensource JavaScript being sent from the server to the client hasn't ...
0
votes
0answers
14 views

From a technical perspective, how are popups like this generated on a smartphone? [closed]

I'm a SysAdmin and dabble in code a bit, but I'm not a developer and certainly don't know frontend stuff like this. How are these oh-so-annoying and ubiquitous popups created exactly? HTML5? ...
0
votes
1answer
86 views
+50

SameSite cookie attribute and Synchronizer Token Pattern

Recently most browser have added support to the SameSite cookie attribute to prevent CSRF attacks: https://www.owasp.org/index.php/SameSite Question if it is supported should we implement ...
0
votes
1answer
89 views

Does having in-browser password managers further the risks of successful CSRF attacks?

When successful CSRF attacks are executed they have the ability to access credentials and other information between the victim and the site. Are the sites username and password that are stored in the ...
1
vote
2answers
65 views

Why do browsers disallow accessing files from local file system even if the HTML document is also on the local file system?

Many browsers do not allow you to access files on the local filesystem with JavaScript (even if the HTML document is also on the local filesystem). (source) Yes I know that the solution is to "...
1
vote
2answers
95 views

How do web browsers detect XSS attempts when the X-XSS-Protection header is enabled?

Simple question but hard to understand how web browsers make the distinction between legitimate and malicious code when mode=block is enabled? Of course, I would like to know how each rendering ...
1
vote
1answer
63 views

Websites that fill back button history with questionable pages

Occasionally I see links like the following (don't visit this on your main computer) that I am redirected to on Google. The back button will either redirect back to the page, or some other ...
0
votes
1answer
119 views

Google Chrome Linux with Activity of Unknown Device

I've recently noticed a strange comportment on my Google Chrome Browser with GMail, where suddenly appeared a connected Unknown Device, with a double connection and with the same IP than mine, looking ...
1
vote
1answer
73 views

Rationale for “install software on computer” functionality in browsers

So after someone mentioned Hangul on another SE site, I just felt like watching another few Korean lessons. Came across a video that I liked, and the author finished with the (usual) more-on-my-...
0
votes
0answers
30 views

How to legally verify a digital signature was validly created and used, and the audit trail was not forged

I am still learning about how exactly a digital signature is created, but I'm wondering about the process of making sure a digital signature was actually created by the end user. For example, say a ...
3
votes
1answer
56 views

What data related to a specific web page can be obtained outside the browser?

The browser has several built-in storages, such as local storage or indexedDB. Does it make sense to store sensitive data in them if there is a risk that some malware can access the browser's data ...
0
votes
1answer
36 views

Is there any way to encrypt form data header values which can be seen in network resources? [duplicate]

I'm able to see my credentials here in this picture which is fb's form data I don't know if that is supposed to be like that or a problem of browser But for my website, I don't want this in ruby on ...
-1
votes
0answers
80 views

“Content-Security-Policy” HTTP Header with “default-src 'self'; script-src 'self'” not blocking downloading of non specify domain

I am trying to only allow 'self' and 'https://cdn.jsdelivr.net' by using: "add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://cdn.jsdelivr.net"; I encountered an ...
1
vote
2answers
77 views

Encrypt but not verify sender identity https without nagging user?

I have a five or six personal websites that I would like to send over https so isps can't inject ads. They're nothing sites hosted on a $60/year shared server. If I want to buy a https certificate I ...
85
votes
8answers
14k views

What attacks are made possible by public release of my web history?

Assume that my Internet history is made public (accidentally or on purpose). And this release is over 24 hours since the visits were made. Also, assume that there aren't embarrassing sites on there: ...
57
votes
1answer
4k views

Does a client certificate identify the owner to unrelated websites?

If I install a client certificate in my browser, which websites can see any information about this client certificate or the CA that issued it? I once visited an ssl diagnostic site that immediately ...
1
vote
1answer
75 views

Can Arbitrary Code Execution be done using CSS Injection?

As part of our class project, we are studying the attacks that could be done using CSS Injection. In our threat model, attacker can manipulate any CSS file on the server. If attacker replaces original ...
8
votes
1answer
457 views

Is Stylish safe to use again?

Stylish is/was a very popular extension for the Chrome and Firefox web browsers, which let users add custom styles to certain websites. I was using it myself, until a helpful fellow told me it was ...
-1
votes
2answers
86 views

Is it possible for my school to see the apps that I use?

So I've seen that they can see stuff if you search it on Google, Bing, etc., but can they see the apps on my phone like Snapchat, Instagram, etc.? If so, can they see me using them?
69
votes
10answers
17k views

Why is JavaScript “safe” to run in the browser?

JavaScript has certain limitations such as preventing reading and writing to disk and not allowing access to other browser windows or domains. But is that all that's needed to prevent malicious code ...
0
votes
1answer
174 views

Access-Control-Allow-Origin wildcard doesnt allow sending session cookies

I always thought CORS restrictions was to disable the following scenario: I enter attacker.com, JS sends GET facebook.com, my browser adds my cookies, attacker.com has access to my facebook profile/...
0
votes
1answer
50 views

SSL session key usage when browser opens multiple sockets to same server

Does a browser tab that opens multiple SSL-secured TCP sockets to the same server use the same session ID and keys for those sockets? I’ve seen pages served using HTTP open 5 or 6 sockets at the same ...
0
votes
1answer
26 views

Displaying username in profile section of a Web Application

Is it a good idea to display the username in the user profile section of a web application, when the user is already logged in? My web application uses basic authentication and does not have any 2 ...
3
votes
1answer
78 views

Why does not Referer header use “same-origin” by default?

Same origin policy is an important part of the security model so it is "on" by default for most things, but for the referer it does not seem to be so. The default for browsers seem to be no-referrer-...
0
votes
1answer
64 views

Inject JavaScript code into websites requested by an Android app? [closed]

How can I add custom scripts to pages I'm opening on Android via Chrome, Firefox or any other internet browsing app?
4
votes
1answer
122 views

Is information still being sent from a discarded tab in my browser?

I was connected to my workplace wifi via my personal phone for 10 minutes. I did not open anything strange that could get me into trouble. I was doing some work. However, when I finished looking up ...
0
votes
1answer
83 views

Why are there no browser feature or extension to only check the domain and username to prevent phishing?

One of the recommendations to prevent phishing using look-alike domain names (like www.google.com.phishing.org or IDN homograph attacks) is to use a password manager or a physical security token like ...
3
votes
1answer
41 views

When I upload a file on browser, will the server know my file path or disk info?

I believe server can know my file name. What other info will browser tell the server? File path? Disk info?
15
votes
3answers
355 views

Are browser wrappers in software bad for users?

These days I see a lot of browser wrappers in software. For example: when you purchase something in the Steam desktop application and use PayPal, you enter your PayPal security details in a browser ...
2
votes
2answers
93 views

Do browsers XSS filters protect against DOM based XSS?

Many (but not all) browsers come with built in XSS protection that can be activated with a HTTP header: X-XSS-Protection: 1; mode=block As I understand it, it prevents reflected XSS attacks by ...
0
votes
2answers
84 views

Is chrome's prediction service for faster page loading vulnerable to attacks? is it safe to leave it on?

Chrome offers a "prediction service" for faster page loading. It might load some links on a page before you even click on them: Use a prediction service to load pages more quickly: Browsers use an ...
0
votes
2answers
108 views

Can employers log internet traffic of employees personal computers? [closed]

I have a suspicion that my employer is misusing their work monitoring and remote access software to check my online activity outside of work. I have the software installed on my personal machine as I ...
2
votes
0answers
137 views

How to extract browser login credentials from memory dump? [closed]

Does anyone know if there is a way to extract passwords for social networks like from a browser memory dump? I tried this tutorial without success. I used dumpit.exe tool to make a full dump of the ...
15
votes
3answers
4k views

Does incognito/private browsing prevent XSS attacks?

When starting an incognito/private browsing session, no cookies from other browsing profiles should exist. For example, if I am logged in to a site on my main browsing profile, then start a new ...
5
votes
1answer
635 views

Danger of browser extension without any permissions?

Assuming that an extension for Firefox or Chrome does not request any WebExtensions permission, what harm could this extension do? Or put another way: What (potentially malicious) actions can an ...
0
votes
3answers
71 views

Determine All Possible Fields in HTML Form

Is it possible to determine, from the client-side, all the valid fields for a given backend form processor, even if they are excluded from the webpage containing the form? For example: Assume a ...
83
votes
5answers
20k views

Can “Accept cookie” button in a website be malicious?

I don't remember when this "accept/cancel cookie" button started to be used in websites. Why do they insist on getting users to click on this button? Can it do any harm to user's PC or to collect ...
-2
votes
1answer
79 views

Are schools over protective? [closed]

My school says that they can see their students history, but is it possible for them to do so even though you are using your own device?
2
votes
1answer
63 views

Can my VPN provider see my browsing activities on SSL sites? [duplicate]

I gather they can probably see everything if they want to on non-SSL sites but how about on SSL sites, can they do it?
-1
votes
1answer
42 views

Infection of malware

Lets say, My firewall is configured to block any incoming connections My browser doesnt allow any traces and scripts I have vpn on My browser always asks before downloading files My browser doesn't ...
2
votes
2answers
213 views

Is single-click phishing possible?

For Chrome, IE/Edge, Safari, Firefox, Opera released after 2018, is it possible for a phishing to succeed by just enticing a user to click a URL? Notice: The user only does a click on the URL, no ...
1
vote
2answers
139 views

Is it secure to interact with a web page before it has fully loaded?

Web pages are often displayed in the browser before they have finished fully loading (i.e. the loading indicator is still spinning, etc). Usually this is caused by a slow advert or a video, etc. But ...
1
vote
0answers
80 views

What is the essence of Google Chrome’s new controversial sign-in feature?

What is the essence of Google Chrome’s new controversial sign-in feature? How does it work and how does it differ from what was it before? What is the danger of it? Is Chromium affected?
3
votes
1answer
132 views

Invalid certificate name on go,microsoft.com

About 1 times out of 20, going to go.microsoft.com displays this page: The certificate is for www.holidaycheck.de which doesn't make sense. (Note: I'm Canadian, not Deutsch.) The other 19 times, I ...
3
votes
3answers
298 views

Security benefits of disabling Chrome Incognito mode?

The company I work for has disabled Incognito mode for Chrome (but allows InPrivate windows for Edge) and when I enquired why, I was told it was for security reasons. As a developer, I find Incognito ...
33
votes
8answers
12k views

Why should browser security be prioritized?

From this answer about browser security: time to update if you really care about security So if every other software and functions I need can work on a 32-bit OS, I guess the only reason for ...
0
votes
2answers
137 views

Why IPv6 showing on whatismyip.com?

I use Tor Browser on Whonix. Why I see IPv6 (something like 3221:23f9:c:67h:0:0:0:3) on whatismyip.com? Is that website can see my MAC Address?
2
votes
1answer
65 views

Risks of letting the browser open local/network file system listing

Browsers do not generally allow web pages to interact with client-side file system as a security measure. I would like to know what can go wrong with the following scenario: Clicking a special ...